A capability is a narrowly granted permission that lets a WebAssembly program perform a specific interaction with its host system. A Wasm module remains inside a memory-safe sandbox and cannot use native operating-system interfaces unless the runtime supplies the relevant capability. Granting standard output enables printing; withholding network access prevents unnecessary communication. section 1.2.4 section 4.1
Capabilities shape both security and integration:
- Treat each permission as an explicit boundary between the guest and native operating-system resources. section 1.2.4
- Use WASI to expose capabilities such as standard output, environment variables, or files to a Wasm guest. section 4.1
- Disable capabilities that an application does not need; the greeting component disables HTTP while retaining standard output. section 4.1
Granting standard output with WASI
A JavaScript guest changes greet from returning a string to calling console.log, then jco componentizes it with `--disable http`. A Rust Wasmtime host adds WASI to its linker, inherits stdout with `WasiCtxBuilder::new().inherit_stdout()`, and calls the component. The guest can print "Hello, World!" but receives no network capability.
Figure 1.6 A native (traditional) application security model versus Wasm’s capability-based security model
Compare unrestricted native operating-system access with Wasm’s capability-based model, where host permissions are granted selectively. section 1.2.4
