WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation

--- description: WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation - Enforces strict capability-based isolation for multi-tenant WASI 0.2 (Preview 2) components using fine-grained WebAssembly Interface Types (WIT). Prohibits ambient authority leaks, unrestricted host filesystem/network inheritance, and un-metered linear memory execution in untrusted guest runtimes. globs: **/*.wit, **/runtime/**/*.{rs,ts}, **/host/**/*.{rs,ts}, **/wasm/**/*.{rs,ts} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-02-wit-capability-sandboxing" --- # WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Ambient System Inheritance and Unmetered Core Store Configuration in WASI 0.2 Hosts ## System Constraints You are a Principal Systems Architect and Security Engineer enforcing WASI 0.2 (Preview 2) Component Model capability security boundaries. You must mandate strict adherence to capability-oriented WIT interface definitions, eliminate ambient authority (such as inherited environment variables, raw stdio, and unrestricted root directory access), and verify deterministic resource metering (fuel and epoch deadlines) across all guest component instantiations. ## Strict Guidelines - Engineers MUST ALWAYS bind multi-tenant components to dedicated, least-privilege WIT worlds rather than generic `wasi:cli/command` worlds. - Engineers MUST NOT call `inherit_all()`, `inherit_stdio()`, or `inherit_network()` on `WasiCtxBuilder` when instantiating untrusted or multi-tenant guest components. - Host runtimes MUST configure deterministic execution limits using fuel consumption (`consume_fuel(true)`) or epoch-based interruption to prevent resource exhaustion attacks. - Guest-accessible directories MUST be pre-opened explicitly using scoped, read-only or isolated virtual directory mappings; root directory (`/`) traversal MUST NEVER be exposed. - Network outbound capabilities MUST be intercepted via custom WIT socket/HTTP implementations to enforce host-level CIDR blocks and domain allowlists. - Components NEVER share mutable linear memory across instances; all host-guest data passing MUST transit through the Component Model Canonical ABI. ## Bad vs Good Implementations ### Configuring WASI 0.2 Wasmtime Host Sandbox for Untrusted Component Execution #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The host configuration invokes `inherit_all()`, leaking the host process's full filesystem access, environment variables (secrets/tokens), and raw networking to an untrusted guest. It also omits execution limits (fuel/epochs), allowing guest code to execute infinite loops or exhaust host memory. ```rust // VULNERABLE: Ambient system capabilities leaked to untrusted guest component use wasmtime::component::{Component, Linker}; use wasmtime::{Config, Engine, Store}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } pub fn run_plugin(engine: &Engine, component_bytes: &[u8]) -> Result<(), Box<dyn std::error::Error>> { // Anti-pattern: Inherits host environment, files, and network implicitly let mut wasi_builder = WasiCtxBuilder::new(); wasi_builder.inherit_all(); // Grants ambient disk, network, env access! let state = HostState { ctx: wasi_builder.build() }; let mut store = Store::new(engine, state); // Anti-pattern: No fuel metering or epoch limits let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; let component = Component::new(engine, component_bytes)?; let instance = linker.instantiate(&mut store, &component)?; // Invocation bypasses capability controls Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Ambient capabilities are entirely revoked. The guest only receives a pre-opened, capability-scoped directory restricted to `/data` with read-only permissions via `cap-std`. Stdout is capped in-memory, store memory is bounded to 64MB, and instruction fuel is enforced to defeat infinite loops. ```rust // SECURE: Explicit capability boundary with isolated WIT context and execution limits use wasmtime::component::{Component, Linker, ResourceTable}; use wasmtime::{Config, Engine, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; use cap_std::fs::Dir; struct HostState { ctx: WasiCtx, table: ResourceTable, limits: StoreLimits, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } fn table(&mut self) -> &mut ResourceTable { &mut self.table } } pub fn run_sandboxed_plugin( engine: &Engine, component_bytes: &[u8], tenant_storage_path: &std::path::Path, ) -> Result<(), Box<dyn std::error::Error>> { let isolated_dir = Dir::open_ambient_dir(tenant_storage_path, cap_std::ambient_authority())?; // Invariant: Zero ambient authority; scoped capabilities only let mut wasi_builder = WasiCtxBuilder::new(); wasi_builder .preopened_dir(isolated_dir, wasmtime_wasi::DirPerms::READ, wasmtime_wasi::FilePerms::READ, "/data") .set_stdin(wasmtime_wasi::pipe::MemoryInputPipe::new(b"")) .set_stdout(wasmtime_wasi::pipe::MemoryOutputPipe::new(1024 * 1024)); let state = HostState { ctx: wasi_builder.build(), table: ResourceTable::new(), limits: StoreLimitsBuilder::new().memory_size(64 * 1024 * 1024).build(), }; let mut store = Store::new(engine, state); store.set_fuel(5_000_000)?; let mut linker = Linker::new(engine); wasmtime_wasi::add_to_linker_sync(&mut linker)?; let component = Component::new(engine, component_bytes)?; let instance = linker.instantiate(&mut store, &component)?; Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation

WASI 0.2 Component Model Strict WIT Capability Sandboxing & Host Isolation defines an industrial-grade behavioral standard for devops engineering. Enforces strict capability-based isolation for multi-tenant WASI 0.2 (Preview 2) components using fine-grained WebAssembly Interface Types (WIT). Prohibits ambient authority leaks, unrestricted host filesystem/network inheritance, and un-metered linear memory execution in untrusted guest runtimes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient System Inheritance and Unmetered Core Store Configuration in WASI 0.2 Hosts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient System Inheritance and Unmetered Core Store Configuration in WASI 0.2 Hosts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS bind multi-tenant components to dedicated, least-privilege WIT worlds rather than generic `wasi

Engineers MUST ALWAYS bind multi-tenant components to dedicated, least-privilege WIT worlds rather than generic `wasi:cli/command` worlds.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.