Struct GVisorRuntime 

pub struct GVisorRuntime { /* private fields */ }

GVisor runtime manager

Implements the gVisor state machine from NucleusSecurity_GVisor_GVisorRuntime.tla

Implementations

impl GVisorRuntime

pub fn new() -> Result<Self>

Create a new GVisor runtime manager

This checks for runsc binary availability

pub fn with_path(runsc_path: String) -> Self

Create a GVisor runtime with a pre-resolved runsc path.

Use this when the path was resolved before privilege changes (e.g. before entering a user namespace where UID 0 would block PATH-based lookup).

pub fn resolve_path() -> Result<String>

Resolve the runsc path without constructing a full runtime. Call this before fork/unshare so the path is resolved while still unprivileged.

pub fn exec_with_oci_bundle( &self, container_id: &str, bundle: &OciBundle, ) -> Result<()>

Execute using gVisor with an OCI bundle

This is the OCI-compliant way to run containers with gVisor using default options: no networking, systrap platform, no rootless flag, and no internal cgroup setup override.

pub fn exec_with_oci_bundle_options( &self, container_id: &str, bundle: &OciBundle, options: GVisorOciRunOptions, ) -> Result<()>

Execute using gVisor with an OCI bundle and explicit run options.

ignore_cgroups skips runsc’s internal cgroup configuration because Nucleus already manages cgroups externally and unprivileged callers cannot configure them directly. runsc_rootless selects gVisor’s built-in rootless execution path for cases where Nucleus already entered a mapped user namespace and therefore cannot express the namespace setup as an OCI linux.uidMappings request. require_supervisor_exec_policy fail-closes if Nucleus cannot install the host-side execute allowlist before handing control to runsc.

pub fn exec_with_oci_bundle_network( &self, container_id: &str, bundle: &OciBundle, network_mode: GVisorNetworkMode, ignore_cgroups: bool, runsc_rootless: bool, require_supervisor_exec_policy: bool, platform: GVisorPlatform, ) -> Result<()>

Execute using gVisor with an OCI bundle and explicit network mode.

Prefer Self::exec_with_oci_bundle_options for new call sites.

pub fn is_available() -> bool

Check if gVisor is available on this system

pub fn version(&self) -> Result<String>

Get runsc version