Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard

--- description: Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard - Enforces deterministic capability-based security across all WebAssembly Component Model runtimes using Wasmtime. Untrusted guest extensions are strictly isolated from ambient POSIX capabilities, host filesystems, environment variables, and raw sockets through explicitly mediated WASI 0.2 interfaces and rigid resource limits. globs: crates/**/*.rs, src/**/*.rs, src/plugins/**/*.rs, src/runtime/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasmtime-capability-component-isolation-standard" --- # Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Leaking Ambient Host POSIX Resources and Ambient Network Context into Untrusted WebAssembly Guests ## System Constraints You are a Principal Systems Architect and Security Engineer enforcing strict capability-based isolation using Wasmtime and the WebAssembly Component Model. You strictly mandate that guest modules and components never inherit ambient host authority, POSIX filesystem roots, unrestrained network access, or unbounded host memory allocations. ## Strict Guidelines - Engineers MUST ALWAYS construct guest runtime contexts using explicit, capability-constrained WASI contexts (WasiCtxBuilder) without calling ambient helper methods like inherit_stdio, inherit_env, or inherit_network. - Engineers MUST NOT preopen root directories ('/') or arbitrary host paths; all filesystem interactions MUST use scoped, virtualized in-memory filesystems or read-only guest-specific mount points via DirPerms and FilePerms. - Host runtimes MUST attach StoreLimits or StoreLimitsBuilder to every Wasmtime Store to place deterministic hard upper bounds on linear memory growth, table elements, and component instances. - Engineers MUST route guest stdout, stderr, and network IO exclusively through sandboxed memory pipes or custom mock WASI virtual interfaces, disallowing raw OS socket creation. - Linkers MUST explicitly define interface boundaries using WASI Preview 2 Component Model interfaces (wasmtime_wasi::p2) and MUST NOT inject host syscall bindings into untrusted guest linkers. ## Bad vs Good Implementations ### Wasmtime WasiCtx Host Context Initialization #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The runtime grants ambient host access by inheriting host stdout/stderr, environment variables (which may leak secrets), and network sockets. Mounting the host root directory with all permissions grants guest escape into the host filesystem, while omitting StoreLimits enables host-crashing memory exhaustion attacks. ```rust use wasmtime::Store; use wasmtime_wasi::WasiCtxBuilder; // CRITICAL SECURITY FLAW: Inheriting ambient host privileges and unbounded host filesystem access pub fn setup_untrusted_plugin_runtime() -> anyhow::Result<()> { let mut wasi_builder = WasiCtxBuilder::new(); wasi_builder .inherit_stdio() .inherit_env() .inherit_network() .preopened_dir("/", ".", wasmtime_wasi::DirPerms::all(), wasmtime_wasi::FilePerms::all())?; let wasi_ctx = wasi_builder.build_p1(); // Store created without memory/table resource limiting allows guest DoS/OOM on the host let engine = wasmtime::Engine::default(); let _store = Store::new(&engine, wasi_ctx); Ok(()) } ``` #### Production Standard (Correct) > **Standard**: The runtime adheres strictly to capability-based security: it isolates guest IO into an in-memory capture pipe, avoids environment variable and raw network leakage, restricts directory preopening to a single read-only scoped mount, and enforces deterministic resource limits via StoreLimits. ```rust use wasmtime::{Engine, Store, StoreLimits, StoreLimitsBuilder}; use wasmtime_wasi::pipe::MemoryOutputPipe; use wasmtime_wasi::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder, WasiView}; pub struct HostState { pub wasi: WasiCtx, pub limits: StoreLimits, pub stdout_capture: MemoryOutputPipe, } impl WasiView for HostState { fn ctx(&mut self) -> &mut WasiCtx { &mut self.wasi } fn ctx_mut(&mut self) -> &mut WasiCtx { &mut self.wasi } } pub fn setup_isolated_plugin_runtime(engine: &Engine, scoped_dir: &std::path::Path) -> anyhow::Result<Store<HostState>> { let stdout_capture = MemoryOutputPipe::new(1024 * 64); let mut wasi = WasiCtxBuilder::new(); // Zero ambient inheritance: explicitly mock/pipe standard IO wasi.stdout(stdout_capture.clone()) .preopened_dir(scoped_dir, ".", DirPerms::READ, FilePerms::READ)?; // Enforce strict resource budgets against memory exhaustion let limits = StoreLimitsBuilder::new() .memory_size(64 * 1024 * 1024) // 64 MB max .instances(5) .tables(5) .build(); let state = HostState { wasi: wasi.build(), limits, stdout_capture, }; let mut store = Store::new(engine, state); store.limiter(|state| &mut state.limits); Ok(store) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard

Wasmtime Capability-Based Component Model Zero-Trust Isolation Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic capability-based security across all WebAssembly Component Model runtimes using Wasmtime. Untrusted guest extensions are strictly isolated from ambient POSIX capabilities, host filesystems, environment variables, and raw sockets through explicitly mediated WASI 0.2 interfaces and rigid resource limits. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Leaking Ambient Host POSIX Resources and Ambient Network Context into Untrusted WebAssembly Guests Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Leaking Ambient Host POSIX Resources and Ambient Network Context into Untrusted WebAssembly Guests	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS construct guest runtime contexts using explicit, capability-constrained WASI contexts (WasiCtxBuilder) without calling ambient helper methods like inherit_stdio, inherit_env, or inherit_network.

Engineers MUST ALWAYS construct guest runtime contexts using explicit, capability-constrained WASI contexts (WasiCtxBuilder) without calling ambient helper methods like inherit_stdio, inherit_env, or inherit_network.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.