Compile the NsJail config protobuf into Python code

Include a helper shell script for compilation.

5 files changed, 1265 insertions, 1 deletions

diff --git a/.flake8 b/.flake8
index d0f7459..05e97ac 100644
--- a/.flake8
+++ b/.flake8
@@ -6,7 +6,7 @@ import-order-style = pycharm
 inline-quotes = "
 max-line-length = 100
 
-exclude = __pycache__,.cache,user_base,venv,.venv
+exclude = __pycache__,.cache,user_base,venv,.venv,snekbox/config.py
 
 ignore =
     W503,
diff --git a/NOTICE b/NOTICE
new file mode 100644
index 0000000..f38232e
--- /dev/null
+++ b/NOTICE
@@ -0,0 +1,207 @@
+The Python code at snekbox/config.py was generated from config.proto in nsjail
+Copyright 2014 Google Inc. All Rights Reserved.
+Copyright 2016 Sergiusz Bazanski. All Rights Reserved.
+
+-------------------------------------------------------------------------------
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/Pipfile b/Pipfile
index 86ec69f..5609128 100644
--- a/Pipfile
+++ b/Pipfile
@@ -42,6 +42,7 @@ testb = """
 report = "coverage report"
 snekbox = "gunicorn -c config/gunicorn.conf.py snekbox.api.app"
 devsh = "sh scripts/dev.sh"
+protoc = "sh scripts/protoc.sh"
 build = """
     docker build \
         -t ghcr.io/python-discord/snekbox:latest \
diff --git a/scripts/protoc.sh b/scripts/protoc.sh
new file mode 100755
index 0000000..5771b95
--- /dev/null
+++ b/scripts/protoc.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env sh
+
+set -eu
+
+URL='https://raw.githubusercontent.com/google/nsjail/2.9/config.proto'
+SRC_DIR='snekbox'
+FILE_NAME='config'
+PROTO_PATH="${SRC_DIR}/${FILE_NAME}.proto"
+
+curl -SsL "${URL}" -o "${PROTO_PATH}"
+protoc --proto_path="${SRC_DIR}" --python_out="${SRC_DIR}" "${PROTO_PATH}"
+
+rm -f "${PROTO_PATH}"
+mv -f "${SRC_DIR}/${FILE_NAME}_pb"*.py "${SRC_DIR}/${FILE_NAME}.py"
diff --git a/snekbox/config.py b/snekbox/config.py
new file mode 100644
index 0000000..e2a7192
--- /dev/null
+++ b/snekbox/config.py
@@ -0,0 +1,1042 @@
+# -*- coding: utf-8 -*-
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: config.proto
+
+from google.protobuf.internal import enum_type_wrapper
+from google.protobuf import descriptor as _descriptor
+from google.protobuf import message as _message
+from google.protobuf import reflection as _reflection
+from google.protobuf import symbol_database as _symbol_database
+# @@protoc_insertion_point(imports)
+
+_sym_db = _symbol_database.Default()
+
+
+
+
+DESCRIPTOR = _descriptor.FileDescriptor(
+  name='config.proto',
+  package='nsjail',
+  syntax='proto2',
+  serialized_options=None,
+  create_key=_descriptor._internal_create_key,
+  serialized_pb=b'\n\x0c\x63onfig.proto\x12\x06nsjail\"a\n\x05IdMap\x12\x13\n\tinside_id\x18\x01 \x01(\t:\x00\x12\x14\n\noutside_id\x18\x02 \x01(\t:\x00\x12\x10\n\x05\x63ount\x18\x03 \x01(\r:\x01\x31\x12\x1b\n\x0cuse_newidmap\x18\x04 \x01(\x08:\x05\x66\x61lse\"\xca\x02\n\x07MountPt\x12\r\n\x03src\x18\x01 \x01(\t:\x00\x12\x18\n\x0eprefix_src_env\x18\x02 \x01(\t:\x00\x12\x15\n\x0bsrc_content\x18\x03 \x01(\x0c:\x00\x12\r\n\x03\x64st\x18\x04 \x02(\t:\x00\x12\x18\n\x0eprefix_dst_env\x18\x05 \x01(\t:\x00\x12\x10\n\x06\x66stype\x18\x06 \x01(\t:\x00\x12\x11\n\x07options\x18\x07 \x01(\t:\x00\x12\x16\n\x07is_bind\x18\x08 \x01(\x08:\x05\x66\x61lse\x12\x11\n\x02rw\x18\t \x01(\x08:\x05\x66\x61lse\x12\x0e\n\x06is_dir\x18\n \x01(\x08\x12\x17\n\tmandatory\x18\x0b \x01(\x08:\x04true\x12\x19\n\nis_symlink\x18\x0c \x01(\x08:\x05\x66\x61lse\x12\x15\n\x06nosuid\x18\r \x01(\x08:\x05\x66\x61lse\x12\x14\n\x05nodev\x18\x0e \x01(\x08:\x05\x66\x61lse\x12\x15\n\x06noexec\x18\x0f \x01(\x08:\x05\x66\x61lse\"F\n\x03\x45xe\x12\x0c\n\x04path\x18\x01 \x02(\t\x12\x0b\n\x03\x61rg\x18\x02 \x03(\t\x12\x0c\n\x04\x61rg0\x18\x03 \x01(\t\x12\x16\n\x07\x65xec_fd\x18\x04 \x01(\x08:\x05\x66\x61lse\"\x81\x14\n\x0cNsJailConfig\x12\x0e\n\x04name\x18\x01 \x01(\t:\x00\x12\x13\n\x0b\x64\x65scription\x18\x02 \x03(\t\x12 \n\x04mode\x18\x03 \x01(\x0e\x32\x0c.nsjail.Mode:\x04ONCE\x12\x16\n\nchroot_dir\x18\x04 \x01(\tB\x02\x18\x01\x12\x1d\n\nis_root_rw\x18\x05 \x01(\x08:\x05\x66\x61lseB\x02\x18\x01\x12\x18\n\x08hostname\x18\x08 \x01(\t:\x06NSJAIL\x12\x0e\n\x03\x63wd\x18\t \x01(\t:\x01/\x12\x0f\n\x04port\x18\n \x01(\r:\x01\x30\x12\x14\n\x08\x62indhost\x18\x0b \x01(\t:\x02::\x12\x1b\n\x10max_conns_per_ip\x18\x0c \x01(\r:\x01\x30\x12\x17\n\ntime_limit\x18\r \x01(\r:\x03\x36\x30\x30\x12\x15\n\x06\x64\x61\x65mon\x18\x0e \x01(\x08:\x05\x66\x61lse\x12\x13\n\x08max_cpus\x18\x0f \x01(\r:\x01\x30\x12\x0e\n\x06log_fd\x18\x10 \x01(\x05\x12\x10\n\x08log_file\x18\x11 \x01(\t\x12#\n\tlog_level\x18\x12 \x01(\x0e\x32\x10.nsjail.LogLevel\x12\x17\n\x08keep_env\x18\x13 \x01(\x08:\x05\x66\x61lse\x12\r\n\x05\x65nvar\x18\x14 \x03(\t\x12\x18\n\tkeep_caps\x18\x15 \x01(\x08:\x05\x66\x61lse\x12\x0b\n\x03\x63\x61p\x18\x16 \x03(\t\x12\x15\n\x06silent\x18\x17 \x01(\x08:\x05\x66\x61lse\x12\x1a\n\x0bskip_setsid\x18\x18 \x01(\x08:\x05\x66\x61lse\x12\x1d\n\x0estderr_to_null\x18\x19 \x01(\x08:\x05\x66\x61lse\x12\x0f\n\x07pass_fd\x18\x1a \x03(\x05\x12#\n\x14\x64isable_no_new_privs\x18\x1b \x01(\x08:\x05\x66\x61lse\x12\x17\n\trlimit_as\x18\x1c \x01(\x04:\x04\x34\x30\x39\x36\x12-\n\x0erlimit_as_type\x18\x1d \x01(\x0e\x32\x0e.nsjail.RLimit:\x05VALUE\x12\x16\n\x0brlimit_core\x18\x1e \x01(\x04:\x01\x30\x12/\n\x10rlimit_core_type\x18\x1f \x01(\x0e\x32\x0e.nsjail.RLimit:\x05VALUE\x12\x17\n\nrlimit_cpu\x18  \x01(\x04:\x03\x36\x30\x30\x12.\n\x0frlimit_cpu_type\x18! \x01(\x0e\x32\x0e.nsjail.RLimit:\x05VALUE\x12\x17\n\x0crlimit_fsize\x18\" \x01(\x04:\x01\x31\x12\x30\n\x11rlimit_fsize_type\x18# \x01(\x0e\x32\x0e.nsjail.RLimit:\x05VALUE\x12\x19\n\rrlimit_nofile\x18$ \x01(\x04:\x02\x33\x32\x12\x31\n\x12rlimit_nofile_type\x18% \x01(\x0e\x32\x0e.nsjail.RLimit:\x05VALUE\x12\x1a\n\x0crlimit_nproc\x18& \x01(\x04:\x04\x31\x30\x32\x34\x12/\n\x11rlimit_nproc_type\x18\' \x01(\x0e\x32\x0e.nsjail.RLimit:\x04SOFT\x12\x1d\n\x0crlimit_stack\x18( \x01(\x04:\x07\x31\x30\x34\x38\x35\x37\x36\x12/\n\x11rlimit_stack_type\x18) \x01(\x0e\x32\x0e.nsjail.RLimit:\x04SOFT\x12\x19\n\ndisable_rl\x18T \x01(\x08:\x05\x66\x61lse\x12)\n\x1apersona_addr_compat_layout\x18* \x01(\x08:\x05\x66\x61lse\x12%\n\x16persona_mmap_page_zero\x18+ \x01(\x08:\x05\x66\x61lse\x12(\n\x19persona_read_implies_exec\x18, \x01(\x08:\x05\x66\x61lse\x12%\n\x16persona_addr_limit_3gb\x18- \x01(\x08:\x05\x66\x61lse\x12(\n\x19persona_addr_no_randomize\x18. \x01(\x08:\x05\x66\x61lse\x12\x1a\n\x0c\x63lone_newnet\x18/ \x01(\x08:\x04true\x12\x1b\n\rclone_newuser\x18\x30 \x01(\x08:\x04true\x12\x19\n\x0b\x63lone_newns\x18\x31 \x01(\x08:\x04true\x12\x1a\n\x0c\x63lone_newpid\x18\x32 \x01(\x08:\x04true\x12\x1a\n\x0c\x63lone_newipc\x18\x33 \x01(\x08:\x04true\x12\x1a\n\x0c\x63lone_newuts\x18\x34 \x01(\x08:\x04true\x12\x1d\n\x0f\x63lone_newcgroup\x18\x35 \x01(\x08:\x04true\x12\x1d\n\x06uidmap\x18\x36 \x03(\x0b\x32\r.nsjail.IdMap\x12\x1d\n\x06gidmap\x18\x37 \x03(\x0b\x32\r.nsjail.IdMap\x12\x19\n\nmount_proc\x18\x38 \x01(\x08:\x05\x66\x61lse\x12\x1e\n\x05mount\x18\x39 \x03(\x0b\x32\x0f.nsjail.MountPt\x12\x1b\n\x13seccomp_policy_file\x18: \x01(\t\x12\x16\n\x0eseccomp_string\x18; \x03(\t\x12\x1a\n\x0bseccomp_log\x18< \x01(\x08:\x05\x66\x61lse\x12\x19\n\x0e\x63group_mem_max\x18= \x01(\x04:\x01\x30\x12/\n\x10\x63group_mem_mount\x18> \x01(\t:\x15/sys/fs/cgroup/memory\x12!\n\x11\x63group_mem_parent\x18? \x01(\t:\x06NSJAIL\x12\x1a\n\x0f\x63group_pids_max\x18@ \x01(\x04:\x01\x30\x12.\n\x11\x63group_pids_mount\x18\x41 \x01(\t:\x13/sys/fs/cgroup/pids\x12\"\n\x12\x63group_pids_parent\x18\x42 \x01(\t:\x06NSJAIL\x12!\n\x16\x63group_net_cls_classid\x18\x43 \x01(\r:\x01\x30\x12\x34\n\x14\x63group_net_cls_mount\x18\x44 \x01(\t:\x16/sys/fs/cgroup/net_cls\x12%\n\x15\x63group_net_cls_parent\x18\x45 \x01(\t:\x06NSJAIL\x12 \n\x15\x63group_cpu_ms_per_sec\x18\x46 \x01(\r:\x01\x30\x12,\n\x10\x63group_cpu_mount\x18G \x01(\t:\x12/sys/fs/cgroup/cpu\x12!\n\x11\x63group_cpu_parent\x18H \x01(\t:\x06NSJAIL\x12\x1a\n\x0biface_no_lo\x18I \x01(\x08:\x05\x66\x61lse\x12\x11\n\tiface_own\x18J \x03(\t\x12\x15\n\rmacvlan_iface\x18K \x01(\t\x12\"\n\rmacvlan_vs_ip\x18L \x01(\t:\x0b\x31\x39\x32.168.0.2\x12$\n\rmacvlan_vs_nm\x18M \x01(\t:\r255.255.255.0\x12\"\n\rmacvlan_vs_gw\x18N \x01(\t:\x0b\x31\x39\x32.168.0.1\x12\x17\n\rmacvlan_vs_ma\x18O \x01(\t:\x00\x12\x16\n\nnice_level\x18P \x01(\x05:\x02\x31\x39\x12\x1d\n\x08\x65xec_bin\x18Q \x01(\x0b\x32\x0b.nsjail.Exe\x12&\n\x0e\x63groupv2_mount\x18R \x01(\t:\x0e/sys/fs/cgroup\x12\x1b\n\x0cuse_cgroupv2\x18S \x01(\x08:\x05\x66\x61lse*3\n\x04Mode\x12\n\n\x06LISTEN\x10\x00\x12\x08\n\x04ONCE\x10\x01\x12\t\n\x05RERUN\x10\x02\x12\n\n\x06\x45XECVE\x10\x03*B\n\x08LogLevel\x12\t\n\x05\x44\x45\x42UG\x10\x00\x12\x08\n\x04INFO\x10\x01\x12\x0b\n\x07WARNING\x10\x02\x12\t\n\x05\x45RROR\x10\x03\x12\t\n\x05\x46\x41TAL\x10\x04*0\n\x06RLimit\x12\t\n\x05VALUE\x10\x00\x12\x08\n\x04SOFT\x10\x01\x12\x08\n\x04HARD\x10\x02\x12\x07\n\x03INF\x10\x03'
+)
+
+_MODE = _descriptor.EnumDescriptor(
+  name='Mode',
+  full_name='nsjail.Mode',
+  filename=None,
+  file=DESCRIPTOR,
+  create_key=_descriptor._internal_create_key,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='LISTEN', index=0, number=0,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='ONCE', index=1, number=1,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='RERUN', index=2, number=2,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='EXECVE', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+  ],
+  containing_type=None,
+  serialized_options=None,
+  serialized_start=3092,
+  serialized_end=3143,
+)
+_sym_db.RegisterEnumDescriptor(_MODE)
+
+Mode = enum_type_wrapper.EnumTypeWrapper(_MODE)
+_LOGLEVEL = _descriptor.EnumDescriptor(
+  name='LogLevel',
+  full_name='nsjail.LogLevel',
+  filename=None,
+  file=DESCRIPTOR,
+  create_key=_descriptor._internal_create_key,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='DEBUG', index=0, number=0,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='INFO', index=1, number=1,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='WARNING', index=2, number=2,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='ERROR', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='FATAL', index=4, number=4,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+  ],
+  containing_type=None,
+  serialized_options=None,
+  serialized_start=3145,
+  serialized_end=3211,
+)
+_sym_db.RegisterEnumDescriptor(_LOGLEVEL)
+
+LogLevel = enum_type_wrapper.EnumTypeWrapper(_LOGLEVEL)
+_RLIMIT = _descriptor.EnumDescriptor(
+  name='RLimit',
+  full_name='nsjail.RLimit',
+  filename=None,
+  file=DESCRIPTOR,
+  create_key=_descriptor._internal_create_key,
+  values=[
+    _descriptor.EnumValueDescriptor(
+      name='VALUE', index=0, number=0,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='SOFT', index=1, number=1,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='HARD', index=2, number=2,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+    _descriptor.EnumValueDescriptor(
+      name='INF', index=3, number=3,
+      serialized_options=None,
+      type=None,
+      create_key=_descriptor._internal_create_key),
+  ],
+  containing_type=None,
+  serialized_options=None,
+  serialized_start=3213,
+  serialized_end=3261,
+)
+_sym_db.RegisterEnumDescriptor(_RLIMIT)
+
+RLimit = enum_type_wrapper.EnumTypeWrapper(_RLIMIT)
+LISTEN = 0
+ONCE = 1
+RERUN = 2
+EXECVE = 3
+DEBUG = 0
+INFO = 1
+WARNING = 2
+ERROR = 3
+FATAL = 4
+VALUE = 0
+SOFT = 1
+HARD = 2
+INF = 3
+
+
+
+_IDMAP = _descriptor.Descriptor(
+  name='IdMap',
+  full_name='nsjail.IdMap',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='inside_id', full_name='nsjail.IdMap.inside_id', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='outside_id', full_name='nsjail.IdMap.outside_id', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='count', full_name='nsjail.IdMap.count', index=2,
+      number=3, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=1,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='use_newidmap', full_name='nsjail.IdMap.use_newidmap', index=3,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=24,
+  serialized_end=121,
+)
+
+
+_MOUNTPT = _descriptor.Descriptor(
+  name='MountPt',
+  full_name='nsjail.MountPt',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='src', full_name='nsjail.MountPt.src', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='prefix_src_env', full_name='nsjail.MountPt.prefix_src_env', index=1,
+      number=2, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='src_content', full_name='nsjail.MountPt.src_content', index=2,
+      number=3, type=12, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"",
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='dst', full_name='nsjail.MountPt.dst', index=3,
+      number=4, type=9, cpp_type=9, label=2,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='prefix_dst_env', full_name='nsjail.MountPt.prefix_dst_env', index=4,
+      number=5, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='fstype', full_name='nsjail.MountPt.fstype', index=5,
+      number=6, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='options', full_name='nsjail.MountPt.options', index=6,
+      number=7, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='is_bind', full_name='nsjail.MountPt.is_bind', index=7,
+      number=8, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rw', full_name='nsjail.MountPt.rw', index=8,
+      number=9, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='is_dir', full_name='nsjail.MountPt.is_dir', index=9,
+      number=10, type=8, cpp_type=7, label=1,
+      has_default_value=False, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='mandatory', full_name='nsjail.MountPt.mandatory', index=10,
+      number=11, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='is_symlink', full_name='nsjail.MountPt.is_symlink', index=11,
+      number=12, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='nosuid', full_name='nsjail.MountPt.nosuid', index=12,
+      number=13, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='nodev', full_name='nsjail.MountPt.nodev', index=13,
+      number=14, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='noexec', full_name='nsjail.MountPt.noexec', index=14,
+      number=15, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=124,
+  serialized_end=454,
+)
+
+
+_EXE = _descriptor.Descriptor(
+  name='Exe',
+  full_name='nsjail.Exe',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='path', full_name='nsjail.Exe.path', index=0,
+      number=1, type=9, cpp_type=9, label=2,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='arg', full_name='nsjail.Exe.arg', index=1,
+      number=2, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='arg0', full_name='nsjail.Exe.arg0', index=2,
+      number=3, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='exec_fd', full_name='nsjail.Exe.exec_fd', index=3,
+      number=4, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=456,
+  serialized_end=526,
+)
+
+
+_NSJAILCONFIG = _descriptor.Descriptor(
+  name='NsJailConfig',
+  full_name='nsjail.NsJailConfig',
+  filename=None,
+  file=DESCRIPTOR,
+  containing_type=None,
+  create_key=_descriptor._internal_create_key,
+  fields=[
+    _descriptor.FieldDescriptor(
+      name='name', full_name='nsjail.NsJailConfig.name', index=0,
+      number=1, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='description', full_name='nsjail.NsJailConfig.description', index=1,
+      number=2, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='mode', full_name='nsjail.NsJailConfig.mode', index=2,
+      number=3, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=1,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='chroot_dir', full_name='nsjail.NsJailConfig.chroot_dir', index=3,
+      number=4, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=b'\030\001', file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='is_root_rw', full_name='nsjail.NsJailConfig.is_root_rw', index=4,
+      number=5, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=b'\030\001', file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='hostname', full_name='nsjail.NsJailConfig.hostname', index=5,
+      number=8, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"NSJAIL".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cwd', full_name='nsjail.NsJailConfig.cwd', index=6,
+      number=9, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='port', full_name='nsjail.NsJailConfig.port', index=7,
+      number=10, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='bindhost', full_name='nsjail.NsJailConfig.bindhost', index=8,
+      number=11, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"::".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='max_conns_per_ip', full_name='nsjail.NsJailConfig.max_conns_per_ip', index=9,
+      number=12, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='time_limit', full_name='nsjail.NsJailConfig.time_limit', index=10,
+      number=13, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=600,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='daemon', full_name='nsjail.NsJailConfig.daemon', index=11,
+      number=14, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='max_cpus', full_name='nsjail.NsJailConfig.max_cpus', index=12,
+      number=15, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='log_fd', full_name='nsjail.NsJailConfig.log_fd', index=13,
+      number=16, type=5, cpp_type=1, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='log_file', full_name='nsjail.NsJailConfig.log_file', index=14,
+      number=17, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='log_level', full_name='nsjail.NsJailConfig.log_level', index=15,
+      number=18, type=14, cpp_type=8, label=1,
+      has_default_value=False, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='keep_env', full_name='nsjail.NsJailConfig.keep_env', index=16,
+      number=19, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='envar', full_name='nsjail.NsJailConfig.envar', index=17,
+      number=20, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='keep_caps', full_name='nsjail.NsJailConfig.keep_caps', index=18,
+      number=21, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cap', full_name='nsjail.NsJailConfig.cap', index=19,
+      number=22, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='silent', full_name='nsjail.NsJailConfig.silent', index=20,
+      number=23, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='skip_setsid', full_name='nsjail.NsJailConfig.skip_setsid', index=21,
+      number=24, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='stderr_to_null', full_name='nsjail.NsJailConfig.stderr_to_null', index=22,
+      number=25, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='pass_fd', full_name='nsjail.NsJailConfig.pass_fd', index=23,
+      number=26, type=5, cpp_type=1, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='disable_no_new_privs', full_name='nsjail.NsJailConfig.disable_no_new_privs', index=24,
+      number=27, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_as', full_name='nsjail.NsJailConfig.rlimit_as', index=25,
+      number=28, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=4096,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_as_type', full_name='nsjail.NsJailConfig.rlimit_as_type', index=26,
+      number=29, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_core', full_name='nsjail.NsJailConfig.rlimit_core', index=27,
+      number=30, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_core_type', full_name='nsjail.NsJailConfig.rlimit_core_type', index=28,
+      number=31, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_cpu', full_name='nsjail.NsJailConfig.rlimit_cpu', index=29,
+      number=32, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=600,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_cpu_type', full_name='nsjail.NsJailConfig.rlimit_cpu_type', index=30,
+      number=33, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_fsize', full_name='nsjail.NsJailConfig.rlimit_fsize', index=31,
+      number=34, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=1,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_fsize_type', full_name='nsjail.NsJailConfig.rlimit_fsize_type', index=32,
+      number=35, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_nofile', full_name='nsjail.NsJailConfig.rlimit_nofile', index=33,
+      number=36, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=32,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_nofile_type', full_name='nsjail.NsJailConfig.rlimit_nofile_type', index=34,
+      number=37, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_nproc', full_name='nsjail.NsJailConfig.rlimit_nproc', index=35,
+      number=38, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=1024,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_nproc_type', full_name='nsjail.NsJailConfig.rlimit_nproc_type', index=36,
+      number=39, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=1,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_stack', full_name='nsjail.NsJailConfig.rlimit_stack', index=37,
+      number=40, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=1048576,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='rlimit_stack_type', full_name='nsjail.NsJailConfig.rlimit_stack_type', index=38,
+      number=41, type=14, cpp_type=8, label=1,
+      has_default_value=True, default_value=1,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='disable_rl', full_name='nsjail.NsJailConfig.disable_rl', index=39,
+      number=84, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='persona_addr_compat_layout', full_name='nsjail.NsJailConfig.persona_addr_compat_layout', index=40,
+      number=42, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='persona_mmap_page_zero', full_name='nsjail.NsJailConfig.persona_mmap_page_zero', index=41,
+      number=43, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='persona_read_implies_exec', full_name='nsjail.NsJailConfig.persona_read_implies_exec', index=42,
+      number=44, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='persona_addr_limit_3gb', full_name='nsjail.NsJailConfig.persona_addr_limit_3gb', index=43,
+      number=45, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='persona_addr_no_randomize', full_name='nsjail.NsJailConfig.persona_addr_no_randomize', index=44,
+      number=46, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newnet', full_name='nsjail.NsJailConfig.clone_newnet', index=45,
+      number=47, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newuser', full_name='nsjail.NsJailConfig.clone_newuser', index=46,
+      number=48, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newns', full_name='nsjail.NsJailConfig.clone_newns', index=47,
+      number=49, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newpid', full_name='nsjail.NsJailConfig.clone_newpid', index=48,
+      number=50, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newipc', full_name='nsjail.NsJailConfig.clone_newipc', index=49,
+      number=51, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newuts', full_name='nsjail.NsJailConfig.clone_newuts', index=50,
+      number=52, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='clone_newcgroup', full_name='nsjail.NsJailConfig.clone_newcgroup', index=51,
+      number=53, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=True,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='uidmap', full_name='nsjail.NsJailConfig.uidmap', index=52,
+      number=54, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='gidmap', full_name='nsjail.NsJailConfig.gidmap', index=53,
+      number=55, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='mount_proc', full_name='nsjail.NsJailConfig.mount_proc', index=54,
+      number=56, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='mount', full_name='nsjail.NsJailConfig.mount', index=55,
+      number=57, type=11, cpp_type=10, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='seccomp_policy_file', full_name='nsjail.NsJailConfig.seccomp_policy_file', index=56,
+      number=58, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='seccomp_string', full_name='nsjail.NsJailConfig.seccomp_string', index=57,
+      number=59, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='seccomp_log', full_name='nsjail.NsJailConfig.seccomp_log', index=58,
+      number=60, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_mem_max', full_name='nsjail.NsJailConfig.cgroup_mem_max', index=59,
+      number=61, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_mem_mount', full_name='nsjail.NsJailConfig.cgroup_mem_mount', index=60,
+      number=62, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/sys/fs/cgroup/memory".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_mem_parent', full_name='nsjail.NsJailConfig.cgroup_mem_parent', index=61,
+      number=63, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"NSJAIL".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_pids_max', full_name='nsjail.NsJailConfig.cgroup_pids_max', index=62,
+      number=64, type=4, cpp_type=4, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_pids_mount', full_name='nsjail.NsJailConfig.cgroup_pids_mount', index=63,
+      number=65, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/sys/fs/cgroup/pids".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_pids_parent', full_name='nsjail.NsJailConfig.cgroup_pids_parent', index=64,
+      number=66, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"NSJAIL".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_net_cls_classid', full_name='nsjail.NsJailConfig.cgroup_net_cls_classid', index=65,
+      number=67, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_net_cls_mount', full_name='nsjail.NsJailConfig.cgroup_net_cls_mount', index=66,
+      number=68, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/sys/fs/cgroup/net_cls".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_net_cls_parent', full_name='nsjail.NsJailConfig.cgroup_net_cls_parent', index=67,
+      number=69, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"NSJAIL".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_cpu_ms_per_sec', full_name='nsjail.NsJailConfig.cgroup_cpu_ms_per_sec', index=68,
+      number=70, type=13, cpp_type=3, label=1,
+      has_default_value=True, default_value=0,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_cpu_mount', full_name='nsjail.NsJailConfig.cgroup_cpu_mount', index=69,
+      number=71, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/sys/fs/cgroup/cpu".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroup_cpu_parent', full_name='nsjail.NsJailConfig.cgroup_cpu_parent', index=70,
+      number=72, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"NSJAIL".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='iface_no_lo', full_name='nsjail.NsJailConfig.iface_no_lo', index=71,
+      number=73, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='iface_own', full_name='nsjail.NsJailConfig.iface_own', index=72,
+      number=74, type=9, cpp_type=9, label=3,
+      has_default_value=False, default_value=[],
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='macvlan_iface', full_name='nsjail.NsJailConfig.macvlan_iface', index=73,
+      number=75, type=9, cpp_type=9, label=1,
+      has_default_value=False, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='macvlan_vs_ip', full_name='nsjail.NsJailConfig.macvlan_vs_ip', index=74,
+      number=76, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"192.168.0.2".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='macvlan_vs_nm', full_name='nsjail.NsJailConfig.macvlan_vs_nm', index=75,
+      number=77, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"255.255.255.0".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='macvlan_vs_gw', full_name='nsjail.NsJailConfig.macvlan_vs_gw', index=76,
+      number=78, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"192.168.0.1".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='macvlan_vs_ma', full_name='nsjail.NsJailConfig.macvlan_vs_ma', index=77,
+      number=79, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='nice_level', full_name='nsjail.NsJailConfig.nice_level', index=78,
+      number=80, type=5, cpp_type=1, label=1,
+      has_default_value=True, default_value=19,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='exec_bin', full_name='nsjail.NsJailConfig.exec_bin', index=79,
+      number=81, type=11, cpp_type=10, label=1,
+      has_default_value=False, default_value=None,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='cgroupv2_mount', full_name='nsjail.NsJailConfig.cgroupv2_mount', index=80,
+      number=82, type=9, cpp_type=9, label=1,
+      has_default_value=True, default_value=b"/sys/fs/cgroup".decode('utf-8'),
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+    _descriptor.FieldDescriptor(
+      name='use_cgroupv2', full_name='nsjail.NsJailConfig.use_cgroupv2', index=81,
+      number=83, type=8, cpp_type=7, label=1,
+      has_default_value=True, default_value=False,
+      message_type=None, enum_type=None, containing_type=None,
+      is_extension=False, extension_scope=None,
+      serialized_options=None, file=DESCRIPTOR,  create_key=_descriptor._internal_create_key),
+  ],
+  extensions=[
+  ],
+  nested_types=[],
+  enum_types=[
+  ],
+  serialized_options=None,
+  is_extendable=False,
+  syntax='proto2',
+  extension_ranges=[],
+  oneofs=[
+  ],
+  serialized_start=529,
+  serialized_end=3090,
+)
+
+_NSJAILCONFIG.fields_by_name['mode'].enum_type = _MODE
+_NSJAILCONFIG.fields_by_name['log_level'].enum_type = _LOGLEVEL
+_NSJAILCONFIG.fields_by_name['rlimit_as_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_core_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_cpu_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_fsize_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_nofile_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_nproc_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['rlimit_stack_type'].enum_type = _RLIMIT
+_NSJAILCONFIG.fields_by_name['uidmap'].message_type = _IDMAP
+_NSJAILCONFIG.fields_by_name['gidmap'].message_type = _IDMAP
+_NSJAILCONFIG.fields_by_name['mount'].message_type = _MOUNTPT
+_NSJAILCONFIG.fields_by_name['exec_bin'].message_type = _EXE
+DESCRIPTOR.message_types_by_name['IdMap'] = _IDMAP
+DESCRIPTOR.message_types_by_name['MountPt'] = _MOUNTPT
+DESCRIPTOR.message_types_by_name['Exe'] = _EXE
+DESCRIPTOR.message_types_by_name['NsJailConfig'] = _NSJAILCONFIG
+DESCRIPTOR.enum_types_by_name['Mode'] = _MODE
+DESCRIPTOR.enum_types_by_name['LogLevel'] = _LOGLEVEL
+DESCRIPTOR.enum_types_by_name['RLimit'] = _RLIMIT
+_sym_db.RegisterFileDescriptor(DESCRIPTOR)
+
+IdMap = _reflection.GeneratedProtocolMessageType('IdMap', (_message.Message,), {
+  'DESCRIPTOR' : _IDMAP,
+  '__module__' : 'config_pb2'
+  # @@protoc_insertion_point(class_scope:nsjail.IdMap)
+  })
+_sym_db.RegisterMessage(IdMap)
+
+MountPt = _reflection.GeneratedProtocolMessageType('MountPt', (_message.Message,), {
+  'DESCRIPTOR' : _MOUNTPT,
+  '__module__' : 'config_pb2'
+  # @@protoc_insertion_point(class_scope:nsjail.MountPt)
+  })
+_sym_db.RegisterMessage(MountPt)
+
+Exe = _reflection.GeneratedProtocolMessageType('Exe', (_message.Message,), {
+  'DESCRIPTOR' : _EXE,
+  '__module__' : 'config_pb2'
+  # @@protoc_insertion_point(class_scope:nsjail.Exe)
+  })
+_sym_db.RegisterMessage(Exe)
+
+NsJailConfig = _reflection.GeneratedProtocolMessageType('NsJailConfig', (_message.Message,), {
+  'DESCRIPTOR' : _NSJAILCONFIG,
+  '__module__' : 'config_pb2'
+  # @@protoc_insertion_point(class_scope:nsjail.NsJailConfig)
+  })
+_sym_db.RegisterMessage(NsJailConfig)
+
+
+_NSJAILCONFIG.fields_by_name['chroot_dir']._options = None
+_NSJAILCONFIG.fields_by_name['is_root_rw']._options = None
+# @@protoc_insertion_point(module_scope)