# Class LittleGhost::Network::EnvoyGateway

Documentation version: Edge

Canonical HTML: https://littleghostai.org/docs/LittleGhost/Network/EnvoyGateway.html

Manages Envoy as a native process or pinned Docker sidecar for one Sandbox.
CONNECT policy sees destinations, not encrypted request details. Optional HTTP
inspection changes the child trust configuration and may not work for clients
with certificate pinning or custom trust stores. The Sandbox must block direct
sockets for either mode to be an enforcement boundary.

## Inheritance

`LittleGhost::Network::EnvoyGateway < LittleGhost::Network::Gateway`

## Attributes

<a id="attribute-i-client_network"></a>
### `client_network` (R)

Internal Docker network exposed only to sandbox clients, when used.

<a id="attribute-i-proxy_socket"></a>
### `proxy_socket` (R)

Host path of the explicit proxy's Unix socket, when used.

<a id="attribute-i-runtime"></a>
### `runtime` (R)

Configured runtime selector: `:auto`, `:native`, or
`:docker`.

## Class methods

<a id="method-c-new"></a>
### `.new`

```ruby
.new(policy:, runtime: :auto, transport: :unix, envoy: "envoy", docker: "docker",
        image: ENVOY_IMAGE, pull: :if_missing, dns: [])
```

Builds a run-scoped Envoy gateway. Envoy remains an optional external
dependency and the Docker image is pinned by digest by default.

## Instance methods

<a id="method-i-close"></a>
### `#close`

```ruby
#close()
```

Removes the process, containers, networks, sockets, and trust material.

<a id="method-i-environment"></a>
### `#environment`

```ruby
#environment()
```

Returns proxy variables and, for inspection, child-scoped trust paths.

<a id="method-i-mounts"></a>
### `#mounts`

```ruby
#mounts()
```

Returns the gateway files that must be mounted into the sandbox.

<a id="method-i-open"></a>
### `#open`

```ruby
#open(run: nil)
```

Creates configuration, trust material, and the Envoy process.

<a id="method-i-proxy_mount_path"></a>
### `#proxy_mount_path`

```ruby
#proxy_mount_path()
```

Returns the proxy socket's stable path inside a mounted sandbox.