You can already do this in lunatic. For example, in the Rust library you can create a configuration (https://docs.rs/lunatic/latest/lunatic/struct.ProcessConfig....) with specific permissions (e.g. no i/o) and then use the spawn_config function to spawn children with it. Children will automatically inherit the configuration from their parents.
Lunatic is also a bit of a meta-system. We expose a lot of the vm stuff directly to the running wasm instances. So you can in a running wasm modules embed other modules or dynamically load them, then spawn processes from them. At the same time you can use the configurations to limit capabilities of this, potentially untrusted, modules.
Comments
Thanks!
You can already do this in lunatic. For example, in the Rust library you can create a configuration (https://docs.rs/lunatic/latest/lunatic/struct.ProcessConfig....) with specific permissions (e.g. no i/o) and then use the spawn_config function to spawn children with it. Children will automatically inherit the configuration from their parents.
Lunatic is also a bit of a meta-system. We expose a lot of the vm stuff directly to the running wasm instances. So you can in a running wasm modules embed other modules or dynamically load them, then spawn processes from them. At the same time you can use the configurations to limit capabilities of this, potentially untrusted, modules.