Struct ContainerSecurityConfig

pub struct ContainerSecurityConfig {

    pub apparmor_profile: Option<String>,
    pub cap_add: Option<Vec<String>>,
    pub cap_drop: Option<Vec<String>>,
    pub groups: Option<Vec<String>>,
    pub idmappings: Option<Box<IdMappingOptions>>,
    pub label_nested: Option<bool>,
    pub mask: Option<Vec<String>>,
    pub no_new_privileges: Option<bool>,
    pub privileged: Option<bool>,
    pub procfs_opts: Option<Vec<String>>,
    pub read_only_filesystem: Option<bool>,
    pub read_write_tmpfs: Option<bool>,
    pub seccomp_policy: Option<String>,
    pub seccomp_profile_path: Option<String>,
    pub selinux_opts: Option<Vec<String>>,
    pub umask: Option<String>,
    pub unmask: Option<Vec<String>>,
    pub user: Option<String>,
    pub userns: Option<Box<Namespace>>,
}

ContainerSecurityConfig : ContainerSecurityConfig is a container’s security features, including SELinux, Apparmor, and Seccomp.

Fields

apparmor_profile: Option<String>

ApparmorProfile is the name of the Apparmor profile the container will use. Optional.

cap_add: Option<Vec<String>>

CapAdd are capabilities which will be added to the container. Conflicts with Privileged. Optional.

cap_drop: Option<Vec<String>>

CapDrop are capabilities which will be removed from the container. Conflicts with Privileged. Optional.

groups: Option<Vec<String>>

Groups are a list of supplemental groups the container’s user will be granted access to. Optional.

idmappings: Option<Box<IdMappingOptions>>

label_nested: Option<bool>

LabelNested indicates whether or not the container is allowed to run fully nested containers including SELinux labelling. Optional.

mask: Option<Vec<String>>

Mask is the path we want to mask in the container. This masks the paths given in addition to the default list. Optional

no_new_privileges: Option<bool>

NoNewPrivileges is whether the container will set the no new privileges flag on create, which disables gaining additional privileges (e.g. via setuid) in the container. Optional.

privileged: Option<bool>

Privileged is whether the container is privileged. Privileged does the following: Adds all devices on the system to the container. Adds all capabilities to the container. Disables Seccomp, SELinux, and Apparmor confinement. (Though SELinux can be manually re-enabled). TODO: this conflicts with things. TODO: this does more. Optional.

procfs_opts: Option<Vec<String>>

ProcOpts are the options used for the proc mount.

read_only_filesystem: Option<bool>

ReadOnlyFilesystem indicates that everything will be mounted as read-only. Optional.

read_write_tmpfs: Option<bool>

ReadWriteTmpfs indicates that when running with a ReadOnlyFilesystem mount temporary file systems. Optional.

seccomp_policy: Option<String>

SeccompPolicy determines which seccomp profile gets applied the container. valid values: empty,default,image

seccomp_profile_path: Option<String>

SeccompProfilePath is the path to a JSON file containing the container’s Seccomp profile. If not specified, no Seccomp profile will be used. Optional.

selinux_opts: Option<Vec<String>>

SelinuxProcessLabel is the process label the container will use. If SELinux is enabled and this is not specified, a label will be automatically generated if not specified. Optional.

umask: Option<String>

Umask is the umask the init process of the container will be run with.

unmask: Option<Vec<String>>

Unmask a path in the container. Some paths are masked by default, preventing them from being accessed within the container; this undoes that masking. If ALL is passed, all paths will be unmasked. Optional.

user: Option<String>

User is the user the container will be run as. Can be given as a UID or a username; if a username, it will be resolved within the container, using the container’s /etc/passwd. If unset, the container will be run as root. Optional.

userns: Option<Box<Namespace>>

Implementations

impl ContainerSecurityConfig

pub fn new() -> ContainerSecurityConfig

ContainerSecurityConfig is a container’s security features, including SELinux, Apparmor, and Seccomp.

Trait Implementations

impl Clone for ContainerSecurityConfig

fn clone(&self) -> ContainerSecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContainerSecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for ContainerSecurityConfig

fn default() -> ContainerSecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for ContainerSecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for ContainerSecurityConfig

fn eq(&self, other: &ContainerSecurityConfig) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for ContainerSecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for ContainerSecurityConfig