# Class LittleGhost::Sandbox::Capabilities

Documentation version: Edge

Canonical HTML: https://littleghostai.org/docs/LittleGhost/Sandbox/Capabilities.html

Describes the operations, network modes, and isolation mechanism a Sandbox
backend implements. `process_spawn` permits child creation,
`process_spawn_denial` means the backend can prohibit it for one session, and
`process_tree_ownership` means descendants remain owned through cleanup.
Capabilities are immutable and safe to expose to tools, but are not a security
certification of the surrounding deployment.

## Inheritance

`LittleGhost::Sandbox::Capabilities < Object`

## Attributes

<a id="attribute-i-features"></a>
### `features` (R)

Operation names implemented by the backend.

<a id="attribute-i-isolation"></a>
### `isolation` (R)

Descriptive isolation mechanism, such as `:none` or
`:container`.

<a id="attribute-i-network_modes"></a>
### `network_modes` (R)

Network modes the backend can enforce.

## Class methods

<a id="method-c-new"></a>
### `.new`

```ruby
.new(features: DEFAULT_FEATURES, network_modes: [:inherit], isolation: :none)
```

Builds a capability report from feature names and supported network modes.
`isolation` is descriptive and does not itself grant an operation or establish
a complete trust boundary.

## Instance methods

<a id="method-i-include-3F"></a>
### `#include?`

```ruby
#include?(feature, value = nil)
```

Equivalent to #supports?.

<a id="method-i-intersect"></a>
### `#intersect`

```ruby
#intersect(other)
```

Produces a capability set no broader than both operands.

<a id="method-i-supports-3F"></a>
### `#supports?`

```ruby
#supports?(feature, value = nil)
```

Indicates whether `feature` is available. For `:network`, `value`
selects the requested mode.