Documentation
¶
Overview ¶
Package wasm implements the TierWASM sandbox using wazero (WASI preview1).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Tool ¶
func Tool(name, desc string, module []byte, caps []policy.Capability) (runtime.ToolDescriptor, runtime.ToolExecutor)
Tool is a helper that wraps a WASM module as a ToolExecutor + ToolDescriptor. It creates a ToolExecutor that routes to a WASM sandbox.
Types ¶
type WASM ¶
type WASM struct {
// PrecompileModule can be used to optimize repeated executions.
// If nil, modules are compiled on-demand.
PrecompiledModules map[string]wazero.CompiledModule
}
WASM is a sandbox that executes WASM modules with wazero (TierWASM). It enforces WASI preview1 with configurable capabilities and resource limits.
func (*WASM) Run ¶
func (w *WASM) Run(ctx context.Context, spec runtime.SandboxSpec) (runtime.SandboxResult, error)
Run executes a WASM module in an isolated environment with WASI preview1. stdin/stdout are set from spec.Input/result.Output. Capabilities in spec.Caps determine filesystem mounts (fs:read:<dir> → read-only preopen). MemoryLimitPages limits WASM memory; deadline from ctx kills execution.
Context cancellation / deadline is respected: the runtime is configured with WithCloseOnContextDone, so wazero injects cancellation checks into compiled code — even a tight WASM busy-loop is forcibly terminated when ctx is done. No goroutine is leaked.
Source Files