Struct OciConfig 

pub struct OciConfig {
    pub oci_version: String,
    pub root: OciRoot,
    pub process: OciProcess,
    pub hostname: Option<String>,
    pub mounts: Vec<OciMount>,
    pub linux: Option<OciLinux>,
    pub hooks: Option<OciHooks>,
    pub annotations: HashMap<String, String>,
}

OCI Runtime Specification configuration

This implements a subset of the OCI runtime spec for gVisor compatibility Spec: https://github.com/opencontainers/runtime-spec/blob/main/config.md

Fields

oci_version: String

root: OciRoot

process: OciProcess

hostname: Option<String>

mounts: Vec<OciMount>

linux: Option<OciLinux>

hooks: Option<OciHooks>

annotations: HashMap<String, String>

Implementations

impl OciConfig

pub fn new(command: Vec<String>, hostname: Option<String>) -> Self

Create a minimal OCI config for Nucleus containers

pub fn with_resources(self, limits: &ResourceLimits) -> Self

Add resource limits to the config

pub fn with_no_new_privileges(self, enabled: bool) -> Self

Configure the OCI noNewPrivileges process flag.

pub fn with_env(self, vars: &[(String, String)]) -> Self

Add environment variables to the OCI process config.

pub fn with_sd_notify(self) -> Self

Add sd_notify socket passthrough.

pub fn with_secret_mounts(self, secrets: &[SecretMount]) -> Self

Add bind mounts for secrets.

pub fn with_process_identity(self, identity: &ProcessIdentity) -> Self

Set the process identity for the OCI workload.

pub fn with_inmemory_secret_mounts( self, stage_dir: &Path, secrets: &[SecretMount], ) -> Result<Self>

Add a read-only bind mount of an in-memory secret staging directory at /run/secrets, plus compatibility bind mounts for each staged secret to its requested container destination.

pub fn with_volume_mounts(self, volumes: &[VolumeMount]) -> Result<Self>

Add bind or tmpfs volume mounts.

pub fn with_context_bind(self, context_dir: &Path) -> Self

Bind mount the host context directory into the container.

The gVisor integration path expects /context to be writable so test workloads can write results back to the host.

pub fn with_rootfs_binds(self, rootfs_path: &Path) -> Self

Add rootfs bind mounts from a pre-built rootfs path.

pub fn with_namespace_config(self, config: &NamespaceConfig) -> Self

Replace the default namespace list with an explicit configuration.

pub fn with_host_runtime_binds(self) -> Self

Add read-only bind mounts for host runtime paths.

This mirrors the native fallback path for non-production containers so common executables such as /bin/sh remain available inside the OCI rootfs when no explicit rootfs is configured.

pub fn with_user_namespace(self) -> Self

Add user namespace configuration

pub fn without_network_namespace(self) -> Self

Remove the OCI network namespace entry so runsc inherits the process network namespace that Nucleus prepared before exec.

pub fn with_rootless_user_namespace(self, config: &UserNamespaceConfig) -> Self

Configure gVisor’s true rootless OCI path.

gVisor expects UID/GID mappings in the OCI spec for this mode, and its rootless OCI implementation does not currently support a network namespace entry in the spec. We still control networking through runsc’s top-level --network flag.

pub fn with_hooks(self, hooks: OciHooks) -> Self

Set OCI lifecycle hooks on the config.

pub fn with_rlimits(self, limits: &ResourceLimits) -> Self

Set process rlimits from the Nucleus runtime defaults and configured limits.

Mirrors the RLIMIT backstops applied in-process for native containers (runtime.rs), expressed as OCI config so gVisor can enforce them.

pub fn with_seccomp(self, seccomp: OciSeccomp) -> Self

Set the linux.seccomp section from an OCI seccomp config.

pub fn with_cgroups_path(self, path: String) -> Self

Set the linux.cgroupsPath field.

pub fn with_sysctl(self, sysctl: HashMap<String, String>) -> Self

Set sysctl key-value pairs on the linux config.

pub fn with_annotations(self, annotations: HashMap<String, String>) -> Self

Set annotations on the OCI config.

Trait Implementations

impl Clone for OciConfig

fn clone(&self) -> OciConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OciConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for OciConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OciConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.