Module detect 

Auto-detection of available security features

Structs

SandboxExtraRoots

Extra filesystem roots beyond the primary workspace that a sandbox should also grant access to, mirroring SecurityPolicy’s allowed-roots tiers (allowed_roots, allowed_roots_read_only, allowed_roots_write_only). Only backends that build per-path rulesets (currently Landlock) consume this; others ignore it.

SandboxPosture

Side-effect-light description of the sandbox backend the runtime would use.

Functions

create_sandbox

linux_memcg_available

sandbox_posture

Inspect sandbox backend selection without returning a usable sandbox.