Sandboxing untrusted code using WebAssembly
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…
In plain words
This is a WebAssembly-based runtime that isolates untrusted code to protect host systems from potential damage. Built in Rust with WASI 0.2 and the component model, it offers language-specific SDKs for Python and TypeScript that make integration straightforward. Developers can execute arbitrary code safely with resource controls, file permissions, and timeout settings using simple decorators or API calls, without exposing their systems to security risks.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator: from capsule import task @task( name="analyze_data", compute="MEDIUM", ram="512mb", allowed_files=["./authorized-folder/"], timeout="30s", max_retries=1 ) def analyze_data(dataset: list) -> dict: """Process data in an isolated, resource-controlled environment.""" # Your code runs safely in a Wasm sandbox return {"processed": len(dataset), "status": "complete"} And in TypeScript we have a wrapper: import { task } from "@capsule-run/sdk" export const analyze = task({ name: "analyzeData", compute: "MEDIUM", ram: "512mb", allowedFiles: ["./authorized-folder/"], timeout: 30000, maxRetries: 1 }, (dataset: number[]) => { return {processed: dataset.length, status: "complete"} }); You can set CPU (with compute), memory, filesystem access, and retries to keep precise control over your tasks. It's still quite early, but I'd love feedback. I’ll be around to answer questions. GitHub: https://github.com/mavdol/capsule [1] https://news.ycombinator.com/item?id=46500510
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
