Struct ExecSession 

pub struct ExecSession {
    pub exec_id: String,
    pub input: Pin<Box<dyn AsyncWrite + Send>>,
    pub output: Pin<Box<dyn Stream<Item = Result<LogOutput, Error>> + Send>>,
}

Exec session handle for a single turn.

input is the stdin pipe into the container process. It is ONLY usable for a process that completes on a newline: the write half can never be closed, so stdin never reaches EOF (see ContainerManager::exec). Turn input goes in a file instead — NOT argv, which would leak a pasted secret via docker top / host ps / /proc/<pid>/cmdline; see ContainerManager::upload_turn_prompt. output is a bollard LogOutput stream; with tty: false Docker multiplexes stdout as LogOutput::StdOut frames and stderr as LogOutput::StdErr frames.

Env vars are passed via CreateExecOptions.env (Docker socket) — they never appear in process argv, preventing CWE-214 credential exposure via ps/proc.

Fields

exec_id: String

Docker exec id — pass to ContainerManager::inspect_exec after the output stream ends to retrieve the process’s real exit code. The stream ending is NOT the exit status, so callers that care about success/failure must inspect the exec (the in-container CLI can exit non-zero while still closing stdout cleanly).

input: Pin<Box<dyn AsyncWrite + Send>>

Stdin pipe to the container process. Unusable for EOF-terminated readers — see the type-level doc and ContainerManager::exec’s attach_stdin.

output: Pin<Box<dyn Stream<Item = Result<LogOutput, Error>> + Send>>

Multiplexed stdout/stderr stream (LogOutput::StdOut / LogOutput::StdErr).