Enum ExecSubstrate 

pub enum ExecSubstrate {
    Native,
    Container,
    MicroVm,
}

The execution substrate a workload runs on, ordered by the isolation it provides — Native < Container < MicroVm.

The ordering is the type’s whole reason to exist, and it is the one kamaji’s Backend enum documents widest-first: a native workload is fork+exec’d on the host with no boundary at all, a container gets namespaces and a cgroup on the host’s kernel, and a microVM gets its own kernel behind hardware virtualization. Ord is derived, so declaration order below is the security ordering — do not reorder these variants, and insert a new one at the position its isolation actually places it.

This is the same three-way distinction crate::admission::GrantRuntime carries; that type stays separate because a grant names a substrate it admits (an unordered label in a signed document) while this one answers “is what I got at least as strong as what I need”. GrantRuntime::of_spec delegates here so the two cannot disagree about how a spec reads.

Variants

Native

fork+exec on the host’s own userland. Host kernel, no namespaces, no image — WorkloadSpec::wants_native_exec.

Container

A container backend: host kernel, namespaces + cgroup, OCI rootfs. The default when NATIVE_EXEC_ANNOTATION is absent or unrecognised.

MicroVm

A KVM guest with its own kernel — WorkloadSpec::wants_microvm.

Implementations

impl ExecSubstrate

pub fn annotation_value(self) -> Option<&'static str>

The annotation value that selects this substrate, or None for Self::Container (which is selected by saying nothing).

pub fn as_str(self) -> &'static str

How a refusal should name this substrate to an operator. Matches the annotation spelling for the two opt-outs; container is what every message in the tree already calls the default.

Trait Implementations

impl Clone for ExecSubstrate

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ExecSubstrate

impl Debug for ExecSubstrate

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ExecSubstrate

impl Hash for ExecSubstrate

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for ExecSubstrate

fn cmp(&self, other: &Self) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for ExecSubstrate

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for ExecSubstrate

fn partial_cmp(&self, other: &Self) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl StructuralPartialEq for ExecSubstrate