WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits

--- description: WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits - Host runtimes embedding untrusted WASI 0.2 components must enforce deterministic execution via fuel metering and strict linear memory growth limits through a custom ResourceLimiter. Unbounded component instances can exhaust host microVM memory pages and starve CPU threads, leading to host-level OOM kills and denial of service across co-located tenants. globs: src/**/*.rs, crates/**/*.rs, hosts/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-component-sandbox-fuel-quota-standard" --- # WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Instantiating untrusted WASI components with default engine configs and unbounded memory growth ## System Constraints You are a Principal Systems and Edge Infrastructure Architect enforcing deterministic sandboxing for WASI 0.2 Component Model runtimes. Mandate strict linear memory quotas, deterministic fuel budgeting, non-blocking store execution, and isolated tenant traps on all microVM host runtimes. ## Strict Guidelines - Engineers MUST ALWAYS enable fuel consumption (`consume_fuel(true)`) in the Wasmtime engine configuration prior to instantiating untrusted WASI 0.2 components. - Engineers MUST ALWAYS attach a custom `ResourceLimiter` implementation to the execution `StoreContext` that strictly bounds initial memory, max dynamic heap allocations (`memory_growing`), and table growth. - Code MUST explicitly set per-invocation fuel budgets via `store.set_fuel(TENANT_FUEL_LIMIT)` and audit remaining fuel post-execution to detect rogue execution loops. - Services MUST trap on out-of-fuel and memory-growth-denied errors gracefully, logging tenant metrics without crashing or poisoning the host worker thread. - Components NEVER share mutable `Store` state or unchecked host capabilities across tenant invocation boundaries. ## Bad vs Good Implementations ### Wasmtime Component Host Engine & Store Sandbox Setup #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Default Engine and Store configurations disable fuel metering and omit memory caps. An untrusted component can issue unbounded `memory.grow` instructions or trigger infinite loops, taking down the host microVM process via OS SIGKILL (OOM). ```rust use wasmtime::component::{Component, Linker}; use wasmtime::{Config, Engine, Store}; pub struct TenantHostState; pub fn run_untrusted_plugin(wasm_bytes: &[u8]) -> anyhow::Result<()> { // DANGEROUS: Default config has no fuel metering or memory caps. // Untrusted components can execute infinite loops and exhaust host RAM. let mut config = Config::new(); let engine = Engine::new(&config)?; let mut store = Store::new(&engine, TenantHostState); let component = Component::new(&engine, wasm_bytes)?; let linker = Linker::new(&engine); let instance = linker.instantiate(&mut store, &component)?; // Invocation runs without CPU or memory bounding Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Enables fuel tracking on the engine, enforces strict 32MB maximum dynamic heap allocations via `StoreLimitsBuilder` and `ResourceLimiter`, and sets explicit fuel allocations per invocation, guaranteeing microVM multi-tenant isolation. ```rust use wasmtime::component::{Component, Linker}; use wasmtime::{Config, Engine, ResourceLimiter, Store, StoreLimits, StoreLimitsBuilder}; const MAX_MEMORY_BYTES: usize = 32 * 1024 * 1024; // 32MB strict quota const TENANT_INVOCATION_FUEL: u64 = 500_000_000; // Deterministic instruction budget pub struct TenantHostState { pub limits: StoreLimits, } impl wasmtime::ResourceLimiter for TenantHostState { fn memory_growing(&mut self, current: usize, desired: usize, maximum: Option<usize>) -> Result<bool, wasmtime::Trap> { self.limits.memory_growing(current, desired, maximum) } fn table_growing(&mut self, current: usize, desired: usize, maximum: Option<usize>) -> Result<bool, wasmtime::Trap> { self.limits.table_growing(current, desired, maximum) } } pub fn run_untrusted_plugin(wasm_bytes: &[u8]) -> anyhow::Result<()> { let mut config = Config::new(); config.consume_fuel(true); config.wasm_component_model(true); let engine = Engine::new(&config)?; let limits = StoreLimitsBuilder::new() .memory_size(MAX_MEMORY_BYTES) .instances(1) .tables(10) .build(); let mut store = Store::new(&engine, TenantHostState { limits }); store.set_fuel(TENANT_INVOCATION_FUEL)?; store.limiter(|state| &mut state.limits); let component = Component::new(&engine, wasm_bytes)?; let linker = Linker::new(&engine); let instance = linker.instantiate(&mut store, &component)?; // Tenant is bounded by 32MB linear heap and deterministic fuel budget Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits

WASI 0.2 Component Sandboxing with Strict Fuel Budgeting and Linear Memory Limits defines an industrial-grade behavioral standard for devops engineering. Host runtimes embedding untrusted WASI 0.2 components must enforce deterministic execution via fuel metering and strict linear memory growth limits through a custom ResourceLimiter. Unbounded component instances can exhaust host microVM memory pages and starve CPU threads, leading to host-level OOM kills and denial of service across co-located tenants. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Instantiating untrusted WASI components with default engine configs and unbounded memory growth Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Instantiating untrusted WASI components with default engine configs and unbounded memory growth	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enable fuel consumption (`consume_fuel(true)`) in the Wasmtime engine configuration prior to instantiating untrusted WASI 0.2 components.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.