NamespaceSpec

Defined in: packages/runtime/src/container/types.ts:72

Namespace configuration — the container boundary (rootfs + mounts + permissions).

Remarks

The namespace IS the container in this runtime: there is no process isolation separate from namespace isolation.

Properties

allow?

readonly optional allow?: NamespacePermissions

Defined in: packages/runtime/src/container/types.ts:86

Namespace permissions — what the container can do to its own namespace.

---

binds?

readonly optional binds?: readonly BindSpec[]

Defined in: packages/runtime/src/container/types.ts:80

Union binds applied AFTER all mounts.

---

devices?

readonly optional devices?: DeviceSpec

Defined in: packages/runtime/src/container/types.ts:83

Which synthetic devices to mount.

---

factotumScope?

readonly optional factotumScope?: readonly string[]

Defined in: packages/runtime/src/container/types.ts:94

Factotum credential scope — domain patterns this namespace can authenticate to.

• undefined = inherit parent’s effective scope (default, backwards compatible)
• [] = no auth access at all
• [‘api.anthropic.com’, ‘*.github.com’] = whitelist of domain patterns

---

image?

readonly optional image?: ImageRef

Defined in: packages/runtime/src/container/types.ts:74

Image reference — provides the frozen rootFs and base config. Optional for root container.

---

mounts?

readonly optional mounts?: Readonly<Record<string, MountSpec>>

Defined in: packages/runtime/src/container/types.ts:77

Additional mounts layered on top of image mounts, keyed by destination path.