Crate sdme 

Lightweight systemd-nspawn container manager with overlayfs.

sdme manages containers backed by explicit root filesystems, keeping the base rootfs untouched via overlayfs copy-on-write. Each container gets upper/work/merged directories under the data directory and a KEY=VALUE state file that tracks its metadata.

Requires Linux with systemd (>= 255) and root privileges.

Modules

Module	Purpose
containers	Create, remove, join, exec, stop, list
systemd	D-Bus helpers and template unit management
import	Rootfs import (dir, tar, URL, OCI, QCOW2)
oci	OCI registry, layout, app setup, blob cache
kube	Kubernetes Pod YAML support
export	Rootfs export (dir, tarball, raw image)
rootfs	Rootfs listing, removal, os-release parsing
build	Build config parsing and rootfs build execution
config	Configuration file loading and saving
lock	Advisory file locking for resource protection
mounts	Bind mount and environment variable config
network	Network configuration and state serialization
security	Capability, seccomp, AppArmor config
system_check	Version and dependency checks
pod	Shared network namespace management
txn	Enumerated transaction staging and gc

Re-exports

pub use mounts::BindConfig;

pub use mounts::EnvConfig;

pub use network::NetworkConfig;

pub use security::SecurityConfig;

Modules

build

Build root filesystems from a Dockerfile-like configuration.

config

Internal API for managing sdme configuration.

containers

Internal API for container filesystem, state, and runtime management.

cp

File copy between host, containers, and root filesystems.

export

Rootfs export: directory copy, tarball creation, raw disk image.

import

Rootfs import logic: directory copy, tarball extraction, URL download, OCI image, registry pull, and QCOW2 support.

kube

Kubernetes Pod YAML support for sdme.

lock

Advisory file locking for resource protection across all mutating operations.

mounts

Bind mount and environment variable configuration for containers.

network

Network configuration for containers.

oci

OCI container image support: layout parsing, registry pulling, app setup, and caching.

pod

Pod network namespace management.

rootfs

Internal API for managing root filesystems used as overlayfs lower layers.

security

Security configuration for containers.

system_check

Runtime dependency and version checks.

systemd

Internal API for managing interactions with systemd and D-Bus.

txn

Enumerated transaction staging for filesystem operations.

Structs

DownloadProgress

Download progress display for interactive terminals.

InterruptGuard

RAII guard that saves and resets interrupt state on creation, and restores it on drop.

ResourceLimits

Resource limits that map to systemd cgroup directives.

State

Container metadata stored as KEY=VALUE pairs in a state file.

SudoUser

Information about the real user behind sudo.

Statics

INTERRUPTED

Global flag set by the SIGINT/SIGTERM handler; checked by check_interrupted.

Functions

atomic_write

Write data to a file atomically via a temporary file and rename.

atomic_write_mode

Write data to a file atomically with explicit permissions.

check_interrupted

Return Err if the global SIGINT/SIGTERM flag is set.

confirm

Prompt the user for yes/no confirmation, returning Ok(true) for “y”.

confirm_default_yes

Prompt the user for yes/no confirmation, returning Ok(true) for “y” or empty input (Enter). Only “n”/“no” returns false.

install_interrupt_handler

Install the SIGINT and SIGTERM handler that sets the global INTERRUPTED flag.

interrupt_exit_code

Return the exit code appropriate for signal-terminated processes.

parse_size

Parse a human-readable size string (e.g. “10G”, “512M”) into bytes.

read_line_interruptible

Read a line from stdin, returning ErrorKind::Interrupted if a signal interrupts the read.

reset_interrupt

Reset the interrupt flag and re-install the signal handler.

restore_interrupt

Restore a previously saved interrupt state.

save_and_reset_interrupt

Save the current interrupt state and reset it.

sudo_user

Returns info about the real user behind sudo, if applicable.

validate_name

Validate a container name.