wasm_sandbox

Overview ¶

Example: wasm_sandbox runs an untrusted WebAssembly (WASI) module inside the pure-Go wazero-backed sandbox. WebAssembly gives strong isolation for free — the module runs in its own linear memory and can only touch the host through capabilities the sandbox grants (here: stdio and argv, nothing else).

The example compiles a tiny Go program to WASI on the fly, so it is fully self-contained and needs no external .wasm file. It requires the Go toolchain on PATH (it invokes `GOOS=wasip1 GOARCH=wasm go build`).

go run ./examples/wasm_sandbox/

To run your own module instead, build it to WASI and pass its path:

GOOS=wasip1 GOARCH=wasm go build -o prog.wasm ./yourprog
go run ./examples/wasm_sandbox/ prog.wasm