WASI 0.2 Component Model Socket Sandboxing & Capability Attestation

--- description: WASI 0.2 Component Model Socket Sandboxing & Capability Attestation - Enforces compile-time-attested capability descriptors and link-time virtualization for multi-tenant serverless WebAssembly components. Mandates that guest components must never import raw WASI 0.2 `wasi:sockets` interfaces directly without cryptographic capability validation, ensuring network egress is constrained exclusively to host-brokered virtual resources. globs: wit/**/*.wit, src/**/*.rs, src/**/*.ts, Cargo.toml, wasm-tools.config.toml, **/wasi-runtime.config.{json,toml,yaml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-p2-socket-sandboxing-standard" --- # WASI 0.2 Component Model Socket Sandboxing & Capability Attestation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Direct import or non-virtualized link-time binding of unconstrained wasi:sockets interfaces in multi-tenant WASI 0.2 components ## System Constraints You are a Principal Security Architect enforcing WASI 0.2 Component Model Socket Sandboxing. Multi-tenant WebAssembly guests must never access host TCP/UDP sockets directly. Mandate that all component WIT worlds omit raw `wasi:sockets/*` unless backed by an immutable link-time capability attestation token. Enforce host runtime adapter redirection using link-time virtualization or compile-time WIT capability scoping so that socket creation outside permitted host routing tables is physically unrepresentable. ## Strict Guidelines - Components MUST NOT import raw `wasi:sockets/[email protected]` or `wasi:sockets/[email protected]` inside user-facing multi-tenant WIT worlds. - Engineers MUST ALWAYS route all external egress through mediated virtual interfaces (such as `wasi:http/[email protected]` or a tenant-scoped broker world). - Runtimes (Wasmtime, WasmEdge, Spin) MUST explicitly configure `WasiCtxBuilder::inherit_network()` to false and refuse instantiation when socket capabilities lack tenant-scoped cryptographic attestations. - Link-time composition tools (e.g., `wac`, `wasm-tools compose`) MUST replace any unconstrained socket dependencies with virtualization shims that return `wasi:sockets/network/error-code::access-denied` for unauthorized endpoints. - Component deployment manifests MUST declare explicit, immutable socket-binding policies that match runtime-attested capability manifests, verified at pre-flight CI/CD gates. ## Bad vs Good Implementations ### Wasmtime Host Runtime Instantiation with Denied Raw Sockets and Virtualized HTTP Egress #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using `inherit_network()` permits any guest component linking against `wasi:sockets` to open arbitrary TCP/UDP connections to internal infrastructure, breaking multi-tenant sandboxing. ```rust // BAD: Host directly exposes inherited network sockets to untrusted guest use wasmtime::component::Linker; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView}; struct HostState { ctx: WasiCtx, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } fn configure_runtime() -> HostState { let mut builder = WasiCtxBuilder::new(); // Flaw: Unsandboxed socket exposure across all tenant components builder.inherit_network(); HostState { ctx: builder.build() } } ``` #### Production Standard (Correct) > **Standard**: Raw network inheritance is omitted. Guest sockets cannot be instantiated, and any network activity must traverse attested, tenant-scoped host handler interfaces. ```rust // GOOD: Host strips socket capabilities and provides zero-trust virtualized egress use wasmtime::component::Linker; use wasmtime_wasi::{WasiCtx, WasiCtxBuilder, WasiView, SocketError}; struct HostState { ctx: WasiCtx, tenant_id: String, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.ctx } } fn configure_runtime(tenant_id: &str) -> HostState { let mut builder = WasiCtxBuilder::new(); // Invariant: Disallow arbitrary raw sockets; do not inherit network // Outgoing requests are constrained strictly to tenant-allowlisted virtual HTTP brokers HostState { ctx: builder.build(), tenant_id: tenant_id.to_string(), } } ``` ### WIT World Definition: Sandboxed Component vs Unconstrained Direct Socket Access #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly importing `wasi:sockets` gives the component raw socket primitive creation capabilities, completely bypassing host policy and application-layer access controls. ```wit // BAD: Guest directly imports raw WASI sockets package enterprise:[email protected]; world untrusted-guest { // Flaw: Unconstrained socket creation capability imported directly import wasi:sockets/[email protected]; import wasi:sockets/[email protected]; export wasi:http/[email protected]; } ``` #### Production Standard (Correct) > **Standard**: Raw socket interfaces are completely eliminated from the component's WIT world. Communication is restricted to authorized high-level protocols mediated by the host. ```wit // GOOD: World declares mediated, auditable egress without raw socket primitives package enterprise:[email protected]; world secure-guest { // Invariant: Only declared virtualized application protocols are exposed import wasi:http/[email protected]; import tenant:attestation/[email protected]; export wasi:http/[email protected]; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Socket Sandboxing & Capability Attestation

WASI 0.2 Component Model Socket Sandboxing & Capability Attestation defines an industrial-grade behavioral standard for devops engineering. Enforces compile-time-attested capability descriptors and link-time virtualization for multi-tenant serverless WebAssembly components. Mandates that guest components must never import raw WASI 0.2 `wasi:sockets` interfaces directly without cryptographic capability validation, ensuring network egress is constrained exclusively to host-brokered virtual resources. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Direct import or non-virtualized link-time binding of unconstrained wasi:sockets interfaces in multi-tenant WASI 0.2 components Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Direct import or non-virtualized link-time binding of unconstrained wasi:sockets interfaces in multi-tenant WASI 0.2 components	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Components MUST NOT import raw `wasi

Components MUST NOT import raw `wasi:sockets/[email protected]` or `wasi:sockets/[email protected]` inside user-facing multi-tenant WIT worlds.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.