config

type Config struct {
	Path    string  `toml:"-"`
	Network Network `toml:"network"`
	Podman  Podman  `toml:"podman"`
	Systemd Systemd `toml:"systemd"`
	Env     Env     `toml:"env"`
	Sandbox Sandbox `toml:"sandbox"`
}

type Env struct {
	Setenv []string `toml:"setenv"`
}

type Limits struct {
	MemoryMax     *string `toml:"memory_max"`
	MemoryHigh    *string `toml:"memory_high"`
	MemorySwapMax *string `toml:"memory_swap_max"`
	CPUQuota      *string `toml:"cpu_quota"`
	TasksMax      *int    `toml:"tasks_max"`
}

type Network struct {
	Public bool `toml:"public"`
	// LocalPorts are host ports spliced into the sandbox by pasta (-T/-U).
	// An empty list passes "none", so no host port is reachable.
	LocalPorts []int `toml:"local_ports"`
	// AllowCIDRs are egress destinations that stay reachable when Public is
	// false (the corporate-only / "private" mode). Normalized to masked
	// prefixes by validate; empty with Public false means loopback only.
	AllowCIDRs []string `toml:"allow_cidrs"`
	ResolvConf string   `toml:"resolv_conf"`
}

type Podman struct {
	Enabled     bool     `toml:"enabled"`
	Images      []string `toml:"images"`
	ChownShadow bool     `toml:"chown_shadow"`
}

type Sandbox struct {
	VirtualHome  string   `toml:"virtual_home"`
	Binds        []string `toml:"binds"`
	CwdGitMode   string   `toml:"cwd_git_mode"`
	SetupScripts []string `toml:"setup_scripts"`
}

type Systemd struct {
	Enabled bool   `toml:"enabled"`
	Limits  Limits `toml:"limits"`
}