Crate podman_lens 

Version-aware native Podman inspection and non-executing deployment planning.

PodmanLens acquires one explicitly selected Libpod service through a replaceable transport, preserves typed native observation state and provenance, discovers an evidence-backed resource graph, plans caller-authored target intent, and renders deterministic CLI and Libpod descriptions. It never discovers an ambient endpoint, shells out to podman for input, sends a mutating acquisition request, or executes a rendered plan.

Explicit read-only acquisition

The built-in Unix transport accepts one caller-supplied socket and rejects every method except GET before opening it. Environment values are redacted by default and secret payload endpoints are never requested.

use podman_lens::{
    AcquisitionOptions, DiscoveryRequest, ReadOnlyUnixTransport,
    ReadOnlyUnixTransportTimeouts, TransportLimits, UnixConnection, acquire_inventory,
    discover,
};

let transport = ReadOnlyUnixTransport::new(
    UnixConnection::new("/run/user/1000/podman/podman.sock")?,
    TransportLimits::default(),
    ReadOnlyUnixTransportTimeouts::default(),
)?;
let runtime = tokio::runtime::Builder::new_current_thread().enable_all().build()?;
let graph = runtime.block_on(async {
    let inventory = acquire_inventory(&transport, AcquisitionOptions::redacted()).await?;
    let mut request = DiscoveryRequest::new();
    request.select_all();
    discover(&inventory, &request)
})?;
assert!(graph.requested_roots().is_empty());

select_all is retained separately on the graph; exact and label selectors are available when the caller needs a narrower application boundary. See the task-oriented public guides for selector, grouping, network-crossing, and privacy contracts.

Deterministic offline planning and rendering

Planning uses explicit target-side intent and opens no connection. Rendering produces data and review text only.

use podman_lens::{
    DeploymentIntent, DeploymentResource, DeploymentResourceId, ImageIntent, ImagePullPolicy,
    ImageSource, ObservedApiVersion, ObservedPodmanVersion, ResourceKind, TargetProfile,
    artifact::deployment_v1, plan_deployment, render_deployment,
};

let target = TargetProfile::new(
    ObservedPodmanVersion::parse("6.1.0")?,
    ObservedApiVersion::parse("6.1.0")?,
)?;
let image = DeploymentResourceId::new(ResourceKind::Image, "application-image")?;
let mut intent = DeploymentIntent::new(target);
intent.add_resource(DeploymentResource::Image(ImageIntent::new(
    image,
    ImageSource::new("registry.example.invalid/team/application:1")?,
    ImagePullPolicy::Missing,
)?));
let planned = plan_deployment(&intent);
let plan = planned.plan().expect("reviewed intent produces a complete plan");
let rendered = render_deployment(plan);
let rendering = rendered.rendering().expect("reviewed target renders exactly");
assert_eq!(plan.operations().len(), 1);
assert_eq!(rendering.operations()[0].cli().program(), "podman");
assert_eq!(deployment_v1::deployment(rendering).schema_version(), 1);

Re-exports

pub use connection::ConnectionKind;

pub use connection::ConnectionSpec;

pub use connection::MutualTlsPolicy;

pub use connection::OpaqueReference;

pub use connection::SshConnection;

pub use connection::TcpMutualTlsConnection;

pub use connection::UnixConnection;

pub use coverage::NativeFieldCoverageClassification;

pub use coverage::NativeFieldCoverageEntry;

pub use coverage::NativeFieldCoveragePlane;

pub use coverage::native_field_coverage_catalogue;

pub use deployment::ContainerIntent;

pub use deployment::DeploymentConnectionReference;

pub use deployment::DeploymentIntent;

pub use deployment::DeploymentOperation;

pub use deployment::DeploymentOperationId;

pub use deployment::DeploymentPlan;

pub use deployment::DeploymentResource;

pub use deployment::DeploymentResourceId;

pub use deployment::ExternalPrecondition;

pub use deployment::ImageIntent;

pub use deployment::ImagePullPolicy;

pub use deployment::ImageSource;

pub use deployment::ImageSourceClassification;

pub use deployment::NetworkIntent;

pub use deployment::PlanningFinding;

pub use deployment::PlanningOutcome;

pub use deployment::PodIntent;

pub use deployment::SecretIntent;

pub use deployment::SemanticOperationAction;

pub use deployment::SensitiveInputReference;

pub use deployment::StartupDependency;

pub use deployment::VolumeIntent;

pub use deployment::plan_deployment;

pub use diagnostic::Diagnostic;

pub use diagnostic::DiagnosticCode;

pub use diagnostic::PodmanLensResult;

pub use discovery::DependencyEvidence;

pub use discovery::DiscoveryExplanation;

pub use discovery::DiscoveryExplanationKind;

pub use discovery::DiscoveryFinding;

pub use discovery::DiscoveryRequest;

pub use discovery::DiscoveryRootOrigin;

pub use discovery::GroupingEdge;

pub use discovery::GroupingEvidence;

pub use discovery::LabelSelector;

pub use discovery::ResourceDependency;

pub use discovery::ResourceGraph;

pub use discovery::ResourceGroup;

pub use discovery::ResourceSelector;

pub use discovery::ResourceSelectorMatch;

pub use discovery::discover;

pub use evidence::CapabilityCatalogueEntry;

pub use evidence::EvidenceReference;

pub use evidence::capability_catalogue;

pub use inventory::AcquisitionOptions;

pub use inventory::EnvironmentValuePolicy;

pub use inventory::InventoryFinding;

pub use inventory::InventorySection;

pub use inventory::InventorySectionAvailability;

pub use inventory::JsonValueKind;

pub use inventory::MAX_INVENTORY_JSON_BYTES;

pub use inventory::MAX_UNKNOWN_FIELDS_PER_INVENTORY;

pub use inventory::MAX_UNKNOWN_FIELDS_PER_RECORD;

pub use inventory::ResourceEvidence;

pub use inventory::ResourceIdentity;

pub use inventory::ResourceInventory;

pub use inventory::ResourceKind;

pub use inventory::SensitiveEnvironmentValue;

pub use inventory::acquire_inventory;

pub use networking::DnsConfiguration;

pub use networking::HostAlias;

pub use networking::NetworkAttachment;

pub use networking::NetworkCidr;

pub use networking::NetworkRoute;

pub use networking::NetworkSubnet;

pub use networking::PortMapping;

pub use networking::PortProtocol;

pub use networking::RouteType;

pub use networking::StaticMacAddress;

pub use observation::AuthoredImageSpellingHint;

pub use observation::AuthoredMountRelabelHint;

pub use observation::ConfiguredContainerCommand;

pub use observation::ConfiguredContainerEntrypoint;

pub use observation::ConfiguredContainerHostname;

pub use observation::ConfiguredContainerUser;

pub use observation::ConfiguredContainerWorkdir;

pub use observation::ContainerCreationEvidence;

pub use observation::ContainerMountKind;

pub use observation::ContainerMountObservation;

pub use observation::ContainerMountSelinuxRelabel;

pub use observation::ContainerMountSource;

pub use observation::ContainerObservation;

pub use observation::ContainerSecretGrantObservation;

pub use observation::ContainerSecretReference;

pub use observation::ImageObservation;

pub use observation::Labels;

pub use observation::NativeCapability;

pub use observation::NativeHealthCheckObservation;

pub use observation::NativeHealthCommand;

pub use observation::NativeHealthFailureAction;

pub use observation::NativeIpcNamespaceMode;

pub use observation::NativeLogDriver;

pub use observation::NativeLoggingObservation;

pub use observation::NativeNamespaceMode;

pub use observation::NativeNamespaceObservation;

pub use observation::NativeNetworkCidr;

pub use observation::NativeNetworkLeaseRange;

pub use observation::NativeNetworkRouteObservation;

pub use observation::NativeNetworkRouteType;

pub use observation::NativeNetworkSubnetObservation;

pub use observation::NativeNetworkingObservation;

pub use observation::NativeOpaqueNetworkOptions;

pub use observation::NativeOpaqueSecurityOptions;

pub use observation::NativePortBindingObservation;

pub use observation::NativePortProtocol;

pub use observation::NativeResourceControlObservation;

pub use observation::NativeResourceReference;

pub use observation::NativeRestartPolicyName;

pub use observation::NativeRestartPolicyObservation;

pub use observation::NativeSecretDriverObservation;

pub use observation::NativeSecretDriverOptions;

pub use observation::NativeSecurityObservation;

pub use observation::NativeStartupHealthCheckObservation;

pub use observation::NativeTimestamp;

pub use observation::NativeUlimitObservation;

pub use observation::NetworkObservation;

pub use observation::NetworkOptionKeys;

pub use observation::ObservationField;

pub use observation::ObservationHeader;

pub use observation::ObservationOrigin;

pub use observation::ObservedValue;

pub use observation::PodObservation;

pub use observation::ProtectedEnvironment;

pub use observation::ProtectedEnvironmentEntry;

pub use observation::ProtectedEnvironmentValue;

pub use observation::ProtectedHealthCommand;

pub use observation::ResourceDetails;

pub use observation::ResourceObservation;

pub use observation::ResourceObservationState;

pub use observation::SecretObservation;

pub use observation::UnixId as ObservedUnixId;

pub use observation::UnmodelledCompleteness;

pub use observation::UnmodelledField;

pub use observation::UnmodelledFieldId;

pub use observation::VolumeObservation;

pub use observation::VolumeOwnerIdWireValue;

pub use probe::MAX_PROBE_JSON_BYTES;

pub use probe::ServiceObservation;

pub use probe::probe_libpod_service;

pub use read_only_unix_transport::MIN_HTTP1_HEADER_BYTES;

pub use read_only_unix_transport::ReadOnlyUnixTransport;

pub use read_only_unix_transport::ReadOnlyUnixTransportTimeouts;

pub use render::CliInvocation;

pub use render::DeploymentRendering;

pub use render::LibpodInvocation;

pub use render::RenderStatus;

pub use render::RenderedHttpBody;

pub use render::RenderedHttpMethod;

pub use render::RenderedOperation;

pub use render::RenderingFinding;

pub use render::RenderingOutcome;

pub use render::render_deployment;

pub use runtime::ConfiguredHealthCheck;

pub use runtime::ContainerNamespaceSettings;

pub use runtime::ContainerResourceControls;

pub use runtime::ContainerRuntimeSettings;

pub use runtime::HealthCheck;

pub use runtime::HealthCommand;

pub use runtime::HealthDuration;

pub use runtime::HealthInterval;

pub use runtime::HealthOnFailure;

pub use runtime::HealthRetries;

pub use runtime::HealthStartPeriod;

pub use runtime::HealthTimeout;

pub use runtime::IpcNamespaceMode;

pub use runtime::LinuxCapability;

pub use runtime::LogDriver;

pub use runtime::LogSize;

pub use runtime::LoggingSettings;

pub use runtime::NamespaceMode;

pub use runtime::PublicHealthArgumentArray;

pub use runtime::PublicHealthCommand;

pub use runtime::Rlimit;

pub use runtime::RlimitKind;

pub use runtime::RlimitValue;

pub use runtime::SecuritySettings;

pub use runtime::SensitiveInlineHealthArgumentArray;

pub use runtime::SensitiveInlineHealthCommand;

pub use runtime::StartupHealthCheck;

pub use runtime::StartupHealthRetries;

pub use runtime::StartupHealthSuccesses;

pub use settings::AbsoluteContainerPath;

pub use settings::ArgumentArray;

pub use settings::BindMount;

pub use settings::ContainerHostname;

pub use settings::ContainerSettings;

pub use settings::ContainerUser;

pub use settings::ContainerWorkdir;

pub use settings::DeploymentEnvironmentValue;

pub use settings::EnvironmentAssignment;

pub use settings::EnvironmentName;

pub use settings::Label;

pub use settings::LabelKey;

pub use settings::MountAccess;

pub use settings::MountIntent;

pub use settings::NamedVolumeCopyMode;

pub use settings::NamedVolumeMount;

pub use settings::PublicEnvironmentValue;

pub use settings::PublicLabelValue;

pub use settings::RestartPolicy;

pub use settings::SecretGrant;

pub use settings::SecretMode;

pub use settings::SensitiveInlineEnvironmentValue;

pub use settings::TmpfsMount;

pub use settings::UnixId;

pub use settings::VolumeSubpath;

pub use transport::LibpodHeader;

pub use transport::LibpodHeaders;

pub use transport::LibpodMethod;

pub use transport::LibpodPath;

pub use transport::LibpodRequest;

pub use transport::LibpodResponse;

pub use transport::LibpodTransport;

pub use transport::LibpodTransportFuture;

pub use transport::MAX_PATH_AND_QUERY_BYTES;

pub use transport::TransportError;

pub use transport::TransportLimits;

pub use version::CgroupCapabilityEvidence;

pub use version::CgroupController;

pub use version::CgroupVersion;

pub use version::ObservedApiVersion;

pub use version::ObservedPodmanVersion;

pub use version::SupportedPodmanRange;

pub use version::TargetExecutionContext;

pub use version::TargetProfile;

Modules

artifact

Versioned, serialization-only deployment artifacts. Versioned, serialization-only deployment artifacts.

connection

Explicit, transport-neutral Podman service connection specifications.

coverage

Strict, versioned coverage ledger for native observations and output intent.

deployment

Typed, transport-neutral Podman deployment intent and deterministic semantic planning.

diagnostic

Structured, non-sensitive diagnostics produced by PodmanLens contracts.

discovery

Deterministic, evidence-backed grouping over a read-only native inventory.

evidence

Immutable provenance for reviewed Podman compatibility lines.

inventory

Read-only, versioned acquisition of a redacted native Podman inventory.

networking

Typed declared Podman networking output intent.

observation

Typed, provenance-aware observations at the Podman native input boundary.

probe

Read-only Libpod service probing and fixed version observation.

read_only_unix_transport

Built-in read-only Unix-socket HTTP/1.1 transport for Libpod acquisition.

render

Version-aware, transport-neutral deployment-plan rendering.

runtime

Bounded, redaction-safe native container runtime intent retained before rendering exists.

settings

Typed, bounded deployment settings that do not expose raw configuration strings by default.

snapshot

Versioned, serialization-only redacted public snapshots.

transport

Object-safe, caller-implemented Libpod transport contracts.

version

Observed and target Podman versions backed by reviewed catalogue evidence.