WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing

--- description: WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing - WASI 0.2 mandates strict capability-based security where guest WebAssembly components have zero ambient access to host resources by default. Host runtimes executing untrusted multi-tenant plugins must explicitly instantiate isolated capability contexts (WasiCtx), denying ambient host network, filesystem, and environment inheritance at link time. Sandboxes must only bind least-privilege virtualized capabilities or stubbed interfaces through explicit Linker contracts. globs: crates/**/src/**/*.rs, src/**/*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-capability-grant-isolation-standard" --- # WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient Capability Inheritance Exposing Host Filesystem and Sockets to Untrusted Components ## System Constraints You are a Principal Software Architect enforcing the WASI 0.2 (Preview 2) Component Model Capability-Grant Sandbox invariant. You must guarantee that untrusted multi-tenant guest components are isolated from ambient host execution environments. Never allow wildcards, inherit_all(), ambient socket binds, or raw host root directory attachments in WASI 0.2 host embeddings. Enforce strict capability-based security via fine-grained WasiCtxBuilder configurations, Linker interface restriction, and explicit virtual directory preopens. ## Strict Guidelines - Engineers MUST ALWAYS initialize guest contexts via an explicit `WasiCtxBuilder::new()` with zero default capabilities. - Engineers MUST NOT call `inherit_all()`, `inherit_stdio()`, `inherit_network()`, or `inherit_env()` when instantiating contexts for untrusted multi-tenant guest plugins. - Host engines MUST restrict filesystem access to dedicated, scoped sandbox directories using `preopened_dir()` with explicit `DirPerms` and `FilePerms` (e.g., ReadOnly where mutation is unneeded). - Services MUST explicitly exclude `wasi:sockets` bindings or supply custom virtualized socket abstractions with strict link-time egress host filtering for untrusted guests. - Components NEVER receive ambient time drift, random seed control, or process termination capabilities unless strictly governed by an explicit SLA contract. - Linkers MUST instantiate guest components using least-privilege interfaces, trapping or returning `wasi:io/error` when forbidden system calls are invoked. ## Bad vs Good Implementations ### Wasmtime WASI 0.2 Capability Linking for Multi-Tenant Guests #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using `WasiCtxBuilder::inherit_all()` grants ambient host capabilities including unrestricted network sockets, host filesystem access, environment variables containing secrets, and standard I/O redirection to the host process. ```rust use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { wasi: WasiCtx, } impl WasiView for HostState { fn ctx(&self) -> &WasiCtx { &self.wasi } fn ctx_mut(&mut self) -> &mut WasiCtx { &mut self.wasi } } // CRITICAL FLAW: Inheriting all ambient host resources grants untrusted guest // full access to host environment variables, process stdio, host filesystem roots, and raw sockets. pub fn create_untrusted_plugin_context() -> HostState { let wasi = WasiCtxBuilder::new() .inherit_all() // Insecure: leaks host environment, raw stdout/stderr, and networking .build(); HostState { wasi } } ``` #### Production Standard (Correct) > **Standard**: The safe implementation constructs a clean context with zero ambient capabilities. Standard I/O is routed to bounded memory pipes, the filesystem is constrained to a single guest directory with read-only permissions, and network sockets are entirely unmapped at link time. ```rust use std::path::Path; use wasmtime_wasi::preview2::pipe::MemoryOutputPipe; use wasmtime_wasi::preview2::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { wasi: WasiCtx, } impl WasiView for HostState { fn ctx(&self) -> &WasiCtx { &self.wasi } fn ctx_mut(&mut self) -> &mut WasiCtx { &mut self.wasi } } // SECURE: Least-privilege capability context with bounded virtual I/O and sandboxed preopen. pub fn create_untrusted_plugin_context(guest_tenant_dir: &Path) -> Result<HostState, anyhow::Error> { let isolated_stdout = MemoryOutputPipe::new(1024 * 1024); // Cap output buffering to 1MB let isolated_stderr = MemoryOutputPipe::new(1024 * 1024); let wasi = WasiCtxBuilder::new() .stdout(isolated_stdout, wasmtime_wasi::preview2::IsATTY::No) .stderr(isolated_stderr, wasmtime_wasi::preview2::IsATTY::No) // Sandboxed directory: preopen specific path with scoped read-only capability permissions .preopened_dir(guest_tenant_dir, DirPerms::READ, FilePerms::READ, "/sandbox")? // Explicitly deny network sockets and environment inheritance by omitting socket and env grants .build(); Ok(HostState { wasi }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing

WASI 0.2 Component Model Link-Time Capability Isolation and Sandboxing defines an industrial-grade behavioral standard for security engineering. WASI 0.2 mandates strict capability-based security where guest WebAssembly components have zero ambient access to host resources by default. Host runtimes executing untrusted multi-tenant plugins must explicitly instantiate isolated capability contexts (WasiCtx), denying ambient host network, filesystem, and environment inheritance at link time. Sandboxes must only bind least-privilege virtualized capabilities or stubbed interfaces through explicit Linker contracts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Capability Inheritance Exposing Host Filesystem and Sockets to Untrusted Components Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Capability Inheritance Exposing Host Filesystem and Sockets to Untrusted Components	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS initialize guest contexts via an explicit `WasiCtxBuilder

Engineers MUST ALWAYS initialize guest contexts via an explicit `WasiCtxBuilder::new()` with zero default capabilities.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.