sandboxed-api

In case you're using CMake instead, you may want to take a look at the `hello_sapi` example (https://github.com/google/sandboxed-api/blob/main/sandboxed_...). Other build systems will be significantly harder to integrate with.

Hi, one of the project's co-authors here (SAPI that is). The aim of SAPI is a bit different than whole-process sandboxing. It's about retaining the original running speed (and lack of sandboxing constraints) of the main project part, while making sure that only some parts are isolated (sandboxed), and the programming interfaces to the sandboxed parts still look familiar. I'm not that well-versed into how WASM works when it tries to integrate with the rest of OS. But I'd assume it's some form of whole-process sandboxing, where practically all code is WASMized, and only some kind of loaders and trusted stubs are written in native assemblers (something has to invoke syscalls in the end). In this case one can use Sandbox2, which is part of SAPI, though not very prominently exposed - https://github.com/google/sandboxed-api/tree/main/sandboxed_

Here is an example for sandboxing zlib: https://github.com/google/sandboxed-api/blob/main/sandboxed_... So it adds extra state, that needs to be initialized, adds extra failure points than needed to be handled in the code (sandbox initialization can fail, the RPC layer can fail itself), need to wrap some data structures so they can be passed through (you can't just pass pointers as-is). I wonder how callbacks can be passed, but maybe that's actually less problematic than data pointers.