Trait Sandbox

pub trait Sandbox: Send + Sync {
    // Required methods
    fn wrap_command(&self, cmd: &mut Command) -> Result<()>;
    fn is_available(&self) -> bool;
    fn name(&self) -> &str;
    fn description(&self) -> &str;

    // Provided methods
    fn wrap_shell_command(
        &self,
        cmd: &mut Command,
        _shell_program: Option<&OsStr>,
    ) -> Result<()> { ... }
    fn check_initialization(&self) -> Result<()> { ... }
    fn coding_cli_unsupported_reason(&self) -> Option<&'static str> { ... }
}

Required Methods§

Source

fn wrap_command(&self, cmd: &mut Command) -> Result<()>

Source

fn is_available(&self) -> bool

Source

fn name(&self) -> &str

Return the human-readable name of this sandbox backend. Used in logs and diagnostics to identify which isolation strategy is active (e.g., "firejail", "bubblewrap", "none").

Source

fn description(&self) -> &str

Return a brief description of the isolation guarantees this sandbox provides. Displayed in status output and health checks so operators can verify the active security posture.

Provided Methods§

Source

fn wrap_shell_command( &self, cmd: &mut Command, _shell_program: Option<&OsStr>, ) -> Result<()>

Wrap a runtime-built shell command with its pre-resolution identity.

Host sandboxes retain the resolved program in cmd. A container sandbox may instead use shell_program inside its image, without changing how its own host launcher is resolved. None means that the runtime does not expose a direct shell program.

Source

fn check_initialization(&self) -> Result<()>

Report a retained construction failure without probing backend availability.

Source

fn coding_cli_unsupported_reason(&self) -> Option<&'static str>

Return a reason when this sandbox cannot preserve coding CLI semantics.

Coding CLI tools need a writable validated working directory and selected environment values to reach the actual CLI process. Container-style or replacing wrappers that cannot preserve those semantics must fail closed instead of spawning a misleading partial sandbox.