WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation

--- description: WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation - Mandates mathematically sound capability attenuation for untrusted polyglot guest components executing within WASI 0.2 edge runtimes. Enforces strict zero-ambient-authority via discrete WASI context building, rejecting inherited host descriptors, wildcard socket allocations, and unfiltered outgoing HTTP handlers. Guarantees untrusted plugins cannot escape virtual preopened filesystems or breach runtime network perimeters. globs: crates/**/*.rs, src/**/*.rs, runtime/**/*.rs, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-p2-capability-boundary-isolation-standard" --- # WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Ambient Descriptor Inheritance and Unconstrained Egress in WASI 0.2 Host Runtimes ## System Constraints You are a Principal Software Architect enforcing the WASI 0.2 Component Model Capability-Based Sandboxing Standard. Mandate zero ambient authority for untrusted guest components. Enforce explicit capability attenuation across filesystem preopens, network interfaces, and host resources. ## Strict Guidelines - Engineers MUST ALWAYS construct guest runtime contexts using explicit capability builders (e.g., `WasiCtxBuilder::new()`) without ambient host inheritance. - Engineers MUST NOT invoke `inherit_all()`, `inherit_stdio()`, `inherit_env()`, or `inherit_network()` when instantiating contexts for untrusted plugin execution. - Filesystem preopens MUST be restricted to isolated, non-root paths or memory-backed virtual filesystems with granular, deterministic read/write capability flags (`DirPerms`, `FilePerms`). - Network egress MUST NOT provide raw socket capabilities (`wasi:sockets`); egress MUST be attenuated via a custom `wasi:http/outgoing-handler` interceptor validating URLs against an explicit CIDR/domain allowlist. - Host linkers MUST assign ephemeral, discrete `ResourceTable` instances per invocation to guarantee deterministic teardown and eliminate cross-tenant handle confusion or state leakage. ## Bad vs Good Implementations ### WASI 0.2 Host Runtime Context Isolation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using `.inherit_all()` and preopening the host root directory `/` breaks sandboxing guarantees. Untrusted guest WASM modules gain ambient access to the host's standard I/O, process environment secrets, raw host network sockets, and file descriptor manipulation. ```rust use wasmtime_wasi::p2::{WasiCtx, WasiCtxBuilder, ResourceTable}; use wasmtime::component::Linker; pub fn setup_untrusted_plugin_runtime() -> (WasiCtx, ResourceTable) { let mut table = ResourceTable::new(); // CRITICAL SECURITY FLAW: Inherits ambient host authority // Grants untrusted guest access to host stdout, stdin, env vars, and full socket mesh let wasi = WasiCtxBuilder::new() .inherit_all() .preopened_dir("/", ".", wasmtime_wasi::p2::DirPerms::all(), wasmtime_wasi::p2::FilePerms::all()) .expect("Failed to map root filesystem") .build(); (wasi, table) } ``` #### Production Standard (Correct) > **Standard**: Constructs an unprivileged WASI 0.2 context with zero ambient host capabilities. The host filesystem is protected via cap-std capability-based directory handles restricted to read-only access on an explicit sandbox path, with network sockets and host environment descriptors completely omitted. ```rust use wasmtime_wasi::p2::{WasiCtx, WasiCtxBuilder, ResourceTable, DirPerms, FilePerms}; use std::path::Path; use cap_std::fs::Dir; pub fn setup_untrusted_plugin_runtime(sandbox_root: &Path) -> Result<(WasiCtx, ResourceTable), Box<dyn std::error::Error>> { let table = ResourceTable::new(); // Confine guest to an explicit, isolated directory using cap-std capabilities let dir = Dir::open_ambient_dir(sandbox_root, cap_std::ambient_authority())?; // Zero ambient authority: no inherited stdio, no env vars, no raw sockets let wasi = WasiCtxBuilder::new() .preopened_dir( dir, DirPerms::READ, FilePerms::READ, "/sandbox" ) // Outbound networking and system clocks strictly attenuated .build(); Ok((wasi, table)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation

WASI 0.2 Component Model Least-Privilege Sandboxing & Capability Attenuation defines an industrial-grade behavioral standard for devops engineering. Mandates mathematically sound capability attenuation for untrusted polyglot guest components executing within WASI 0.2 edge runtimes. Enforces strict zero-ambient-authority via discrete WASI context building, rejecting inherited host descriptors, wildcard socket allocations, and unfiltered outgoing HTTP handlers. Guarantees untrusted plugins cannot escape virtual preopened filesystems or breach runtime network perimeters. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Ambient Descriptor Inheritance and Unconstrained Egress in WASI 0.2 Host Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Ambient Descriptor Inheritance and Unconstrained Egress in WASI 0.2 Host Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS construct guest runtime contexts using explicit capability builders (e.g., `WasiCtxBuilder

Engineers MUST ALWAYS construct guest runtime contexts using explicit capability builders (e.g., `WasiCtxBuilder::new()`) without ambient host inheritance.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.