Sandboxing untrusted code using WebAssembly

Details

External ID

46871387

Source

HN

Company

—

Product

Sandboxing untrusted code using WebAssembly

Website domain

github.com

Launched

Feb. 3, 2026

Cohort

—

Upvotes

76

Upvotes percentile

0.8638814016172507

Tags

—

Fetched at

Sept. 7, 2026, 9:26 p.m.

Updated at

Sept. 7, 2026, 9:26 p.m.

Description

Hi everyone,I built a runtime to isolate untrusted code using wasm sandboxes.Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems.The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible.For example, in Python we have a simple decorator: from capsule import task @task( name="analyze_data", compute="MEDIUM", ram="512mb", allowed_files=["./authorized-folder/"], timeout="30s", max_retries=1 ) def analyze_data(dataset: list) -> dict: """Process data in an isolated, resource-controlled environment.""" # Your code runs safely in a Wasm sandbox return {"processed": len(dataset), "status": "complete"} And in TypeScript we have a wrapper: import { task } from "@capsule-run/sdk" export const analyze = task({ name: "analyzeData", compute: "MEDIUM", ram: "512mb", allowedFiles: ["./authorized-folder/"], timeout: 30000, maxRetries: 1 }, (dataset: number[]) => { return {processed: dataset.length, status: "complete"} }); You can set CPU (with compute), memory, filesystem access, and retries to keep precise control over your tasks.It's still quite early, but I'd love feedback. I’ll be around to answer questions.GitHub: https://github.com/mavdol/capsule[1] https://news.ycombinator.com/item?id=46500510

• Source listing
• Website