Container bundling

[andy-haynes]

Containers are implemented via iframes with a srcDoc attribute value containing the importmap and the container source wrapping user RoC Components. This approach works well enough but imposes some constraints:

• Methods and Component source must be interpolated/injected into string templates. This is largely a maintenance concern, as it requires dependency pre-bundling or an absence of package dependencies (which is how it works now). It's also effectively a code injection vector, however benign, which requires source code sanitization during compilation.
• Not having a src property, outgoing container network requests will always have an origin of null.

Addressing the interpolation is ultimately a matter of building the bundle and outer HTML ahead of rendering the container iframe. One approach is to continue using srcDoc, but pass its value as a prop to the outer Component.

Utilizing src however would require a kind of CDN for pre-built HTML documents. An implementation using on-chain bundles in some capacity, with a robust enough fallback mechanism, could be a viable approach that doesn't violate decentralization too egregiously. This could allow developers to opt into performance benefits from caching at a much higher level than currently offered.