microsandbox-rb 0.5.9 → 0.5.11

data/ext/microsandbox/src/sandbox.rs

@@ -89,9 +89,11 @@ impl Sandbox {
         for (host, guest) in conv::opt_port_map(opts, "ports")? {
             b = b.port(host, guest);
         }
-        // volumes: normalized by the Ruby layer to [guest, kind, source] triples.
+        // volumes: normalized by the Ruby layer to [guest, kind, source] triples,
+        // or [guest, kind, source, options] quads where options is a comma-joined
+        // list (ro/readonly, rw, noexec, nosuid, nodev).
         for spec in conv::opt::<Vec<Vec<String>>>(opts, "volumes")?.unwrap_or_default() {
-            if spec.len() != 3 {
+            if spec.len() < 3 || spec.len() > 4 {
                 return Err(error::base_error("invalid volume mount spec"));
             }
             let (guest, kind, source) = (spec[0].clone(), spec[1].clone(), spec[2].clone());
@@ -103,12 +105,43 @@ impl Sandbox {
                     )))
                 }
             }
+            // Validate options up front (the volume closure cannot return an error).
+            let mount_opts: Vec<String> = spec
+                .get(3)
+                .map(|s| {
+                    s.split(',')
+                        .map(|o| o.trim().to_string())
+                        .filter(|o| !o.is_empty())
+                        .collect()
+                })
+                .unwrap_or_default();
+            for opt in &mount_opts {
+                match opt.as_str() {
+                    "ro" | "readonly" | "rw" | "noexec" | "nosuid" | "nodev" => {}
+                    other => {
+                        return Err(error::base_error(format!(
+                            "unknown volume mount option {other:?} \
+                             (expected ro/rw/noexec/nosuid/nodev)"
+                        )))
+                    }
+                }
+            }
             b = b.volume(guest, move |m| {
-                if kind == "named" {
+                let mut m = if kind == "named" {
                     m.named(source)
                 } else {
                     m.bind(source)
+                };
+                for opt in &mount_opts {
+                    m = match opt.as_str() {
+                        "ro" | "readonly" => m.readonly(),
+                        "noexec" => m.noexec(),
+                        "nosuid" => m.nosuid(),
+                        "nodev" => m.nodev(),
+                        _ => m, // "rw" — default; already validated above
+                    };
                 }
+                m
             });
         }
         // patches: rootfs modifications applied before boot. The Ruby layer
@@ -209,27 +242,36 @@ impl Sandbox {
         Ok(Sandbox::from_inner(inner))
     }
 
-    /// Lightweight metadata for a sandbox by name (running or not).
-    fn get(name: String) -> Result<RHash, Error> {
+    /// A controllable handle for a sandbox by name (running or not). Carries
+    /// metadata accessors and the full lifecycle surface (see `SbHandle`).
+    fn get(name: String) -> Result<SbHandle, Error> {
         let handle = block_on(microsandbox::Sandbox::get(&name)).map_err(error::to_ruby)?;
-        Ok(handle_to_hash(&handle))
+        Ok(SbHandle::from_inner(handle))
     }
 
-    /// All sandboxes as metadata hashes.
+    /// All sandboxes as controllable handles.
     fn list() -> Result<RArray, Error> {
         let handles = block_on(microsandbox::Sandbox::list()).map_err(error::to_ruby)?;
-        rhash_array(handles.iter().map(handle_to_hash))
+        let arr = ruby().ary_new();
+        for h in handles {
+            arr.push(SbHandle::from_inner(h))?;
+        }
+        Ok(arr)
     }
 
-    /// Sandboxes filtered by required `key=value` labels (AND-matched). `opts`
-    /// carries a string→string `labels` map.
+    /// Sandboxes filtered by required `key=value` labels (AND-matched), as
+    /// controllable handles. `opts` carries a string→string `labels` map.
     fn list_with(opts: RHash) -> Result<RArray, Error> {
         let mut filter = SandboxFilter::new();
         for (k, v) in conv::opt_string_map(opts, "labels")? {
             filter = filter.label(k, v);
         }
         let handles = block_on(microsandbox::Sandbox::list_with(filter)).map_err(error::to_ruby)?;
-        rhash_array(handles.iter().map(handle_to_hash))
+        let arr = ruby().ary_new();
+        for h in handles {
+            arr.push(SbHandle::from_inner(h))?;
+        }
+        Ok(arr)
     }
 
     /// Remove a (stopped) sandbox by name.
@@ -286,44 +328,46 @@ impl Sandbox {
         Ok(ExecHandle::from_core(handle))
     }
 
-    /// Graceful stop (+ wait). `timeout` is optional seconds.
-    fn stop(&self, timeout: Option<f64>) -> Result<(), Error> {
-        match timeout {
-            Some(secs) => block_on(self.inner.stop_with_timeout(Duration::from_secs_f64(secs))),
-            None => block_on(self.inner.stop()),
-        }
+    /// Graceful stop. Mirrors the official SDKs: the live handle routes through
+    /// a freshly fetched `SandboxHandle::stop` (SIGTERM→SIGKILL escalation with
+    /// a 10s default). Fine-grained control — a custom timeout or fire-and-
+    /// return `request_*` — lives on `SandboxHandle`, obtained via `Sandbox.get`.
+    fn stop(&self) -> Result<(), Error> {
+        let name = self.inner.name().to_string();
+        block_on(async move {
+            let handle = microsandbox::sandbox::Sandbox::get(&name).await?;
+            handle.stop().await
+        })
         .map_err(error::to_ruby)
     }
 
-    /// Force kill (SIGKILL). `timeout` is optional seconds.
-    fn kill(&self, timeout: Option<f64>) -> Result<(), Error> {
-        match timeout {
-            Some(secs) => block_on(self.inner.kill_with_timeout(Duration::from_secs_f64(secs))),
-            None => block_on(self.inner.kill()),
-        }
-        .map_err(error::to_ruby)
+    /// Graceful stop, then wait for the process to exit. Returns an exit-status
+    /// Hash (`exit_code`, `success`). Local backend only.
+    fn stop_and_wait(&self) -> Result<RHash, Error> {
+        let status = block_on(self.inner.stop_and_wait()).map_err(error::to_ruby)?;
+        Ok(exit_status_to_hash(status))
     }
 
-    /// Send the graceful-shutdown request and return without waiting.
-    fn request_stop(&self) -> Result<(), Error> {
-        block_on(self.inner.request_stop()).map_err(error::to_ruby)
+    /// Force kill (SIGKILL).
+    fn kill(&self) -> Result<(), Error> {
+        block_on(self.inner.kill()).map_err(error::to_ruby)
     }
 
-    /// Send the force-kill request and return without waiting.
-    fn request_kill(&self) -> Result<(), Error> {
-        block_on(self.inner.request_kill()).map_err(error::to_ruby)
+    /// Trigger a graceful drain (SIGUSR1 on local).
+    fn drain(&self) -> Result<(), Error> {
+        block_on(self.inner.drain()).map_err(error::to_ruby)
     }
 
-    /// Send the drain request and return without waiting.
-    fn request_drain(&self) -> Result<(), Error> {
-        block_on(self.inner.request_drain()).map_err(error::to_ruby)
+    /// Wait for the process to exit. Returns an exit-status Hash. Local only.
+    fn wait(&self) -> Result<RHash, Error> {
+        let status = block_on(self.inner.wait()).map_err(error::to_ruby)?;
+        Ok(exit_status_to_hash(status))
     }
 
-    /// Block until the sandbox is observed in a terminal state; returns a
-    /// stop-result Hash (name, status, exit_code, signal, observed_at_ms, source).
-    fn wait_until_stopped(&self) -> Result<RHash, Error> {
-        let result = block_on(self.inner.wait_until_stopped()).map_err(error::to_ruby)?;
-        Ok(stop_result_to_hash(&result))
+    /// Live status fetched from the backend (a round-trip per call).
+    fn status(&self) -> Result<String, Error> {
+        let status = block_on(self.inner.status()).map_err(error::to_ruby)?;
+        Ok(sandbox_status_str(status).to_string())
     }
 
     /// Whether this handle owns the sandbox process lifecycle (a synchronous,
@@ -1064,6 +1108,7 @@ struct ExecOpts {
     timeout: Option<Duration>,
     tty: bool,
     stdin: Option<Vec<u8>>,
+    stdin_pipe: bool,
     rlimits: Vec<(RlimitResource, u64, u64)>,
 }
 
@@ -1078,6 +1123,7 @@ impl ExecOpts {
             timeout: conv::opt_f64(opts, "timeout")?.map(Duration::from_secs_f64),
             tty: conv::opt_bool(opts, "tty")?,
             stdin,
+            stdin_pipe: conv::opt_bool(opts, "stdin_pipe")?,
             rlimits: parse_rlimits(opts)?,
         })
     }
@@ -1104,7 +1150,13 @@ impl ExecOpts {
         if self.tty {
             b = b.tty(true);
         }
-        if let Some(stdin) = self.stdin {
+        // Pipe mode opens a writable stdin sink (lifted out by ExecHandle via
+        // `take_stdin`); bytes mode feeds a fixed buffer and closes. The core's
+        // `StdinMode` is a single enum, so the two are mutually exclusive — pipe
+        // wins if a caller somehow sets both.
+        if self.stdin_pipe {
+            b = b.stdin_pipe();
+        } else if let Some(stdin) = self.stdin {
             b = b.stdin_bytes(stdin);
         }
         for (resource, soft, hard) in self.rlimits {
@@ -1195,7 +1247,13 @@ pub(crate) fn metrics_to_hash(m: &SandboxMetrics) -> RHash {
 }
 
 fn sandbox_status_str(status: SandboxStatus) -> &'static str {
+    // Lowercased `Debug` names, matching the official SDKs' `format!("{:?}")`.
+    // `Created`/`Starting` are new in v0.5.8 (cloud-only today). The match is
+    // intentionally exhaustive — no wildcard — so a future upstream variant
+    // surfaces as a compile error rather than a silent fallback.
     match status {
+        SandboxStatus::Created => "created",
+        SandboxStatus::Starting => "starting",
         SandboxStatus::Running => "running",
         SandboxStatus::Draining => "draining",
         SandboxStatus::Paused => "paused",
@@ -1204,6 +1262,15 @@ fn sandbox_status_str(status: SandboxStatus) -> &'static str {
     }
 }
 
+/// A `std::process::ExitStatus` as a Ruby Hash: `exit_code` (Integer or nil) and
+/// `success` (Boolean). Returned by the live `Sandbox#wait` / `#stop_and_wait`.
+fn exit_status_to_hash(status: std::process::ExitStatus) -> RHash {
+    let hash = ruby().hash_new();
+    let _ = hash.aset("exit_code", status.code());
+    let _ = hash.aset("success", status.success());
+    hash
+}
+
 fn stop_result_to_hash(result: &SandboxStopResult) -> RHash {
     let hash = ruby().hash_new();
     let _ = hash.aset("name", result.name.clone());
@@ -1215,19 +1282,85 @@ fn stop_result_to_hash(result: &SandboxStopResult) -> RHash {
     hash
 }
 
-fn handle_to_hash(handle: &SandboxHandle) -> RHash {
-    let hash = ruby().hash_new();
-    let _ = hash.aset("name", handle.name().to_string());
-    let _ = hash.aset("status", sandbox_status_str(handle.status()));
-    let _ = hash.aset(
-        "created_at_ms",
-        handle.created_at().map(|dt| dt.timestamp_millis()),
-    );
-    let _ = hash.aset(
-        "updated_at_ms",
-        handle.updated_at().map(|dt| dt.timestamp_millis()),
-    );
-    hash
+//--------------------------------------------------------------------------------------------------
+// SandboxHandle — the controllable lightweight handle
+//--------------------------------------------------------------------------------------------------
+
+/// Wraps a core `microsandbox::sandbox::SandboxHandle` (returned by
+/// `Sandbox.get`/`list`/`list_with`). Carries metadata accessors plus the rich
+/// lifecycle surface that moved off the live `Sandbox` in v0.5.8 — mirroring the
+/// official Python (`PySandboxHandle`) and Node (`SandboxHandle`) SDKs. Status is
+/// a synchronous snapshot read off the handle (no round-trip).
+#[magnus::wrap(class = "Microsandbox::Native::SandboxHandle", free_immediately, size)]
+pub struct SbHandle {
+    inner: SandboxHandle,
+}
+
+impl SbHandle {
+    fn from_inner(inner: SandboxHandle) -> Self {
+        Self { inner }
+    }
+
+    fn name(&self) -> String {
+        self.inner.name().to_string()
+    }
+
+    /// Status snapshot captured when the handle was fetched (synchronous).
+    fn status(&self) -> String {
+        sandbox_status_str(self.inner.status_snapshot()).to_string()
+    }
+
+    fn created_at_ms(&self) -> Option<i64> {
+        self.inner.created_at().map(|dt| dt.timestamp_millis())
+    }
+
+    fn updated_at_ms(&self) -> Option<i64> {
+        self.inner.updated_at().map(|dt| dt.timestamp_millis())
+    }
+
+    /// Graceful stop (SIGTERM→SIGKILL escalation, 10s default) and wait.
+    fn stop(&self) -> Result<(), Error> {
+        block_on(self.inner.stop()).map_err(error::to_ruby)
+    }
+
+    /// Graceful stop with a custom escalation timeout (seconds).
+    fn stop_with_timeout(&self, secs: f64) -> Result<(), Error> {
+        block_on(self.inner.stop_with_timeout(Duration::from_secs_f64(secs)))
+            .map_err(error::to_ruby)
+    }
+
+    /// Force kill (SIGKILL) and wait.
+    fn kill(&self) -> Result<(), Error> {
+        block_on(self.inner.kill()).map_err(error::to_ruby)
+    }
+
+    /// Force kill, waiting up to `secs` for the process to disappear.
+    fn kill_with_timeout(&self, secs: f64) -> Result<(), Error> {
+        block_on(self.inner.kill_with_timeout(Duration::from_secs_f64(secs)))
+            .map_err(error::to_ruby)
+    }
+
+    /// Send the graceful-shutdown request and return without waiting.
+    fn request_stop(&self) -> Result<(), Error> {
+        block_on(self.inner.request_stop()).map_err(error::to_ruby)
+    }
+
+    /// Send the force-kill request and return without waiting.
+    fn request_kill(&self) -> Result<(), Error> {
+        block_on(self.inner.request_kill()).map_err(error::to_ruby)
+    }
+
+    /// Send the drain request (SIGUSR1) and return without waiting.
+    fn request_drain(&self) -> Result<(), Error> {
+        block_on(self.inner.request_drain()).map_err(error::to_ruby)
+    }
+
+    /// Block until the sandbox reaches a terminal state; returns a stop-result
+    /// Hash (name, status, exit_code, signal, observed_at_ms, source).
+    fn wait_until_stopped(&self) -> Result<RHash, Error> {
+        let result = block_on(self.inner.wait_until_stopped()).map_err(error::to_ruby)?;
+        Ok(stop_result_to_hash(&result))
+    }
 }
 
 //--------------------------------------------------------------------------------------------------
@@ -1328,15 +1461,12 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     class.define_method("shell", method!(Sandbox::shell, 2))?;
     class.define_method("exec_stream", method!(Sandbox::exec_stream, 3))?;
     class.define_method("shell_stream", method!(Sandbox::shell_stream, 2))?;
-    class.define_method("stop", method!(Sandbox::stop, 1))?;
-    class.define_method("kill", method!(Sandbox::kill, 1))?;
-    class.define_method("request_stop", method!(Sandbox::request_stop, 0))?;
-    class.define_method("request_kill", method!(Sandbox::request_kill, 0))?;
-    class.define_method("request_drain", method!(Sandbox::request_drain, 0))?;
-    class.define_method(
-        "wait_until_stopped",
-        method!(Sandbox::wait_until_stopped, 0),
-    )?;
+    class.define_method("stop", method!(Sandbox::stop, 0))?;
+    class.define_method("stop_and_wait", method!(Sandbox::stop_and_wait, 0))?;
+    class.define_method("kill", method!(Sandbox::kill, 0))?;
+    class.define_method("drain", method!(Sandbox::drain, 0))?;
+    class.define_method("wait", method!(Sandbox::wait, 0))?;
+    class.define_method("status", method!(Sandbox::status, 0))?;
     class.define_method("owns_lifecycle", method!(Sandbox::owns_lifecycle, 0))?;
     class.define_method("detach", method!(Sandbox::detach, 0))?;
     class.define_method("metrics", method!(Sandbox::metrics, 0))?;
@@ -1367,5 +1497,22 @@ pub fn define(ruby: &Ruby, native: &RModule) -> Result<(), Error> {
     class.define_method("attach", method!(Sandbox::attach, 3))?;
     class.define_method("attach_shell", method!(Sandbox::attach_shell, 0))?;
 
+    let handle = native.define_class("SandboxHandle", ruby.class_object())?;
+    handle.define_method("name", method!(SbHandle::name, 0))?;
+    handle.define_method("status", method!(SbHandle::status, 0))?;
+    handle.define_method("created_at_ms", method!(SbHandle::created_at_ms, 0))?;
+    handle.define_method("updated_at_ms", method!(SbHandle::updated_at_ms, 0))?;
+    handle.define_method("stop", method!(SbHandle::stop, 0))?;
+    handle.define_method("stop_with_timeout", method!(SbHandle::stop_with_timeout, 1))?;
+    handle.define_method("kill", method!(SbHandle::kill, 0))?;
+    handle.define_method("kill_with_timeout", method!(SbHandle::kill_with_timeout, 1))?;
+    handle.define_method("request_stop", method!(SbHandle::request_stop, 0))?;
+    handle.define_method("request_kill", method!(SbHandle::request_kill, 0))?;
+    handle.define_method("request_drain", method!(SbHandle::request_drain, 0))?;
+    handle.define_method(
+        "wait_until_stopped",
+        method!(SbHandle::wait_until_stopped, 0),
+    )?;
+
     Ok(())
 }

data/ext/microsandbox/src/volume.rs

@@ -65,7 +65,12 @@ fn create(name: String, opts: RHash) -> Result<RHash, Error> {
     let vol = block_on(builder.create()).map_err(error::to_ruby)?;
     let hash = ruby().hash_new();
     hash.aset("name", vol.name().to_string())?;
-    hash.aset("path", vol.path().display().to_string())?;
+    // `path()` is fallible as of v0.5.8 (returns `Unsupported` for cloud
+    // volumes); the volume just created here is local, so this resolves.
+    hash.aset(
+        "path",
+        vol.path().map_err(error::to_ruby)?.display().to_string(),
+    )?;
     Ok(hash)
 }
 

data/lib/microsandbox/errors.rb

@@ -65,4 +65,10 @@ module Microsandbox
 
   # Runtime compatibility ---------------------------------------------------
   define_error(:UnsupportedOperationError, "unsupported-operation")
+
+  # Cloud / backend routing errors (v0.5.8) ---------------------------------
+  # `UnsupportedError` (a backend feature gap, e.g. an op not yet wired on the
+  # cloud backend) is distinct from `UnsupportedOperationError` above.
+  define_error(:CloudHttpError, "cloud-http")
+  define_error(:UnsupportedError, "unsupported")
 end

data/lib/microsandbox/exec_handle.rb

@@ -22,25 +22,28 @@ module Microsandbox
 
     # @return [String, nil] {#data} decoded as UTF-8 (lenient)
     def text
-      @data && @data.dup.force_encoding(Encoding::UTF_8)
+      @data&.dup&.force_encoding(Encoding::UTF_8)
     end
 
-    def started?      = @type == :started
-    def stdout?       = @type == :stdout
-    def stderr?       = @type == :stderr
-    def exited?       = @type == :exited
-    def failed?       = @type == :failed
-    def stdin_error?  = @type == :stdin_error
+    def started? = @type == :started
+    def stdout? = @type == :stdout
+    def stderr? = @type == :stderr
+    def exited? = @type == :exited
+    def failed? = @type == :failed
+    def stdin_error? = @type == :stdin_error
 
     def inspect
-      "#<Microsandbox::ExecEvent type=#{@type}#{@pid ? " pid=#{@pid}" : ""}" \
-        "#{@code ? " code=#{@code}" : ""}#{@data ? " data=#{@data.bytesize}B" : ""}>"
+      "#<Microsandbox::ExecEvent type=#{@type}#{" pid=#{@pid}" if @pid}" \
+        "#{" code=#{@code}" if @code}#{" data=#{@data.bytesize}B" if @data}>"
     end
   end
 
-  # The terminal status of a streamed execution, from {ExecHandle#wait}.
+  # The terminal status of a streamed execution ({ExecHandle#wait}) or of a
+  # sandbox process ({Sandbox#wait}, {Sandbox#stop_and_wait}).
   class ExitStatus
-    # @return [Integer]
+    # @return [Integer, nil] the exit code, or nil when the process was
+    #   terminated by a signal and so carries no code (e.g. a SIGKILL'd sandbox
+    #   from {Sandbox#kill} then {Sandbox#wait}) — check {#success?} in that case.
     attr_reader :exit_code
 
     def initialize(data)

data/lib/microsandbox/fs.rb

@@ -30,9 +30,9 @@ module Microsandbox
       @modified_ms && Time.at(@modified_ms / 1000.0)
     end
 
-    def file?       = @type == :file
-    def directory?  = @type == :directory
-    def symlink?    = @type == :symlink
+    def file? = @type == :file
+    def directory? = @type == :directory
+    def symlink? = @type == :symlink
 
     def inspect
       "#<Microsandbox::FsEntry path=#{@path.inspect} type=#{@type} size=#{@size}>"
@@ -57,10 +57,10 @@ module Microsandbox
       @created_ms = data["created_ms"]
     end
 
-    def readonly?   = @readonly
-    def file?       = @type == :file
-    def directory?  = @type == :directory
-    def symlink?    = @type == :symlink
+    def readonly? = @readonly
+    def file? = @type == :file
+    def directory? = @type == :directory
+    def symlink? = @type == :symlink
 
     # @return [Time, nil] last-modified time, if known
     def modified

data/lib/microsandbox/image.rb

@@ -56,7 +56,7 @@ module Microsandbox
   # The result of {Image.prune}.
   class ImagePruneReport
     attr_reader :image_refs_removed, :manifests_removed, :layers_removed,
-                :fsmeta_removed, :vmdk_removed, :bytes_reclaimed
+      :fsmeta_removed, :vmdk_removed, :bytes_reclaimed
 
     def initialize(data)
       @image_refs_removed = data["image_refs_removed"]

data/lib/microsandbox/network.rb

@@ -16,23 +16,23 @@ module Microsandbox
     module_function
 
     # Match any destination.
-    def any = { "destination_kind" => "any" }
+    def any = {"destination_kind" => "any"}
 
     # A single IP address (stored as a /32 or /128).
-    def ip(value) = { "destination_kind" => "ip", "destination" => value.to_s }
+    def ip(value) = {"destination_kind" => "ip", "destination" => value.to_s}
 
     # An IP network in CIDR notation (e.g. "10.0.0.0/8").
-    def cidr(value) = { "destination_kind" => "cidr", "destination" => value.to_s }
+    def cidr(value) = {"destination_kind" => "cidr", "destination" => value.to_s}
 
     # An exact domain name (matched against the resolved-hostname cache / SNI).
-    def domain(value) = { "destination_kind" => "domain", "destination" => value.to_s }
+    def domain(value) = {"destination_kind" => "domain", "destination" => value.to_s}
 
     # A domain suffix — matches the apex and any subdomain (e.g. ".internal").
-    def domain_suffix(value) = { "destination_kind" => "domain_suffix", "destination" => value.to_s }
+    def domain_suffix(value) = {"destination_kind" => "domain_suffix", "destination" => value.to_s}
 
     # A predefined group: :public, :loopback, :private, :link_local, :metadata,
     # :multicast, or :host.
-    def group(value) = { "destination_kind" => "group", "destination" => value.to_s.tr("_", "-") }
+    def group(value) = {"destination_kind" => "group", "destination" => value.to_s.tr("_", "-")}
   end
 
   # Factory for a single network-policy **rule**. A rule pairs an action
@@ -64,7 +64,7 @@ module Microsandbox
 
     # @api private
     def build(action, destination, direction, protocol, protocols, port, ports)
-      rule = { "action" => action, "direction" => direction.to_s }
+      rule = {"action" => action, "direction" => direction.to_s}
       rule.merge!(normalize_destination(destination))
       protos = (Array(protocols) + Array(protocol)).compact.map(&:to_s)
       rule["protocols"] = protos unless protos.empty?
@@ -78,7 +78,7 @@ module Microsandbox
       case dest
       when nil then {}
       when Hash then dest.each_with_object({}) { |(k, v), a| a[k.to_s] = v }
-      when String, Symbol then { "destination" => dest.to_s }
+      when String, Symbol then {"destination" => dest.to_s}
       else raise ArgumentError, "invalid rule destination: #{dest.inspect}"
       end
     end
@@ -149,7 +149,7 @@ module Microsandbox
       # @param deny_domain_suffixes [Array<String>] domain suffixes to deny
       # @return [NetworkPolicy]
       def custom(default_egress: :deny, default_ingress: :allow, rules: [],
-                 deny_domains: [], deny_domain_suffixes: [])
+        deny_domains: [], deny_domain_suffixes: [])
         h = {}
         h["default_egress"] = action_str(default_egress) unless default_egress.nil?
         h["default_ingress"] = action_str(default_ingress) unless default_ingress.nil?
@@ -163,12 +163,12 @@ module Microsandbox
       def coerce(network)
         case network
         when NetworkPolicy then network.to_h
-        when String, Symbol then { "preset" => canonical_preset(network) }
+        when String, Symbol then {"preset" => canonical_preset(network)}
         when Hash then from_hash(network)
         else
           raise ArgumentError,
-                "network: expects a preset name, a Microsandbox::NetworkPolicy, or a Hash " \
-                "(got #{network.class})"
+            "network: expects a preset name, a Microsandbox::NetworkPolicy, or a Hash " \
+            "(got #{network.class})"
         end
       end
 
@@ -186,11 +186,11 @@ module Microsandbox
         if sym.key?(:preset)
           if sym.key?(:rules) || sym.key?(:default_egress) || sym.key?(:default_ingress)
             raise ArgumentError,
-                  "network preset: cannot be combined with rules:/default_egress:/" \
-                  "default_ingress: (the preset already defines its rules and defaults); " \
-                  "only deny_domains:/deny_domain_suffixes: may be layered on a preset"
+              "network preset: cannot be combined with rules:/default_egress:/" \
+              "default_ingress: (the preset already defines its rules and defaults); " \
+              "only deny_domains:/deny_domain_suffixes: may be layered on a preset"
           end
-          h = { "preset" => canonical_preset(sym[:preset]) }
+          h = {"preset" => canonical_preset(sym[:preset])}
           add_deny_lists(h, sym[:deny_domains], sym[:deny_domain_suffixes])
           h
         elsif sym.key?(:rules) || sym.key?(:default_egress) || sym.key?(:default_ingress)
@@ -213,7 +213,7 @@ module Microsandbox
           ds = Array(sym[:deny_domain_suffixes]).map(&:to_s)
           return {} if dd.empty? && ds.empty?
 
-          h = { "default_egress" => "allow", "default_ingress" => "allow" }
+          h = {"default_egress" => "allow", "default_ingress" => "allow"}
           add_deny_lists(h, dd, ds)
           h
         end
@@ -233,8 +233,8 @@ module Microsandbox
         key = name.to_s.downcase
         PRESET_ALIASES[key] ||
           raise(ArgumentError,
-                "unknown network preset #{name.inspect} " \
-                "(expected one of public_only/none/allow_all/non_local)")
+            "unknown network preset #{name.inspect} " \
+            "(expected one of public_only/none/allow_all/non_local)")
       end
 
       def action_str(action)