crates/heimdall-container/Cargo.toml
[package]
name = "nordisk-heimdall-container"
description = "Heimdall is a defensive sandbox: heimdall-container is the protected native JobRunner, a youki (libcontainer) container per job with Landlock, a hand-reviewed seccomp profile, rlimits, cgroup v2 limits and the image verified at every start, stated truthfully in its features."
version = "0.3.1"
edition.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
readme.workspace = true
rust-version.workspace = true
keywords = ["sandbox","container","youki","landlock","security"]
categories = ["virtualization"]
[package.metadata.docs.rs]
targets = ["x86_64-unknown-linux-gnu"]
[lib]
name = "heimdall_container"
path = "src/lib.rs"
[features]
# The shim (youki libcontainer + libseccomp; needs libseccomp-dev to build).
# Off by default so the workspace builds without the C library:
# cargo build -p nordisk-heimdall-container --features youki --bin heimdall-container-shim
default = []
youki = ["dep:libcontainer", "dep:oci-spec", "dep:nix", "heimdall-plain/youki"]
# Containment tests only: lets a test give the job a mount that Landlock does
# not list, to prove Landlock (not the mount) refuses it. Never in production.
containment-tests = []
[dependencies]
heimdall-core = { package = "nordisk-heimdall-core", path = "../heimdall-core", version = "0.3.0" }
heimdall-plain = { package = "nordisk-heimdall-plain", path = "../heimdall-plain", version = "0.3.0" }
heimdall-seccomp = { package = "nordisk-heimdall-seccomp", path = "../heimdall-seccomp", version = "0.3.0" }
heimdall-broker = { package = "nordisk-heimdall-broker", path = "../heimdall-broker", version = "0.3.0" }
heimdall-profiles = { package = "nordisk-heimdall-profiles", path = "../../profiles", version = "0.3.0" }
# The learning filter's fixed rules (probe-container), the same as probe-exec's.
heimdall-probe = { package = "nordisk-heimdall-probe", path = "../heimdall-probe", version = "0.3.0" }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
libc = "0.2"
landlock = "0.4"
thiserror = "2"
libcontainer = { version = "=0.7.0", default-features = false, features = ["v2", "libseccomp"], optional = true }
# The spec type the executor gets (libcontainer 0.7.0 uses oci-spec 0.10).
oci-spec = { version = "0.10", default-features = false, features = ["runtime"], optional = true }
nix = { version = "0.29", features = ["signal", "process"], optional = true }
[dev-dependencies]
heimdall-container = { package = "nordisk-heimdall-container", path = ".", features = ["containment-tests"] }
sha2 = "0.10"
tar = "0.4"
flate2 = "1"
proptest = "1"
[[bin]]
name = "heimdall-container-shim"
path = "src/bin/heimdall-container-shim.rs"
required-features = ["youki"]