Skip to content
Formless Host

Threat model

Defended boundaries

Section titled “Defended boundaries”
  • Untrusted Host plugin code is isolated inside OCI + gVisor, non-root, with network=none.
  • Only generation-private HPP/2 and approved egress sockets are mounted.
  • Egress is exact host/port, address-pinned, budgeted, and rejects private/link-local/metadata targets.
  • Canvas is sandboxed and never receives Host credentials.
  • Capability declaration and user/Host authorization are checked separately.
  • Secret leases are exact-digest and generation-scoped.
  • Revisioned idempotent commands prevent silent stale mutation.
  • Causal traces preserve lifecycle and security evidence.

Trusted boundaries

Section titled “Trusted boundaries”

ABI v2 widgets share Click’s WASM address space and are trusted after hash review. The browser origin running Click is trusted as the Click application boundary. Host administrators and its OS keystore are trusted authorities.

Non-goals

Section titled “Non-goals”

Host is not a generic HTTP proxy, arbitrary URL relay, or full VM multi-tenant cloud. Firecracker is intentionally not part of the current runtime. WASI may be used inside an image but does not replace the production OCI/gVisor boundary.

No sandbox makes approval irrelevant. Review publisher identity, immutable digest, capability provisions, permissions, resources, and exact egress before enablement.