Struct Bwrap 

pub struct Bwrap {
    host_workdir: PathBuf,
    args: Vec<OsString>,
    inputs_provider: InputsProvider,
}

Available on Linux only.

Bubblewrap based sandbox executor.

It executes the sandbox command in separate uts, ipc, pid and user namespaces, always runs as uid=1000(nixbld) and gid=100(nixbld) inside the namespace. Provides sane defaults for various /etc files.

Network is optionally disabled with a separate network namespace based on the value of SandboxSpec::allow_network.

The root filesystem is tmpfs, has /dev and /proc.

The rest of the filesystem is based on the SandboxSpec::scratches, SandboxSpec::additional_files and SandboxSpec::inputs_provider.

Scratches

A list of read-write directories available inside the sandbox, these directories are also left available on the host after the sandbox has finished.

Additional files

A list of read-write files whose path currently must resolve into one of the Scratches.

Build Inputs(SandboxSpec::inputs_provider)

A read-only directory that contains any files required by the sandboxed command, e.g /nix/store. Before the sandbox starts, the SandboxSpec::inputs_provider will have a chance to populate this directory and clean up after the sandbox is stopped.

Note: If the build inputs directory overlaps with any of the scratches, an overlayfs mount will be created for that scratch so it remains writable, i.e. the sandboxed command can create new files/directories.

Fields

host_workdir: PathBuf

args: Vec<OsString>

inputs_provider: InputsProvider

Implementations

impl Bwrap

pub async fn run(self) -> Result<SandboxOutcome>

Run the sandbox and return the result.

pub fn initialize(spec: SandboxSpec) -> Result<Bwrap>

Constructor.