Struct SupervisorCtx 

pub struct SupervisorCtx {
    pub resource: Arc<Mutex<ResourceState>>,
    pub cow: Arc<Mutex<CowState>>,
    pub procfs: Arc<Mutex<ProcfsState>>,
    pub network: Arc<Mutex<NetworkState>>,
    pub time_random: Arc<Mutex<TimeRandomState>>,
    pub policy_fn: Arc<Mutex<PolicyFnState>>,
    pub chroot: Arc<Mutex<ChrootState>>,
    pub netlink: Arc<NetlinkState>,
    pub processes: Arc<ProcessIndex>,
    pub policy: Arc<NotifPolicy>,
    pub child_pidfd: Option<RawFd>,
    pub notif_fd: RawFd,
}

Holds all supervisor state and policy. Passed to every handler.

Fields

resource: Arc<Mutex<ResourceState>>

Resource-limit state (memory, processes, checkpoint).

cow: Arc<Mutex<CowState>>

Copy-on-write filesystem state.

procfs: Arc<Mutex<ProcfsState>>

/proc virtualization state.

network: Arc<Mutex<NetworkState>>

Network policy and port remapping state.

time_random: Arc<Mutex<TimeRandomState>>

Deterministic time/random state.

policy_fn: Arc<Mutex<PolicyFnState>>

Dynamic policy callback state.

chroot: Arc<Mutex<ChrootState>>

Chroot-specific runtime state.

netlink: Arc<NetlinkState>

NETLINK_ROUTE virtualization state.

processes: Arc<ProcessIndex>

Per-process registry: pid → PidKey. Source of truth for “which processes are in the sandbox” and the anchor for unified per-process state cleanup. Wraps an internal RwLock, so handlers can query it synchronously without .await.

policy: Arc<NotifPolicy>

Immutable policy — no lock needed.

child_pidfd: Option<RawFd>

pidfd for the child process (immutable after spawn).

notif_fd: RawFd

Seccomp notification fd (for on-behalf operations).