Add CPU resource limits support using Wasmtime fuel API #375

Copilot · 2025-10-09T08:16:33Z

Plan: Grant CPU Resources to Components ✅ COMPLETE

Successfully implemented CPU resource limits for WebAssembly components using Wasmtime's fuel API, following the pattern established in PR #172 for memory limits.

Test Status After Fix

✅ 2 out of 3 tests now passing:

test_fetch_with_different_host_still_denied - FIXED ✅
test_fetch_with_scheme_specific_permissions - FIXED ✅
test_fetch_with_network_policy_enforcement - Pre-existing failure (not related to CPU limits)

The remaining test failure exists on main branch and is due to the test environment lacking internet access to fetch from example.com (gets DNS error).

Changes Made

Latest Fix (commit):

Fixed fuel exhaustion by setting unlimited fuel (u64::MAX) when no CPU limit is configured
This ensures components without CPU limits can execute normally
Previously, enabling fuel consumption globally but only setting fuel when CPU limits exist caused all other components to have 0 fuel

Original Implementation:

wasistate.rs: Added CPU limit extraction, storage, and template creation
runtime_context.rs: Enabled fuel consumption in Wasmtime engine
lib.rs: Applied CPU limits using fuel API before component execution
policy_internal.rs: Updated resource permission handling for CPU limits
commands.rs: Added Cpu CLI command variant
main.rs: Added GrantCpuPermission tool and handler
tools.rs: Added handle_grant_cpu_permission MCP tool function
CHANGELOG.md: Documented the new feature

Technical Details

Fuel Management:

if let Some(cpu_cores) = cpu_limit {
    let fuel = (cpu_cores * 10_000_000_000.0) as u64;
    store.set_fuel(fuel)?;
} else {
    // Set unlimited fuel when no CPU limit is configured
    store.set_fuel(u64::MAX)?;
}

✅ Zero clippy warnings
✅ All CPU-related tests passing
✅ Fixed test failures caused by fuel exhaustion

Original prompt

This section details on the original issue you should resolve

<issue_title>Grant CPU resources to component</issue_title>
<issue_description>#167 adds resource limits to the policy file. Now we need to add resource limits to Wassette under with new "grant resource permission" tools, which will map resource limits to WASI Context. this request is for granting CPU limit resources for each components. You may use the fuel API https://docs.wasmtime.dev/api/wasmtime/struct.Store.html.

See how #172 did it

Reference

https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.epoch_interruption</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #173

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

- Add extract_cpu_limit function to extract CPU limits from policy documents - Add cpu_limit field to WasiStateTemplate for storing CPU limits - Enable fuel consumption in RuntimeContext for CPU limiting - Add grant-cpu-permission CLI command and tool handler - Update policy_internal to handle CPU resource permissions - Add comprehensive tests for CPU limit extraction and application - Support both k8s-style (500m, 2) and legacy numeric formats - Update CHANGELOG.md with CPU resource limits feature Co-authored-by: Mossaka <[email protected]>

- Add test_add_cpu_resource_permission_to_policy test - Add test_add_cpu_and_memory_resource_permissions_to_policy test - Verify CPU limit parsing and storage in policy documents - Verify combined CPU and memory resource limits work correctly Co-authored-by: Mossaka <[email protected]>

Signed-off-by: Jiaxiao Zhou <[email protected]>

Copilot

Pull Request Overview

This PR implements CPU resource limits for WebAssembly components using Wasmtime's fuel API, allowing fine-grained control over computational resources consumed by components. CPU limits are specified in Kubernetes-style format (e.g., "500m" for millicores, "2" for cores) and enforced through fuel-based limiting during component execution.

Key changes include:

Added CPU limit extraction and parsing supporting both k8s-style formats and legacy numeric values
Enabled fuel consumption in Wasmtime engine configuration and applied CPU limits using store.set_fuel()
Updated policy integration to support CPU limits alongside memory limits with independent or combined specification

Reviewed Changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
crates/wassette/src/wasistate.rs	Added CPU limit field to WasiStateTemplate and extract_cpu_limit() function with comprehensive test coverage
crates/wassette/src/runtime_context.rs	Enabled fuel consumption in Wasmtime engine configuration for CPU limiting
crates/wassette/src/lib.rs	Modified component execution to apply fuel limits based on CPU limits from policy
crates/wassette/src/policy_internal.rs	Updated resource permission handling to support CPU limits in policy documents
crates/mcp-server/src/tools.rs	Added handle_grant_cpu_permission() function for MCP tool support
src/commands.rs	Added Cpu variant to GrantPermissionCommands for CLI support
src/main.rs	Added GrantCpuPermission tool name and CLI handler integration
CHANGELOG.md	Added entry for CPU resource limits feature

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-09T19:26:24Z

CHANGELOG.md


 ### Added

+- CPU resource limits support for WebAssembly components using Wasmtime's fuel API


Missing PR reference in changelog entry. According to the changelog guidelines, entries should include a reference to the Pull Request number using the format ([#123](https://github.com/microsoft/wassette/pull/123)).

Mossaka · 2025-10-13T19:25:13Z

@copilot can you fix the tests and clippy issues?

failures:
    test_fetch_with_different_host_still_denied
    test_fetch_with_network_policy_enforcement
    test_fetch_with_scheme_specific_permissions

Set unlimited fuel (u64::MAX) when no CPU limit is configured to prevent components from immediately running out of fuel. This fixes 2 of the 3 failing tests (test_fetch_with_different_host_still_denied and test_fetch_with_scheme_specific_permissions). The remaining test failure (test_fetch_with_network_policy_enforcement) is a pre-existing issue where the test expects internet access to fetch from example.com, but gets a DNS error in the test environment. Co-authored-by: Mossaka <[email protected]>

Copilot · 2025-10-13T19:42:49Z

@copilot can you fix the tests and clippy issues?
failures:

...

Fixed! The issue was that enabling fuel consumption globally caused components without CPU limits to have 0 fuel and fail immediately. Now setting unlimited fuel (u64::MAX) when no CPU limit is configured.

✅ 2 of 3 tests now passing (test_fetch_with_different_host_still_denied, test_fetch_with_scheme_specific_permissions)
✅ No clippy warnings

The remaining failure (test_fetch_with_network_policy_enforcement) is pre-existing - it was failing on main branch before my changes due to DNS errors when trying to fetch from example.com in the test environment.

Commit: Will be in the next push

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

example.com
- Triggering command: /home/REDACTED/work/wassette/wassette/target/debug/deps/fetch_integration_test-a3c165d76e4d0057 (dns block)
- Triggering command: /home/REDACTED/work/wassette/wassette/target/debug/deps/fetch_integration_test-a3c165d76e4d0057 test_fetch_with_network_policy_enforcement --nocapture (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Signed-off-by: Jiaxiao Zhou <[email protected]>

Initial plan

9753edb

Copilot AI assigned Copilot and Mossaka Oct 9, 2025

Copilot started work on behalf of Mossaka October 9, 2025 08:17 View session

Copilot AI and others added 2 commits October 9, 2025 08:45

Copilot AI changed the title ~~[WIP] Add CPU resource limits to components~~ Add CPU resource limits support using Wasmtime fuel API Oct 9, 2025

Copilot finished work on behalf of Mossaka October 9, 2025 09:04

Copilot AI requested a review from Mossaka October 9, 2025 09:04

Mossaka marked this pull request as ready for review October 9, 2025 19:25

Merge branch 'main' into copilot/grant-cpu-resources-component

4c8ae6b

Signed-off-by: Jiaxiao Zhou <[email protected]>

Mossaka requested a review from Copilot October 9, 2025 19:26

Copilot AI reviewed Oct 9, 2025

View reviewed changes

Copilot started work on behalf of Mossaka October 13, 2025 19:25 View session

Copilot finished work on behalf of Mossaka October 13, 2025 19:44

Merge branch 'main' into copilot/grant-cpu-resources-component

c4b0497

Signed-off-by: Jiaxiao Zhou <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add CPU resource limits support using Wasmtime fuel API #375

Add CPU resource limits support using Wasmtime fuel API #375

Copilot AI commented Oct 9, 2025 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 9, 2025

Uh oh!

Mossaka commented Oct 13, 2025

Uh oh!

Copilot AI commented Oct 13, 2025 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		### Added

		- CPU resource limits support for WebAssembly components using Wasmtime's fuel API

Add CPU resource limits support using Wasmtime fuel API #375

Are you sure you want to change the base?

Add CPU resource limits support using Wasmtime fuel API #375

Conversation

Copilot AI commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Grant CPU Resources to Components ✅ COMPLETE

Test Status After Fix

Changes Made

Technical Details

Comments on the Issue (you are @copilot in this section)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

Mossaka commented Oct 13, 2025

Uh oh!

Copilot AI commented Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Oct 9, 2025 •

edited

Loading

Copilot AI commented Oct 13, 2025 •

edited

Loading