Module runner 

The sandboxed subprocess runner behind every subprocess adapter.

The runner enforces the whole sandbox contract from the design document: a wall-clock timeout, separate stdout and stderr caps drained concurrently, no network, no inherited environment, and a temp-dir working jail. Every violation fails closed with a machine-readable reason and no partial result.

The spawn is two-stage. The parent builds a std::process::Command through the platform jail::JailBackend with a cleared environment, the jail as working directory, piped stdio, and a fresh process group. The child starts in the worker binary’s single-threaded sandbox helper mode, which applies namespaces, resource limits, descriptor hygiene, the filesystem jail, and the syscall filter, then execs the requested adapter mode. No sandbox work runs in a pre_exec closure.

The wall clock is a parent-owned monotonic deadline. When it fires, or when either output cap is crossed, the parent kills the whole process group with SIGKILL. The same group kill also runs after a normal clean exit, so no descendant outlives the invocation, and the post-exit drain join is deadline-bounded, so the parent never blocks on a pipe an escaped descendant holds open. A response frame is accepted only from a child that wrote exactly one complete frame, nothing after it, and exited cleanly.

Modules

helper

The sandbox helper: the single-threaded first stage of every jailed spawn.

jail

The jail contract every subprocess adapter runs under.

linux

The Linux jail backend: user and network namespaces, Landlock filesystem rules, and a seccomp allow-list.

protocol

The framed stdin/stdout protocol between the runner and a worker.

worker

The worker binary’s mode dispatch.

Structs

Limits

Resource and output limits for one adapter class.

Runner

Runs worker modes under the platform jail.

RunnerError

A runner failure with a machine-readable reason.

Constants

PROCESS_COUNT_EXIT

Exit code the sandbox helper uses when the real user id’s process count cannot be measured, so the parent can name that refusal rather than folding it into every other setup failure.

SANDBOX_SETUP_EXIT

Exit code the sandbox helper uses when jail setup fails, so the parent can tell a refused jail from an adapter crash.

WORKER_BINARY

File name of the worker binary this crate ships.

Functions

locate_worker

Locates the worker binary beside the current executable, or one directory up, which covers an installed layout and a build tree.

provider_profile_template_blake3

The BLAKE3 of the provider jail profile template on this platform, or None where no provider profile is measured. Part of the effective rules version whenever a provider is configured.