crowdsecurity/crowdsec · error

failed to instantiate WASI: %w

Error message

failed to instantiate WASI: %w

What it means

NewChallengeRuntime wraps wasi_snapshot_preview1.Instantiate failure with 'failed to instantiate WASI'. WASI must be available in the wazero runtime before instantiating the obfuscator module; failure indicates a wazero runtime/context problem rather than bad config.

Source

Thrown at pkg/appsec/challenge/challenge.go:451

	cryptoPoolSize := resolvedOpts.cryptoObfuscationPoolSize
	if cryptoPoolSize <= 0 {
		cryptoPoolSize = cryptoObfuscationPoolDefaultSize
	}

	spentSetMaxEntries := resolvedOpts.spentSetMaxEntries
	if spentSetMaxEntries <= 0 {
		spentSetMaxEntries = spentSetDefaultMaxEntries
	}

	r, err := newWazeroRuntime(ctx)
	if err != nil {
		return nil, err
	}

	// No need to keep the closer around, we can just close the runtime itself when stopping
	if _, err := wasi_snapshot_preview1.Instantiate(ctx, r); err != nil {
		return nil, fmt.Errorf("failed to instantiate WASI: %w", err)
	}

	compiledMod, err := compileObfuscatorModule(ctx, r)
	if err != nil {
		return nil, err
	}

	// We use text/template instead of html/template because the data we send
	// is pretty much hardcoded and trusted; html/template would escape the JS
	// we inject. Parsed once here so GetChallengePage doesn't re-parse on
	// every request.
	htmlTpl, err := template.New("challenge").Parse(htmlTemplate)
	if err != nil {
		return nil, fmt.Errorf("parse challenge html template: %w", err)
	}

	challengeRuntime := &ChallengeRuntime{
		r:                  r,

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure WASI is instantiated exactly once per runtime (NewChallengeRuntime creates its own runtime, so avoid double instantiation in modified code).
2. Check the wrapped error for 'context canceled' and fix premature shutdown of the runtime during startup.
3. Rebuild against the pinned wazero version; try a clean rebuild.
4. Report upstream with the wrapped error if it reproduces on an unmodified build.

// Ensure single WASI instantiation per runtime in tests
wasTestingInOnce sync.Once // guard wasi_snapshot_preview1.Instantiate in test helpers

if _, err := wasi_snapshot_preview1.Instantiate(ctx, r); err != nil {
    if errors.Is(err, context.Canceled) { /* shutdown raced startup; retry or ignore */ }
    return nil, fmt.Errorf("failed to instantiate WASI: %w", err)
}

When it happens

Trigger: NewChallengeRuntime -> wasi_snapshot_preview1.Instantiate(ctx, r) errors — already-instantiated WASI in the runtime, cancelled context, or wazero internal failure.

Common situations: Reusing a runtime where WASI was already instantiated; a context cancelled during startup shutdown; wazero version bugs.

Related errors

• failed to compile obfuscator wasm module: %w
• wasm compiler mode unavailable: %w
• failed to create wasm runtime in compiler mode: %v (the kern
• failed to create gzip reader for obfuscator wasm: %w
• failed to decompress obfuscator wasm: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7b66277e74348800. Report an issue: GitHub.