Show HN: Sandboxing untrusted code using WebAssembly

by mavdol04 on 2/3/2026, 2:28:01 PM

Hi everyone,<p>I built a runtime to isolate untrusted code using wasm sandboxes.<p>Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems.<p>The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible.<p>For example, in Python we have a simple decorator:<p><pre><code> from capsule import task @task( name=&quot;analyze_data&quot;, compute=&quot;MEDIUM&quot;, ram=&quot;512mb&quot;, allowed_files=[&quot;.&#x2F;authorized-folder&#x2F;&quot;], timeout=&quot;30s&quot;, max_retries=1 ) def analyze_data(dataset: list) -&gt; dict: &quot;&quot;&quot;Process data in an isolated, resource-controlled environment.&quot;&quot;&quot; # Your code runs safely in a Wasm sandbox return {&quot;processed&quot;: len(dataset), &quot;status&quot;: &quot;complete&quot;} </code></pre> And in TypeScript we have a wrapper:<p><pre><code> import { task } from &quot;@capsule-run&#x2F;sdk&quot; export const analyze = task({ name: &quot;analyzeData&quot;, compute: &quot;MEDIUM&quot;, ram: &quot;512mb&quot;, allowedFiles: [&quot;.&#x2F;authorized-folder&#x2F;&quot;], timeout: 30000, maxRetries: 1 }, (dataset: number[]) =&gt; { return {processed: dataset.length, status: &quot;complete&quot;} }); </code></pre> You can set CPU (with compute), memory, filesystem access, and retries to keep precise control over your tasks.<p>It&#x27;s still quite early, but I&#x27;d love feedback. I’ll be around to answer questions.<p>GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;mavdol&#x2F;capsule" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;mavdol&#x2F;capsule</a><p>[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46500510">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=46500510</a>

https://github.com/mavdol/capsule

Comments