pub fn host_containment() -> HostContainmentExpand description
Report how process containment behaves on this host without creating a
container or spawning anything — a spawn-free preflight (a doctor /
host-check command that must have no side effects) that answers what a
ProcessGroup would otherwise only reveal after it exists: which
Mechanism a group created here and now would use, how far a soft stop
reaches, what the OS guarantees on abrupt owner death, and this crate’s version.
See HostContainment for the full contract of each field. In particular the
mechanism is determined by a read-only probe
(the shared Mechanism::detect) that is best-effort on two targets, both
because the query must create nothing: on Linux it inspects whether a cgroup
could be created rather than creating one, and on FreeBSD it reports the
process reaper without acquiring reaper status (acquiring it is a real,
permanent side effect). In either case a rare window can make it
differ from the mechanism a real ProcessGroup::new falls
back to. Like which, no async runtime is required.
let host = processkit::host_containment();
// e.g. log the containment story a run *would* get, before starting anything:
let _ = (host.mechanism(), host.parent_death_cleanup(), host.crate_version());