name: "rust download script"

mode: ONCE
hostname: "rust"
log_level: ERROR

disable_rl: true

cwd: "/tmp"

clone_newnet: false

skip_setsid: true
keep_caps: false
keep_env: true
mount_proc: true

mount {
    src: "/bin"
    dst: "/bin"
	is_bind: true
}

mount {
    src: "/lib"
    dst: "/lib"
	is_bind: true
}


mount {
    src: "/lib64"
    dst: "/lib64"
	is_bind: true
    mandatory: false
}


mount {
    src: "/usr"
    dst: "/usr"
	is_bind: true
}

mount {
	src: "/dev/null"
	dst: "/dev/null"
	is_bind: true
	rw: true
}

{TMP_MOUNT_BLOCK}

mount {
    src: "/etc"
    dst: "/etc"
	is_bind: true
}

# Container runtimes bind exactly these 3 files as separate submounts over
# /etc; nsjail's ro remount of /etc is non-recursive so they stay writable.
# Load-bearing -- do not remove as redundant with the /etc bind above.
mount {
    src: "/etc/resolv.conf"
    dst: "/etc/resolv.conf"
    is_bind: true
    mandatory: false
}

mount {
    src: "/etc/hosts"
    dst: "/etc/hosts"
    is_bind: true
    mandatory: false
}

mount {
    src: "/etc/hostname"
    dst: "/etc/hostname"
    is_bind: true
    mandatory: false
}

mount {
    src: "/dev/random"
    dst: "/dev/random"
    is_bind: true
}
mount {
    src: "{JOB_DIR}"
    dst: "/tmp"
    is_bind: true
    rw: true
}

mount {
    src: "/dev/urandom"
    dst: "/dev/urandom"
    is_bind: true
}

iface_no_lo: true

mount {
    src: "{BUILD}"
    dst: "{BUILD}"
    is_bind: true
    mandatory: false
    rw: true
}
mount {
    src: "{CARGO_HOME}"
    dst: "{CARGO_HOME}"
    is_bind: true
    # Readonly
    rw: false
}

mount {
    src: "{RUSTUP_HOME}"
    dst: "{RUSTUP_HOME}"
    is_bind: true
    rw: false
    mandatory: false
}

mount {
    src: "{BUILD}/registry"
    dst: "{CARGO_HOME}/registry"
    is_bind: true
    mandatory: true
    # Read-write
    rw: true
}

mount {
    src: "{BUILD}/git"
    dst: "{CARGO_HOME}/git"
    is_bind: true
    mandatory: true
    # Read-write
    rw: true
}

mount {
    src: "{TRACING_PROXY_CA_CERT_PATH}"
    dst: "{TRACING_PROXY_CA_CERT_PATH}"
    is_bind: true
    mandatory: false
}

#{DEV}
