Enum Confinement 

pub enum Confinement {
    LinuxNamespaces {
        wrapper: PathBuf,
    },
    WindowsJobObject,
    CopiedTree,
    Unavailable {
        missing: Missing,
    },
}

The backends, by platform, each carrying what it promises.

WindowsJobObject is the arm whose assurances a job object would keep. No build of this crate constructs it, although a job object is reachable through a safe interface (runtime::backlog::jobs makes one with win32job), because two of its assurances cannot be kept today: the job-wide memory limit is a private field of that crate and it sets no CPU rate control at all, so resources would promise a limit that is not there; and a child joins the job only after it starts, so a grandchild started in that gap is outside the tree the job ends. A Windows machine therefore reports Confinement::CopiedTree, whose Assurances say what it does not hold (the network, above all) rather than implying it holds everything a job object would.

Variants

LinuxNamespaces

Namespaces of its own — mount, network, process, user — made by a wrapper program on this machine.

Fields

wrapper: PathBuf

WindowsJobObject

A Windows job object: the tree ends together, the limits hold, and the network is not isolated.

CopiedTree

The floor every platform has: the command runs in a copy of the working tree, and the tree itself is not what it writes to.

Unavailable

No arm at all, and what this machine is missing.

Fields

missing: Missing

Implementations

impl Confinement

pub fn detect() -> Confinement

The arm this machine gives a command. One sampling point: the scratch root, the search path and this platform are asked here and nowhere else, so a report and a placement cannot disagree.

pub fn choose(offered: &Offerings) -> Confinement

The arm a machine with these capabilities gives.

pub fn assurances(&self) -> Assurances

What this arm promises. A pure function of the arm, so a report can be read without running anything.

pub fn name(&self) -> &'static str

The name a report carries. Closed and spelled once, because a page, a refusal and a test all have to mean the same arm.

pub fn statement(&self) -> String

What a command under this arm can and cannot count on, in one sentence. Derived from Confinement::assurances rather than written beside it, so the sentence cannot drift from the type.

Trait Implementations

impl Clone for Confinement

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Confinement

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Confinement

impl PartialEq for Confinement

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Confinement