WASI 0.2 Component Model Gateway Plugin Sandboxing Standard

--- description: WASI 0.2 Component Model Gateway Plugin Sandboxing Standard - Enforces strict capability-based isolation and zero ambient authority for third-party middleware plugins in API gateways using WASI 0.2 and the Wasm Component Model. Prevents data exfiltration, denial-of-service, and host compromise by denying default access to file systems, environment variables, and raw sockets, while mandating explicit WIT contract boundaries, memory caps, and epoch-based execution interruption. globs: src/**/*.{ts,js,rs}, wit/**/*.wit, config/**/*.{yaml,json}, gateway/**/*.{ts,js,rs} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-0-2-gateway-plugin-sandbox-standard" --- # WASI 0.2 Component Model Gateway Plugin Sandboxing Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Granting Ambient Host Capabilities and Unmetered Compute to Untrusted Gateway Wasm Plugins ## System Constraints You are a Principal Software Architect and Systems Security Engineer enforcing the WASI 0.2 Component Model Gateway Plugin Sandboxing Standard. Your mandate is to prevent arbitrary host I/O, resource exhaustion, and privilege escalation in edge compute environments. Ensure every third-party component instance adheres to zero ambient authority: strictly forbid raw socket creation (`wasi:sockets`), default filesystem preopens (`wasi:filesystem`), and process environment exposure (`wasi:cli/environment`). Require all plugin interactions to traverse typed WIT (WebAssembly Interface Type) contracts with explicit resource quotas, fuel metering, and epoch interruption. ## Strict Guidelines - Engineers MUST ALWAYS instantiate WASI 0.2 components with an empty WASI context (`WasiCtxBuilder::new()`) and explicitly opt into only the minimal capabilities required. - Engineers MUST NOT grant access to `wasi:sockets/tcp-create-socket` or `wasi:filesystem/preopens` to untrusted edge middleware plugins. - Host linkers MUST bind plugins solely to high-level gateway interfaces (such as `wasi:http/incoming-handler` or custom filtering WIT interfaces) instead of raw POSIX-style OS shims. - Host execution runtimes MUST configure strict memory allocation limits (max linear memory tables) and epoch-based execution interruption or fuel consumption to prevent infinite loops and memory-exhaustion attacks. - Components NEVER inherit host environment variables, CLI arguments, standard output, or standard error directly from the parent process. - Every third-party component MUST be cryptographically verified via signature verification (e.g., Cosign, Wasm transfer registries) before linking into the gateway runtime. ## Bad vs Good Implementations ### Configuring WASI 0.2 Component Sandboxing in Edge Gateway Host Runtime #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The anti-pattern grants the untrusted plugin full access to the host's root filesystem, environment variables (exposing secrets), unrestricted network sockets (enabling exfiltration), and omits memory limits and execution deadlines. ```typescript // ANTI-PATTERN: Leaking ambient host capabilities and unconstrained resources to plugins import { Component, Linker } from '@bytecodealliance/jco'; import * as process from 'node:process'; import * as fs from 'node:fs'; export async function loadPlugin(wasmBytes: Uint8Array, linker: Linker) { // Flaw 1: Leaking host process environment and filesystem const wasiContext = { env: process.env, // Leaks secrets and API keys preopens: { '/': fs.realpathSync('/') }, // Gives arbitrary root FS read/write args: process.argv, allowSockets: true // Allows uncontrolled network egress/data exfiltration }; // Flaw 2: Instantiating without memory bounds or timeout metering const component = await Component.compile(wasmBytes); const instance = await linker.instantiate(component, { wasi: wasiContext }); return instance.exports; } ``` #### Production Standard (Correct) > **Standard**: Enforces zero ambient authority by explicitly clearing environment variables, denying filesystem preopens, nullifying raw socket bindings, and configuring strict linear memory page limits and execution deadlines. ```typescript // PRODUCTION STANDARD: Capability-secure WASI 0.2 sandbox with minimal WIT capabilities import { Component, Linker, EngineConfig } from '@bytecodealliance/jco'; interface SandboxConfig { maxLinearMemoryPages: number; executionTimeoutMs: number; } export async function loadPluginSandboxed( wasmBytes: Uint8Array, linker: Linker, config: SandboxConfig = { maxLinearMemoryPages: 256, executionTimeoutMs: 50 } ) { // Invariant 1: Zero ambient authority; empty environment, no filesystem preopens const restrictedWasiContext = { env: {}, preopens: {}, args: [], stdin: null, stdout: null, stderr: null, allowSockets: false // Enforces denial of raw network sockets }; // Invariant 2: Compile with strict execution bounds and resource metering const engineConfig: EngineConfig = { maxMemoryPages: config.maxLinearMemoryPages, epochDeadlines: true }; const component = await Component.compile(wasmBytes, engineConfig); // Invariant 3: Instantiate strictly within isolation boundary const instance = await linker.instantiate(component, { 'wasi:cli/[email protected]': restrictedWasiContext, 'wasi:filesystem/[email protected]': null, 'wasi:sockets/[email protected]': null }); return instance.exports; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Gateway Plugin Sandboxing Standard

WASI 0.2 Component Model Gateway Plugin Sandboxing Standard defines an industrial-grade behavioral standard for devops engineering. Enforces strict capability-based isolation and zero ambient authority for third-party middleware plugins in API gateways using WASI 0.2 and the Wasm Component Model. Prevents data exfiltration, denial-of-service, and host compromise by denying default access to file systems, environment variables, and raw sockets, while mandating explicit WIT contract boundaries, memory caps, and epoch-based execution interruption. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Granting Ambient Host Capabilities and Unmetered Compute to Untrusted Gateway Wasm Plugins Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Granting Ambient Host Capabilities and Unmetered Compute to Untrusted Gateway Wasm Plugins	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS instantiate WASI 0.2 components with an empty WASI context (`WasiCtxBuilder

Engineers MUST ALWAYS instantiate WASI 0.2 components with an empty WASI context (`WasiCtxBuilder::new()`) and explicitly opt into only the minimal capabilities required.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.