Merge Semantics
This file is auto-generated by
can-docgen. Do not edit manually.
When multiple recipes are composed, each field follows a specific merge strategy.
Composition Order
base.toml (always loaded first)
→ auto-detected recipes (match_prefix against command binary)
→ explicit --recipe args (left to right)
→ manifest overrides (for `can up`)
= final SandboxConfig
Field Merge Strategies
| Field | Type | Strategy | Description |
|---|---|---|---|
recipe | RecipeMeta | Overlay | Later recipe’s metadata wins if present |
strict | Option<bool> | OR | Any Some(true) wins — can never be loosened |
filesystem.allow | Vec<PathBuf> | Union | Deduplicated, preserving first-occurrence order |
filesystem.allow_write | Vec<PathBuf> | Union | Deduplicated, preserving first-occurrence order |
filesystem.deny | Vec<PathBuf> | Union | Deduplicated, preserving first-occurrence order |
filesystem.mask | Vec<PathBuf> | Union | Deduplicated, preserving first-occurrence order |
host (top-level [[host]] blocks) | Vec<HostBlock> | Union by domain | Same domain → field-merged via HostBlock::merge; distinct domains preserved |
network.allow_ips | Vec<String> | Union | Deduplicated, preserving first-occurrence order |
network.egress | Option<EgressMode> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
network.ports | Vec<PortMapping> | Union | Deduplicated, preserving first-occurrence order |
process.max_pids | Option<u32> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
process.allow_execve | Vec<PathBuf> | Union | Deduplicated, preserving first-occurrence order |
process.env_passthrough | Vec<String> | Union | Deduplicated, preserving first-occurrence order |
resources.memory_mb | Option<u64> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
resources.cpu_percent | Option<u32> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
syscalls.seccomp_mode | Option<SeccompMode> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
syscalls.notifier | Option<bool> | Last-Some-wins | None preserves earlier value; Some(x) overwrites |
syscalls.allow | Vec<String> | Union | Absolute allow list (baseline only) |
syscalls.deny | Vec<String> | Union | Absolute deny list (baseline only) |
syscalls.allow_extra | Vec<String> | Union | Deduplicated, preserving first-occurrence order |
syscalls.deny_extra | Vec<String> | Union | Deduplicated, preserving first-occurrence order |
Strategy Definitions
- Union: Both base and overlay values are combined into a single list, deduplicated by value, preserving first-occurrence order.
- OR: Any
Some(true)wins permanently. Once strict mode is enabled by any recipe in the chain, it cannot be disabled. - Last-Some-wins: The last recipe that specifies a value (
Some(x)) wins.None(field omitted) preserves the earlier value. - Overlay: The later recipe’s value replaces the earlier one entirely if present.