Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Build sandbox manager.

Implementations

impl Sandbox

pub fn mount_bindfs( &self, src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_devfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_fdfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_nfs( &self, src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_procfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_tmpfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn unmount_bindfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_devfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_fdfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_nfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_procfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_tmpfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn kill_processes(&self, sandbox: &Path)

Kill all processes with open file handles within a sandbox path.

Uses procfs to scan all processes for file descriptors, cwd, or root that point into the sandbox directory. This is more thorough than fuser which only checks the exact path, not files within subdirs.

impl Sandbox

pub fn new(config: &Config) -> Sandbox

Create a new Sandbox instance. This is used even if sandboxes have not been enabled, as it provides a consistent interface to run commands through using execute. If sandboxes are enabled then commands are executed via chroot(8), otherwise they are executed directly.

pub fn enabled(&self) -> bool

Return whether sandboxes have been enabled.

This is based on whether a valid sandboxes section has been specified in the config file.

pub fn path(&self, id: usize) -> PathBuf

Return full path to a sandbox by id.

pub fn command(&self, id: usize, cmd: &Path) -> Command

Create a Command that runs in the sandbox (via chroot) if enabled, or directly if sandboxes are disabled.

pub fn kill_processes_by_id(&self, id: usize)

Kill all processes in a sandbox by id. This is used for graceful shutdown on Ctrl+C.

pub fn create(&self, id: usize) -> Result<()>

Create a single sandbox by id. If the sandbox already exists and is valid (has lock), this is a no-op.

pub fn execute( &self, id: usize, script: &Path, envs: Vec<(String, String)>, stdin_data: Option<&str>, protected: bool, ) -> Result<Child>

Execute a script file with supplied environment variables and optional stdin data.

If protected is true, the process is placed in its own process group to isolate it from terminal signals (Ctrl+C). Use this for cleanup scripts that must complete even during shutdown.

pub fn execute_script( &self, id: usize, content: &str, envs: Vec<(String, String)>, ) -> Result<Child>

Execute inline script content via /bin/sh.

pub fn execute_command<I, S>( &self, id: usize, cmd: &Path, args: I, envs: Vec<(String, String)>, ) -> Result<Child>

where I: IntoIterator<Item = S>, S: AsRef<OsStr>,

Execute a command directly without shell interpretation.

pub fn run_pre_build( &self, id: usize, config: &Config, envs: Vec<(String, String)>, ) -> Result<bool>

Run the pre-build script if configured. Returns Ok(true) if script ran successfully or wasn’t configured, Ok(false) if script failed.

pub fn run_post_build( &self, id: usize, config: &Config, envs: Vec<(String, String)>, ) -> Result<bool>

Run the post-build script if configured. Returns Ok(true) if script ran successfully or wasn’t configured, Ok(false) if script failed.

Post-build scripts run with signal protection (process_group(0)) to ensure cleanup completes even during shutdown from Ctrl+C.

pub fn destroy(&self, id: usize) -> Result<()>

Destroy a single sandbox by id.

pub fn create_all(&self, count: usize) -> Result<()>

Create all sandboxes in parallel, rolling back on failure.

pub fn destroy_all(&self, count: usize) -> Result<()>

Destroy all sandboxes in parallel. Continue on errors to ensure all sandboxes are attempted, printing each error as it occurs.

pub fn list_all(&self, count: usize)

List all sandboxes.

pub fn count_existing(&self, count: usize) -> usize

Count existing sandboxes (complete or incomplete).

Trait Implementations

impl Clone for Sandbox

fn clone(&self) -> Sandbox

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Sandbox

fn default() -> Sandbox

Returns the “default value” for a type.