Module filesystem 

Structs

ContextPopulator

Context populator - copies files from source to destination

LazyContextPopulator

Lazy context populator that supports both copy and bind mount modes

TmpfsMount

tmpfs mount manager

Enums

ContextMode

Context population mode

FilesystemState

Filesystem lifecycle state machine matching Nucleus_Filesystem_FilesystemLifecycle.tla

Constants

PROC_NULL_MASKED

Paths to mask with /dev/null (files) – matches OCI runtime spec masked paths. Exposed for testing; the canonical list of sensitive /proc entries that must be hidden from container processes.

PROC_READONLY_PATHS

Paths to remount read-only – matches OCI runtime spec readonlyPaths.

PROC_TMPFS_MASKED

Paths to mask with empty tmpfs (directories).

ROOTFS_ATTESTATION_FILE

Functions

audit_mounts

Audit all mounts in the container’s mount namespace.

bind_mount_host_paths

Bind mount essential host directories into container

bind_mount_rootfs

Bind mount a pre-built rootfs (e.g. a Nix store closure) into the container.

create_dev_nodes

Create essential device nodes in /dev

create_minimal_fs

Create minimal filesystem structure in the new root

mask_proc_paths

Mask sensitive /proc paths by bind-mounting /dev/null or tmpfs over them

mount_procfs

Mount procfs at the given path

mount_secrets

Mount secret files into the container root.

mount_secrets_inmemory

Mount secrets onto a dedicated in-memory tmpfs instead of bind-mounting host paths.

mount_volumes

Mount persistent bind volumes and ephemeral tmpfs volumes into the container root.

normalize_container_destination

Normalize an absolute container destination path and reject traversal.

normalize_volume_destination

Normalize and validate a user-supplied volume destination inside the container.

resolve_container_destination

Resolve a validated container destination under a host-side root directory.

resolve_volume_destination

Resolve a validated user-supplied volume destination under a host-side root directory.

snapshot_context_dir

switch_root

Switch to new root filesystem using pivot_root or chroot

validate_bind_mount_source

Validate that a bind mount source exists and is not a sensitive host path or subtree.

validate_bind_mount_source_policy

Validate bind-mount source policy without requiring the source to exist.

validate_production_rootfs_path

Validate a production rootfs path and return the canonical path to use.

verify_context_integrity

verify_context_manifest

verify_rootfs_attestation

Type Aliases

DirectoryManifest