Struct Sandbox 

pub struct Sandbox { /* private fields */ }

Build sandbox manager.

Provides methods to create, execute commands in, and destroy sandboxes. The sandbox implementation is platform-specific but the interface is uniform.

Example

let config = Config::load(None, false)?;
let sandbox = Sandbox::new(&config);

if sandbox.enabled() {
    sandbox.create(0)?;  // Create sandbox 0

    // Execute a script in the sandbox
    let child = sandbox.execute(
        0,
        Path::new("/path/to/script"),
        vec![("KEY".to_string(), "value".to_string())],
        None,
        None,
    )?;
    let output = child.wait_with_output()?;

    sandbox.destroy(0)?;
}

Implementations

impl Sandbox

pub fn mount_bindfs( &self, src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_devfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_fdfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_nfs( &self, src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_procfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn mount_tmpfs( &self, _src: &Path, dest: &Path, opts: &[&str], ) -> Result<Option<ExitStatus>>

pub fn unmount_bindfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_devfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_fdfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_nfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_procfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn unmount_tmpfs(&self, dest: &Path) -> Result<Option<ExitStatus>>

pub fn kill_processes(&self, sandbox: &Path)

Kill all processes using files within a sandbox path.

impl Sandbox

pub fn new(config: &Config) -> Sandbox

Create a new Sandbox instance. This is used even if sandboxes have not been enabled, as it provides a consistent interface to run commands through using execute. If sandboxes are enabled then commands are executed via chroot(8), otherwise they are executed directly.

pub fn enabled(&self) -> bool

Return whether sandboxes have been enabled.

This is based on whether a valid sandboxes section has been specified in the config file.

pub fn path(&self, id: usize) -> PathBuf

Return full path to a sandbox by id.

pub fn command(&self, id: usize, cmd: &Path) -> Command

Create a Command that runs in the sandbox (via chroot) if enabled, or directly if sandboxes are disabled.

pub fn kill_processes_by_id(&self, id: usize)

Kill all processes in a sandbox by id. This is used for graceful shutdown on Ctrl+C.

pub fn create(&self, id: usize) -> Result<()>

Create a single sandbox by id. If the sandbox already exists and is valid (has lock), this is a no-op.

pub fn execute( &self, id: usize, script: &Path, envs: Vec<(String, String)>, stdin_data: Option<&str>, status_fd: Option<i32>, ) -> Result<Child>

Execute a script file with supplied environment variables and optional stdin data. If status_fd is provided, it will be passed to the child process via the bob_status_fd environment variable.

pub fn execute_script( &self, id: usize, content: &str, envs: Vec<(String, String)>, ) -> Result<Child>

Execute inline script content via /bin/sh.

pub fn destroy(&self, id: usize) -> Result<()>

Destroy a single sandbox by id.

pub fn create_all(&self, count: usize) -> Result<()>

Create all sandboxes.

pub fn destroy_all(&self, count: usize) -> Result<()>

Destroy all sandboxes. Continue on errors to ensure all sandboxes are attempted, printing each error as it occurs.

pub fn list_all(&self, count: usize)

List all sandboxes.

Trait Implementations

impl Clone for Sandbox

fn clone(&self) -> Sandbox

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Sandbox

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Sandbox

fn default() -> Sandbox

Returns the “default value” for a type.