Entry-Point Runtime — Rust
Heuristics the Stella Ops scanner uses to classify a container entry point as a Rust binary, plus the evidence it attaches and the edge cases it guards against. For the shared detector contracts, scoring, and calibration, see the Runtime Detector Overview. Like Go, Rust ships as a compiled binary, so this detector leans on ELF/DWARF traits and Cargo artefacts rather than package manifests.
Signals to gather
- ELF binaries with DWARF producer strings containing
rustc. - Symbols prefixed with
_ZN(mangled Rust) or section.rustc. - Presence of
panic=abortstrings,Rustmetadata, or Cargo artefacts (Cargo.toml,Cargo.lock). - Statically linked (no
.dynamicentries) in many cases, or musl loader (/lib/ld-musl-x86_64.so.1). - Environment such as
RUST_LOG,RUST_BACKTRACE.
Implementation notes
- Parse DWARF
.debug_infowhen available; short-circuit by scanning.commentsections forrustc. - Distinguish from Go by the absence of
.note.go.buildid. - When Cargo artefacts exist, include target name and profile in evidence.
- For binaries built with
--target x86_64-pc-windows-gnu, treat them under the same detector (PE + Rust markers).
Evidence & scoring
- Reward DWARF producer strings, Cargo files, and Rust-specific env vars.
- Penalise when only generic static binary traits are present (may defer to C/C++).
- Mention musl vs glibc loader differences for observability.
Edge cases
- Rust compiled to WebAssembly or run inside Wasmtime falls outside this detector; leave as
Other. - Stripped binaries without DWARF or comment sections may be indistinguishable from C — fall back to the C / C++ detector and add an evidence note.
- Supervisors launching multiple Rust binaries are handled by the Supervisor detector.
Related
- Runtime Detector Overview — shared contracts, scoring, calibration.
- Entry-Point Runtime — Go — the other native sibling, distinguished by
.note.go.buildid. - Entry-Point Runtime — C / C++ — fallback for stripped Rust binaries.
- Supervisor detector — multi-service stacks fronting Rust binaries.