Struct Context 

pub struct Context {
    pub mode: Mode,
    pub allowed: Vec<PathBuf>,
    pub protected: Vec<PathBuf>,
    pub log: PathBuf,
}

What one attempt’s proxy enforces, fixed when the attempt launches.

Fields

mode: Mode

allowed: Vec<PathBuf>

The directories a container may bind-mount from, already resolved.

protected: Vec<PathBuf>

Host paths the operator protected (host protect-path), already resolved: never mountable, even inside an allowed directory. The service’s own sandbox hides them, but the engine runs outside it.

log: PathBuf

The violation log.

Implementations

impl Context

pub fn records(&self, violation: &Violation) -> bool

Whether violation is recorded: every one unless the policy is off, and a protected path’s always.

pub fn refuses(&self, violation: &Violation) -> bool

Whether violation refuses its request: every one in Mode::Enforce, and a protected path’s in every mode.

pub fn access(&self, source: &Path) -> Access

Whether a container may bind-mount source.

A path with .. is refused outright. Otherwise the longest existing prefix is resolved through every link on the host, so that a link the job left in its own directory cannot point a mount anywhere else, and the rest is appended as written: Docker creates a missing bind source as a directory.

Trait Implementations

impl Clone for Context

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Context

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Context

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for Context

impl PartialEq for Context

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for Context

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Context