The job policy file (format version 1)
Heimdall is a defensive sandbox. A job policy file can only narrow what a
job may do. It is TOML, passed with heimdall run --policy <file>. Without
--policy, every limit takes its default.
A full example is examples/policy.toml.
Rules
version = 1is required. Any other version, or a missing one, is refused.- Unknown keys are refused everywhere (top level,
[job],[limits]), so a typo never falls back silently to a default. read,writeandnetare refused in milestone 1, even when empty: a wasm job reads only its--indir, writes only its--outdir and has no network.[job] kindis optional; when present it must be"wasm".- Every limit is an integer of at least 1 and at most Heimdall's compiled-in ceiling. Floats, strings and negative numbers are refused.
max_output_file_bytesmust not be abovemax_output_total_bytes.- The file itself must be a regular file (a symlink is refused), valid UTF-8, and at most 64 KiB.
[limits]
| Key | Meaning | Default | Ceiling |
|---|---|---|---|
fuel | wasm fuel the guest may burn (always metered) | 1 000 000 000 | 1 000 000 000 000 |
wall_time_ms | wall-clock timeout (epoch interruption) | 10 000 | 3 600 000 |
memory_bytes | linear memory over all guest memories | 256 MiB | 4 GiB |
table_elements | table elements over all guest tables | 100 000 | 1 000 000 |
instances | core instances the guest may create (a component guest needs 3) | 4 | 100 |
tables | tables the guest may create | 4 | 100 |
memories | memories the guest may create | 1 | 16 |
stack_bytes | wasm stack | 1 MiB | 16 MiB |
max_input_bytes | the input file | 64 MiB | 4 GiB |
max_output_files | files the guest may emit | 64 | 10 000 |
max_output_file_bytes | one emitted file | 64 MiB | 4 GiB |
max_output_total_bytes | all emitted files together | 256 MiB | 16 GiB |
The defaults are heimdall-core's Limits::default() (plus max_input_bytes,
which only heimdall-run uses); the ceilings are heimdall-run's LIMIT_KEYS.
Every key except max_input_bytes maps one to one onto heimdall_core::Limits.
The parser is heimdall_run::PolicyFile::{parse, from_bytes, load}; it has a
cargo-fuzz target (fuzz/fuzz_targets/policy_file.rs).