Expand description
The sandbox abstraction.
Sandbox is the trait every plugin-runtime impl satisfies (WASM
in-process via wasmtime in confium-sandbox-wasm, out-of-process
via stdin/stdout JSON-RPC in this crate’s
ProcessSandbox). Every instance runs
inside the sandbox’s capability envelope: a plugin cannot reach a
host import it has not been granted.
This trait mirrors confium_sandbox_wasm::Sandbox exactly so a
consumer can swap runtimes behind a single trait object.
Enums§
- Capability
- A capability a sandboxed plugin may be granted.
- Filesystem
Mode - Access mode for a
Capability::FilesystemPath. - Value
- A value passed across the sandbox boundary. Intentionally a small
set — structured data crosses via a length-prefixed byte payload
(
Bytes) rather than being encoded into the type system.
Traits§
- Sandbox
- A plugin runtime.
- Sandbox
Instance - A loaded, capability-bound plugin.