Security model
Guest code runs inside the VampCode VM. Capabilities and quotas bound what it can do.
Threat model
Guest code must not:
- Read/write arbitrary host paths
- Spawn OS processes
- Open network without grant
- Load native libraries / unrestricted FFI
- Exhaust host resources unbound
Capabilities
Explicit strings (storage, fs.read, ui…). Declared with @capability, granted in vamp.toml. No ambient authority.
Always fail
exec system spawn shell eval ffi dlopenQuotas (approx)
| Resource | Default |
|---|---|
| CPU steps | ~10M |
| Guest memory | ~64 MB |
| Open files | 16 |
| Network bytes | ~32 MB |
| Storage keys | ~10k |
Core promise
A malicious guest cannot read arbitrary host files, spawn processes, or pivot beyond granted capabilities.
cargo test -p vamp-vm --test security_isolation