Sockets: running actors get TCP, UDP, and DNS through wasi:sockets; candidates get no network

cli/src/runtime.rs

@@ -126,7 +126,8 @@ impl std::fmt::Display for Exit {
 
 pub struct InstanceConfig {
     pub mounts: Vec<Mount>,
-    pub allow_http: bool,
+    /// Outgoing HTTP, and TCP, UDP, and DNS through `wasi:sockets`.
+    pub network: bool,
     pub stderr_log: PathBuf,
     pub env: Vec<(String, String)>,
 }
@@ -277,6 +278,9 @@ impl Runtime {
             .with_context(|| format!("open {}", cfg.stderr_log.display()))?;
 
         let mut b = WasiCtx::builder();
+        if cfg.network {
+            b.inherit_network().allow_tcp(true).allow_udp(true).allow_ip_name_lookup(true);
+        }
         b.stdin(AsyncStdinStream::new(guest_in));
         b.stdout(AsyncStdoutStream::new(8192, guest_out));
         b.stderr(AsyncStdoutStream::new(8192, tokio::fs::File::from_std(stderr)));
@@ -293,7 +297,7 @@ impl Runtime {
             wasi: WasiPart { ctx: b.build(), table: ResourceTable::new() },
             fsx: FsExt::new(cfg.mounts),
             http: WasiHttpCtx::new(),
-            hooks: HttpHooks { allow: cfg.allow_http },
+            hooks: HttpHooks { allow: cfg.network },
         };
 
         let (line_tx, line_rx) = mpsc::channel(1024);