Shared-nothing architecture isolates interacting units: each keeps its own memory and mutable state, and communication crosses explicit interfaces. In a Wasm component system, a runtime, host, or component does not directly read another component’s linear memory; it uses imports and exports instead. This avoids requiring both sides to agree on an exported memory layout, an arrangement that is error prone when modules communicate through raw memory. section 3.1.2 section 3.5
Isolation does not eliminate communication; it makes the boundary explicit. When one component calls an imported function, values such as strings can be copied from its linear memory into the provider’s linear memory. Opaque resources cannot be copied by value, so the provider returns a resource handle. The caller then uses functions on that resource rather than accessing its underlying data directly. section 3.1.2
Figure 3.2 The interaction between two isolated Wasm components starting from a function call to communicating with an adapter component, doing required memory copies, and returning a resource that can be accessed via a resource table
Follow a call from one isolated component through memory copies and an adapter to a returned resource handle. section 3.1.2
The architecture changes security and maintenance boundaries:
- A component can access only its specified imports, rather than another component’s memory or global variables. This contains the potential blast radius of a vulnerable component. section 3.1.3
- A patched vulnerable component can be replaced and relinked without recompiling unrelated business logic, provided the interface connection is reestablished. section 3.1.3
- Explicit imports and exports also support high-level, cross-language communication while preserving separate component memories. section 3.1 section 3.5
Secret store across a component boundary
An application component imports a secret-store interface and calls get with my-key. The key is copied into the secret-store component’s linear memory. Because the returned Secret is opaque, the store returns a handle into a resource table; the application can invoke Secret functions using that handle, but does not receive direct access to the secret’s representation. section 3.1.2
SmartCMS guest and host
A guest imports get and set from component:smartcms/kvstore, writes guest-hello, and reads it back through that interface. The guest and host do not share memory; the interface manipulates runtime state. The guest can be built without standard output, leaving the host to display the result. section 3.4.3
