此包提供了一个基于能力的 std 版本，提供了沙盒化的文件系统、网络和时钟 API。有关使用基于能力的安全性进行沙盒化的更多信息，请参阅 顶级 README.md。

文件系统模块 cap_std::fs、网络模块 cap_std::net 和时间模块 cap_std::time 目前支持 Linux、macOS、FreeBSD 和 Windows。WASI 支持正在开发中，但尚未可用。

Dir 的文件系统访问示例

use std::io;
use cap_std::fs::Dir;

/// Open files relative to `dir`.
fn dir_example(dir: &Dir) -> io::Result<()> {
    // This works (assuming symlinks don't lead outside of `dir`).
    let file = dir.open("the/thing.txt")?;

    // This fails, since `..` leads outside of `dir`.
    let hidden = dir.open("../hidden.txt")?;

    // This fails, as creating symlinks to absolute paths is not permitted.
    dir.symlink("/hidden.txt", "misdirection.txt")?;

    // However, even if the symlink had succeeded, or, if there is a
    // pre-existing symlink to an absolute directory, following a
    // symlink which would lead outside the sandbox also fails.
    let secret = dir.open("misdirection.txt")?;

    Ok(())
}

Pool 的网络访问示例

use std::io;
use cap_std::net::Pool;

/// Open network addresses within `pool`.
fn pool_example(pool: &Pool) -> io::Result<()> {
    // Connect to an address. This succeeds only if the given address and
    // port are present in `pool`.
    let stream = pool.connect_tcp_stream("localhost:3333")?;

    Ok(())
}