Struct ProfileConfig 

pub struct ProfileConfig {

    pub mode: ExecutionMode,
    pub image: Option<ImageConfig>,
    pub network: Option<String>,
    pub writable: Option<bool>,
    pub require_pinned_image: Option<bool>,
    pub require_lockfile: Option<bool>,
    pub role: Option<ProfileRole>,
    pub lockfile_files: Vec<String>,
    pub pre_run: Vec<String>,
    pub ports: Vec<String>,
    pub network_allow: Vec<String>,
    pub capabilities: Option<CapabilitiesSpec>,
    pub no_new_privileges: Option<bool>,
    pub read_only_rootfs: Option<bool>,
    pub reuse_container: Option<bool>,
    pub shell: Option<String>,
    pub writable_paths: Option<Vec<String>>,
}

Fields

mode: ExecutionMode

image: Option<ImageConfig>

network: Option<String>

writable: Option<bool>

require_pinned_image: Option<bool>

require_lockfile: Option<bool>

role: Option<ProfileRole>

Declares what role this profile plays (install, run, build). install enables lockfile auditing and install-style policy enforcement.

lockfile_files: Vec<String>

Lockfile filenames to check when this profile runs an install-style command. Replaces built-in per-PM lockfile detection.

pre_run: Vec<String>

Commands to run on the host before the sandboxed command. Each entry is a shell-quoted command string, e.g. ["npm audit --audit-level=high"].

ports: Vec<String>

network_allow: Vec<String>

When non-empty and network is on, restrict outbound DNS to only these hostnames. Implemented by resolving each domain on the host at container-start time and injecting --add-host entries, then pointing the container’s DNS at a non-existent server so arbitrary lookups fail. Raw-IP connections bypass this; package managers use domain names.

capabilities: Option<CapabilitiesSpec>

no_new_privileges: Option<bool>

read_only_rootfs: Option<bool>

reuse_container: Option<bool>

shell: Option<String>

writable_paths: Option<Vec<String>>

When set, overrides the workspace-level writable_paths for this profile. Only the listed paths are mounted read-write; all others in the workspace remain read-only.

Trait Implementations

impl Clone for ProfileConfig

fn clone(&self) -> ProfileConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProfileConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ProfileConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.