Expand description
The sandbox abstraction.
Sandbox is the trait every plugin-runtime impl satisfies (WASM
in-process via wasmtime here, out-of-process via IPC in
confium-sandbox-process later — see TODO.roadmap/16). Every
instance runs inside the sandbox’s capability envelope: a plugin
cannot reach a host import it has not been granted.
See TODO.roadmap/15-wasm-sandboxing.md for the design.
Enums§
- Capability
- A capability a sandboxed plugin may be granted.
- Filesystem
Mode - Access mode for a
Capability::FilesystemPath. - Value
- A value passed across the sandbox boundary. Intentionally a small set — structured data crosses via linear-memory copy through a host import rather than being encoded into the type system.
Traits§
- Sandbox
- A plugin runtime.
- Sandbox
Instance - A loaded, capability-bound plugin.