Should max_instance_memory limit each memory or the whole instance?

[carsonfarmer]

Question

Should max_instance_memory limit the total linear memory used by one instance, or should it apply separately to each linear memory?

I expected it to limit the total. The current behavior matches Wasmtime's normal per-memory limit, so this may be a difference in interpretation rather than a bug.

Spin's help describes the limit as being "for an instance." The original PR chose this name to distinguish it from a whole-server limit. SKIP 006 also calls it a per-invocation limit. Neither discusses instances that contain several memories.

Current behavior

I tested a real component with two 65,536-byte memories. With max_instance_memory set to 65,536 bytes, Spin accepts both memories and reports 131,072 bytes used by the instance.

That is surprising for users who treat this setting as a firm limit on one instance.

Compatibility

A total limit would be stricter for components with several memories. Components with one memory would behave the same.

The low-level StoreBuilder::max_memory_size method has historically applied its limit to each memory. It could keep that behavior while max_instance_memory uses a separate total limit.

Which behavior does the project want for max_instance_memory, and should StoreBuilder::max_memory_size keep its current behavior? I am happy to submit the implementation and the real two-memory regression test once that choice is clear.

[dicej]

I agree that the name max_instance_memory is confusing given that it is applied per-memory rather than per-instance, and providing a way to limit at either granularity makes sense.

[dicej]

Looks like @rylev is doing some work in this area.