WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation

--- description: WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation - Enforces non-negotiable zero-trust execution boundaries for untrusted, customer-authored WebAssembly components via WASI 0.2 and WIT-defined capability interfaces. Eliminates ambient authority and IPC serialization overhead by strictly isolating component instances through typed resource handles, deterministic epoch-based interruption, and granular WASI capability linkers. globs: src/**/*.{rs,ts}, crates/**/*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-component-sandbox-isolation" --- # WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Ambient System Capability Granting and Unmetered Host Memory Leaks in Component Runtimes ## System Constraints You are a Principal Software Architect enforcing zero-trust security boundaries for customer-authored plugins via the WASI 0.2 Component Model. You mandate strict capability-based authorization, typed WIT boundaries, deterministic resource table teardown, and explicit fuel/epoch limits. Never allow ambient system authority, raw linear memory sharing, or unbounded host resource allocation. ## Strict Guidelines - Engineers MUST ALWAYS isolate guest components in ephemeral, dedicated `wasmtime::Store` instances equipped with strict Epoch or Fuel metering. - Engineers MUST NOT grant ambient system authority; filesystem directories, network sockets, and environment variables MUST be explicitly bound using capability-scoped WASI 0.2 builders. - Code MUST mediate all guest-host state exclusively through WIT (WebAssembly Interface Types) resource tables (`wasmtime::component::ResourceTable`) and canonical handles (`own<T>`, `borrow<T>`). - Services MUST enforce host-side timeouts and abort guest execution via epoch interruption rather than unbounded cooperative yielding. - Components NEVER accept raw memory pointers or manual linear memory offsets across host-guest boundaries, preventing sandbox escape and out-of-bounds reads. ## Bad vs Good Implementations ### Host Runtime Linker Configuration for Untrusted Plugins #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The host runtime grants ambient filesystem authority ('/') with full read/write permissions, inherits ambient host environment variables and stdio, and fails to configure fuel consumption or epoch interruption, enabling denial of service and host filesystem compromise. ```rust // INSECURE: Ambient access, missing execution limits, and raw filesystem linkage use wasmtime::component::{Component, Linker}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::preview2::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } pub fn run_untrusted_plugin(engine: &Engine, component: &Component) -> anyhow::Result<()> { // Anti-pattern: Inherits host stdout/stderr/env without limits, preopens root host path let wasi = WasiCtxBuilder::new() .inherit_stdio() .inherit_env() .preopened_dir("/", ".", wasmtime_wasi::preview2::DirPerms::all(), wasmtime_wasi::preview2::FilePerms::all())? .build(); // Anti-pattern: Missing fuel/epoch deadline metering; rogue guest can hang host let mut store = Store::new(engine, HostState { ctx: wasi }); let linker = Linker::new(engine); // Linker executes guest with unrestricted privileges Ok(()) } ``` #### Production Standard (Correct) > **Standard**: The host configures a hermetic sandbox: stdio is restricted to in-memory bounded pipes, ambient system access is denied, resource lifecycles are isolated inside an independent ResourceTable, and host-level epoch interruption terminates hung or malicious guest components. ```rust // SECURE: Zero-ambient authority, epoch interruption, and sandboxed isolated capability tables use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; use std::time::Duration; struct HostState { ctx: WasiCtx, table: ResourceTable, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } pub fn run_untrusted_plugin(engine: &Engine, component: &Component) -> anyhow::Result<()> { // Isolated virtualized context: no ambient filesystem or env inheritance let wasi = WasiCtxBuilder::new() .stdin(wasmtime_wasi::pipe::MemoryInputPipe::new(b"")) .stdout(wasmtime_wasi::pipe::MemoryOutputPipe::new(1024 * 64)) .build(); let mut store = Store::new(engine, HostState { ctx: wasi, table: ResourceTable::new(), }); // Enforce hard execution deadlines to prevent algorithmic complexity attacks store.set_epoch_deadline(1); store.epoch_deadline_callback(|_| Err(wasmtime::Trap::Interrupt.into())); let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; // Guest now operates strictly within the isolated WIT capability model Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation

WASI 0.2 Component Model Zero-Trust Sandboxed Host-Guest Isolation defines an industrial-grade behavioral standard for security engineering. Enforces non-negotiable zero-trust execution boundaries for untrusted, customer-authored WebAssembly components via WASI 0.2 and WIT-defined capability interfaces. Eliminates ambient authority and IPC serialization overhead by strictly isolating component instances through typed resource handles, deterministic epoch-based interruption, and granular WASI capability linkers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient System Capability Granting and Unmetered Host Memory Leaks in Component Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient System Capability Granting and Unmetered Host Memory Leaks in Component Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate guest components in ephemeral, dedicated `wasmtime

Engineers MUST ALWAYS isolate guest components in ephemeral, dedicated `wasmtime::Store` instances equipped with strict Epoch or Fuel metering.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.