NamespacePermissions

Defined in: packages/runtime/src/container/types.ts:218

What the container is allowed to do to its own namespace.

Remarks

Defaults chosen for a safe, locked-down guest: no mount mutations, but spawn / signal / srv remain enabled so typical workloads run unchanged.

Properties

mount?

readonly optional mount?: MountPolicy

Defined in: packages/runtime/src/container/types.ts:220

Can call mount/bind/unmount. Default: false.

---

signal?

readonly optional signal?: boolean

Defined in: packages/runtime/src/container/types.ts:226

Can signal own processes. Default: true.

---

spawn?

readonly optional spawn?: boolean

Defined in: packages/runtime/src/container/types.ts:224

Can spawn child processes. Default: true.

---

srv?

readonly optional srv?: boolean

Defined in: packages/runtime/src/container/types.ts:222

Can post to /srv. Default: true.