v1.1.0 (API)

Sandboxed wabt tool runs

The API shells out to prebuilt wabt binaries (wasm-decompile, wasm2wat) on user-supplied .wasm uploads. Those binaries carry open memory-corruption bugs reachable from hostile input (WebAssembly/wabt #2678, #2679, #2749, #2565) plus DoS-triggering assertion failures (#2316, #2317, #2322), and previously ran as root, unfiltered, alongside the Node server.

Every tool run now goes through Google's minijail0:

• rlimits — 512 MB address space, 30 s CPU, 256 MB output, 64 fds, no core dumps
• uid/gid drop to nobody (65534) when running as root
• Landlock filesystem rules — read+execute on the tool dir and loader libs, read-only on /usr /etc /dev and the input file, no writes anywhere
• seccomp allowlist — only the syscalls the tools actually make; no socket, clone, ptrace, bpf, io_uring, execve. Default deny = SIGSYS

execFile also gains a 30 s wall-clock timeout, a scrubbed child environment, and tool stderr in failure logs.

Known limitation: Landlock on Fly

Fly's Firecracker guest kernel (6.12.114-fly) does not support Landlock — landlock_create_ruleset returns ENOSYS, and minijail skips it silently. This is a kernel limitation, not a base-image one. On Fly the effective layers are seccomp + uid drop + rlimits, all of which fail closed and were verified on the deployed machine. A startup probe now logs the real enforcement level so the degraded state is visible in fly logs rather than implicit. See api/sandbox/README.md.

Notes

• minijail is built from a pinned upstream commit in the Docker image (linux-v9 predates a fix for newer kernel headers).
• Tests build the same commit and fall back to unsandboxed runs when libcap-dev is unavailable.
• CycloneDX SBOM attached.