pub type SandboxHostCapabilityName = String;Expand description
Extensible identifier of a sandbox policy feature whose availability varies between hosts. A plain string, so an older client decodes a name added by a newer runtime; ignore names you do not recognize. Known values: network — sandboxed commands can reach the network (network.allowOutbound, on by default); on Linux this needs the tooling for Bubblewrap’s private network namespace, such as slirp4netns. network_filtering — host rules and the sandbox proxy (network.allowedHosts, network.blockedHosts, network.proxy); on Linux this needs the same tooling as network; on Windows it needs a version with Process Security Environment 1.1 host-loopback support, and a policy that uses it must also set network.allowLocalNetwork, because Windows reaches the local proxy only together with private-network access. denied_paths — native enforcement of filesystem.deniedPaths; on Windows this needs a version whose sandbox contract reports denied-path support. shell — shell commands inside the sandbox: bash on macOS and Linux, PowerShell on Windows; on Windows this needs a version with Process Security Environment 1.1 filesystem enumeration support.
Experimental. This type is part of an experimental wire-protocol surface and may change or be removed in future SDK or CLI releases.
Aliased Type§
pub struct SandboxHostCapabilityName { /* private fields */ }