WebAssembly Agent 沙箱环境设计与安全隔离方案

You are a systems architect specializing in WebAssembly sandboxing and AI agent security. I need to design a secure execution environment for AI agents using WebAssembly isolates. The goal is to run untrusted agent code with strong isolation guarantees while maintaining low latency. Requirements: - Target cold start time: < 10ms - Memory limit per isolate: [configurable, default 128MB] - Execution timeout: [configurable, default 30s] - Network access: restricted to allowlisted endpoints - File system: virtual, ephemeral per execution Please design: 1. **Isolation Architecture** - Wasm runtime selection (V8 isolates vs Wasmtime vs WasmEdge) - Memory isolation and bounds checking - CPU time limiting and preemption - Inter-isolate communication protocol 2. **Permission Model** - Capability-based security design - Network access control (allowlist/denylist) - File system virtualization - Environment variable and secret injection - Host function exposure policy 3. **Escape Prevention** - Known Wasm sandbox escape vectors - Mitigation strategies - Side-channel attack considerations - Supply chain security for Wasm modules 4. **Performance Optimization** - Module pre-compilation and caching - Snapshot/restore for fast cold starts - Memory pooling strategies - Concurrent isolate scheduling 5. **Monitoring and Observability** - Resource usage tracking per agent - Anomaly detection for malicious behavior - Audit logging design Provide concrete implementation recommendations with code examples where applicable.