[package]
name = "kf-sandbox"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true

[features]
# Restricted to no-NIC/no-share/no-credential independent-VM acceptance.
# Adds fixed VM probes and fault injection; ordinary execution uses the same kernel gates.
vm-acceptance = []

[dependencies]
kf-contracts.workspace = true
clap.workspace = true
serde.workspace = true
serde_json.workspace = true
sha2 = "=0.10.9"
rustix = { version = "1.1.5", features = ["net", "process", "fs", "thread", "mount", "system", "stdio", "pipe", "event"] }

# Fixed BPF compilation/installation through safe APIs; libc supplies syscall
# numbers and the audited fork/exec primitive. Both dependencies stay inside
# the OS sandbox boundary.
seccompiler = { version = "=0.5.0", default-features = false }
libc = "=0.2.190"

[lints]
workspace = true

[[example]]
name = "identity_probe"
test = false