lib/sandbox/src/plan.zig

daab053ee43316e1809a84551d573ddd1e5bf3d2

 1 const sys = @import("sys");
 2 const audit = @import("audit.zig");
 3 const command = @import("command.zig");
 4 const policy_data = @import("policy.zig");
 5 
 6 /// One execution request, borrowed for the length of the call: the slices and
 7 /// directory handles in it belong to the caller and have to outlive `execute` .
 8 /// `max_file_bytes` bounds the size of a source file copied into the layer
 9 /// during staging, and a larger file is left out of the copy and recorded as
10 /// skipped. The same bound applies to nothing else: the child's own output and
11 /// the hashing that builds the change set are unbounded by it.
12 pub const Plan = struct {
13     scratch: sys.fs.Dir,
14     source: ?sys.fs.Dir = null,
15     argv: []const []const u8,
16     cwd: []const u8 = ".",
17     environ_map: ?*const sys.process.Environ.Map = null,
18     runner: audit.Runner = .staging,
19     policy: policy_data.Policy = .{},
20     prefix: []const u8 = "sandbox",
21     timeout_ms: u64 = 30_000,
22     stdout_limit: usize = 1024 * 1024,
23     stderr_limit: usize = 1024 * 1024,
24     max_file_bytes: usize = 16 * 1024 * 1024,
25     interrupt: command.Interrupt = .{},
26 };