Struct SandboxPolicy 

pub struct SandboxPolicy {
    pub limits: ResourceLimits,
    pub allowed_k2k_destinations: HashSet<String>,
    pub denied_k2k_destinations: HashSet<String>,
    pub memory_access: HashMap<String, AccessLevel>,
    pub can_checkpoint: bool,
    pub can_migrate: bool,
    pub can_spawn: bool,
    pub can_access_host: bool,
    pub allowed_syscalls: HashSet<String>,
}

Sandbox policy defining what a kernel can access.

Fields

limits: ResourceLimits

Resource limits

allowed_k2k_destinations: HashSet<String>

Allowed K2K destinations (empty = all allowed)

denied_k2k_destinations: HashSet<String>

Denied K2K destinations

memory_access: HashMap<String, AccessLevel>

Memory region access levels

can_checkpoint: bool

Whether the kernel can create checkpoints

can_migrate: bool

Whether the kernel can be migrated

can_spawn: bool

Whether the kernel can spawn child kernels

can_access_host: bool

Whether the kernel can access host memory

allowed_syscalls: HashSet<String>

Allowed system calls (for future use)

Implementations

impl SandboxPolicy

pub fn new() -> Self

Create a new sandbox policy.

pub fn with_limits(self, limits: ResourceLimits) -> Self

Set resource limits.

pub fn with_memory_limit(self, bytes: u64) -> Self

Set memory limit.

pub fn with_execution_timeout(self, timeout: Duration) -> Self

Set execution timeout.

pub fn allow_k2k_to(self, destinations: &[&str]) -> Self

Allow K2K to specific destinations.

pub fn deny_k2k_to(self, destinations: &[&str]) -> Self

Deny K2K to specific destinations.

pub fn with_memory_access(self, region: &str, access: AccessLevel) -> Self

Set memory region access level.

pub fn with_checkpoint(self, enabled: bool) -> Self

Enable/disable checkpointing.

pub fn with_migration(self, enabled: bool) -> Self

Enable/disable migration.

pub fn with_spawn(self, enabled: bool) -> Self

Enable/disable spawning.

pub fn with_host_access(self, enabled: bool) -> Self

Enable/disable host memory access.

pub fn restrictive() -> Self

Create a restrictive policy for untrusted kernels.

pub fn permissive() -> Self

Create a permissive policy for trusted kernels.

pub fn is_k2k_allowed(&self, destination: &str) -> bool

Check if K2K to destination is allowed.

Trait Implementations

impl Clone for SandboxPolicy

fn clone(&self) -> SandboxPolicy

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SandboxPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SandboxPolicy

fn default() -> Self

Returns the “default value” for a type.