WASM sandbox

WASM sandboxing executes untrusted code at near-native speed within a secure, memory-isolated environment.

WebAssembly (WASM) sandboxing leverages a capability-based security model to restrict execution to a linear memory space. By using runtimes like Wasmtime or Wasmer, developers can run C++, Rust, or Go modules with zero access to the host system unless explicitly granted via WASI (WebAssembly System Interface). This architecture eliminates entire classes of vulnerabilities like buffer overflows and unauthorized file access, making it the standard for edge computing platforms like Cloudflare Workers and plugin systems in Envoy.

https://wasmtime.dev/