6 ms·

The article is completely on point. Because of all the reasons exposed there (and a few more) I started Wasmer, a new container system based on WebAssembly - ht

The article is completely on point. Because of all the reasons exposed there (and a few more) I started Wasmer, a new container system based on WebAssembly - https://wasmer.io/ https://wasmer.io/ Here are some advantages of Wasmer vs Docker: * Much faster startup time * Smaller containers * OS independent containers (they can run in Linux, macOS and Windows) * Chipset independent containers (so they can run anywhere: x86_64, Aarch64/ARM, RISC-V)

scanr 7y ago
Wasmer looks interesting. I couldn’t read much as I get an “unexpected error” as soon as I start scrolling. It does say that it’s not optimised for mobile.
- syrusakbary 7y ago
  Thanks for reporting it! We will investigate and try to fix it ASAP :) PS: if you could provide your device info (os and browser) it would be awesome
  - jackalo 7y ago
    The black terminal next to the “Try It Now” remains blank while the cursor box zooms around it. No visible text is seen. iPhone XS Max, iOS 13 GM, Safari.
  - yoz 7y ago
    Also seeing it on an iPhone 8, iOS 12.4. The site is completely unusable/unreadable.
anaphor 7y ago
One thing I also find sorely lacking in Docker is the ability to run your containers with the appropriate seccomp privileges (in order to enforce Principle of Least Authority). I know this is possible with Docker, but it's not really done much in practice because of various difficulties. I wonder how difficult it would be to do that with your tool?
- syrusakbary 7y ago
  Since Wasmer is in control of all the syscalls its actually quite easy to manage the privileges in a more fine-grained way (think on CloudABI permissions on top of your containers)
  - anaphor 7y ago
    That sounds really interesting. I'm going to check it out. Thanks for working on this!
- nwmcsween 7y ago
  Seccomp is a horrible security model for containers, if the application or it's libraries use differing syscalls the seccomp ruleset is invalid
  - pbar 7y ago
    A process making a system call to the kernel functions the same way regardless of whether it is in a container or not. How exactly does the security model differ at all?
    - nwmcsween 7y ago
      Because 99.9% of software doesn't make use of direct syscalls, instead it uses wrappers or standard functions that wrap various other syscalls that can and will change over time. Meaning $app_container v0.1 can and probably will have a different seccomp filter than $app_container v0.2
      - pbar 7y ago
        This is the same case regardless of being in a container or not, $app v0.1 and $app v0.2 will have different filters
        nwmcsween 7y ago
ctidd 7y ago
Looks like an interesting project. I know the website isn't responsive, but adjusting the current meta viewport declaration would go a long way while you're working on a full solution. The minimum zoom of 1 makes it unusable in practice right now on a small mobile viewport due to the amount of panning it forces you to do.
gravypod 7y ago
Is there a feature by feature comparison of wasmer to docker? I don't think Wasmer, while interesting, is a container system. It looks more like a bytecode vm. Things I use and love from docker that to me feel "container"-y: 1. OSs as a library (FROM alpine:3.9) 2. Network namespaces so all applications think they are running on a machine with port 80 available 3. Service discovery through DNS 4. CPU and memory share allocation 5. Volumes (bind, temporary, remote) 6. docker-compose for single-command & single-tool development environments (all you need is docker and an internet connection)
- syrusakbary 7y ago
  Wasmer is an application-based container while Docker is a OS-based container. Because of that some of the things that you posted are a bit hard to compare. We believe that by having a VM (based on a industry adopted specification such as WebAssembly) we can control much more granularly both execution (CPU, memory) and the runtime interoperability with the system (networking, file system, ...), solving most of the issues that Docker containers have
  - ahnick 7y ago
    What's the selling point of Wasmer over the JVM or BEAM?
    - syrusakbary 7y ago
      JVM requires almost all your stack to be rewritten for it. Because WebAssembly permits languages to be usable in the web, almost any other language (C, C++, Rust, Go and even Java) is now working to be compiled to WebAssembly. Therefore you don’t need to adapt your stack to run it in Wasmer :)
      - gravypod 7y ago
        > "JVM requires almost all your stack to be rewritten for it." This applies no more to the JVM than to Wasmer. There exists WASM to JVM bytecode transpilers [0]. [0] - https://github.com/cretz/asmble https://github.com/cretz/asmble
roca 7y ago
Wasmer looks cool but FWIW it wouldn't address our (OP) needs. For one thing, in our containers we dynamically generate x86 machine code and execute it (yes, it has to be x86). Our needs are a bit special of course.
techntoke 7y ago
Some things to note: - Wasmer isn't available as a package on most distros from what I can tell. Instead they want you to curl a script directly to your shell, which is bad practice. - They do not have a reproducible benchmark or a test suite to prove that it is actually faster than Docker and it is likely you can't even compare them. The Docker daemon and containers generally have very fast startup times. - Docker containers are OS independent as well, but rely on Linux kernel features so they run more native on Linux. This isn't a negative. Most microservice apps are Linux-based. - Adding abstractions for the chipset has always been slower than optimizing and compiling for multiple architectures. This is like someone saying Java is better because it provides a VM that translates everything. Instead Java has a reputation for being clunky and slow because of it. Well built apps and pipelines can easily be compiled for multiple architectures. See Alpine Linux for example.
jdnenej 7y ago
This sounds like a great idea. Docker on ARM is such a pain if you aren't building everything yourself because half the packages are x86 only
- geerlingguy 7y ago
  More than half, I’d say 90%.

scanr 7y ago

Wasmer looks interesting. I couldn’t read much as I get an “unexpected error” as soon as I start scrolling. It does say that it’s not optimised for mobile.

syrusakbary 7y ago
Thanks for reporting it! We will investigate and try to fix it ASAP :) PS: if you could provide your device info (os and browser) it would be awesome
- jackalo 7y ago
  The black terminal next to the “Try It Now” remains blank while the cursor box zooms around it. No visible text is seen. iPhone XS Max, iOS 13 GM, Safari.
- yoz 7y ago
  Also seeing it on an iPhone 8, iOS 12.4. The site is completely unusable/unreadable.

anaphor 7y ago

One thing I also find sorely lacking in Docker is the ability to run your containers with the appropriate seccomp privileges (in order to enforce Principle of Least Authority). I know this is possible with Docker, but it's not really done much in practice because of various difficulties. I wonder how difficult it would be to do that with your tool?

syrusakbary 7y ago
Since Wasmer is in control of all the syscalls its actually quite easy to manage the privileges in a more fine-grained way (think on CloudABI permissions on top of your containers)
- anaphor 7y ago
  That sounds really interesting. I'm going to check it out. Thanks for working on this!
nwmcsween 7y ago
Seccomp is a horrible security model for containers, if the application or it's libraries use differing syscalls the seccomp ruleset is invalid
- pbar 7y ago
  A process making a system call to the kernel functions the same way regardless of whether it is in a container or not. How exactly does the security model differ at all?
  - nwmcsween 7y ago
    Because 99.9% of software doesn't make use of direct syscalls, instead it uses wrappers or standard functions that wrap various other syscalls that can and will change over time. Meaning $app_container v0.1 can and probably will have a different seccomp filter than $app_container v0.2
    - pbar 7y ago
      This is the same case regardless of being in a container or not, $app v0.1 and $app v0.2 will have different filters
      - nwmcsween 7y ago

ctidd 7y ago

Looks like an interesting project. I know the website isn't responsive, but adjusting the current meta viewport declaration would go a long way while you're working on a full solution. The minimum zoom of 1 makes it unusable in practice right now on a small mobile viewport due to the amount of panning it forces you to do.

gravypod 7y ago

Is there a feature by feature comparison of wasmer to docker? I don't think Wasmer, while interesting, is a container system. It looks more like a bytecode vm. Things I use and love from docker that to me feel "container"-y: 1. OSs as a library (FROM alpine:3.9) 2. Network namespaces so all applications think they are running on a machine with port 80 available 3. Service discovery through DNS 4. CPU and memory share allocation 5. Volumes (bind, temporary, remote) 6. docker-compose for single-command & single-tool development environments (all you need is docker and an internet connection)

syrusakbary 7y ago
Wasmer is an application-based container while Docker is a OS-based container. Because of that some of the things that you posted are a bit hard to compare. We believe that by having a VM (based on a industry adopted specification such as WebAssembly) we can control much more granularly both execution (CPU, memory) and the runtime interoperability with the system (networking, file system, ...), solving most of the issues that Docker containers have
- ahnick 7y ago
  What's the selling point of Wasmer over the JVM or BEAM?
  - syrusakbary 7y ago
    JVM requires almost all your stack to be rewritten for it. Because WebAssembly permits languages to be usable in the web, almost any other language (C, C++, Rust, Go and even Java) is now working to be compiled to WebAssembly. Therefore you don’t need to adapt your stack to run it in Wasmer :)
    - gravypod 7y ago
      > "JVM requires almost all your stack to be rewritten for it." This applies no more to the JVM than to Wasmer. There exists WASM to JVM bytecode transpilers [0]. [0] - https://github.com/cretz/asmble https://github.com/cretz/asmble

roca 7y ago

Wasmer looks cool but FWIW it wouldn't address our (OP) needs. For one thing, in our containers we dynamically generate x86 machine code and execute it (yes, it has to be x86). Our needs are a bit special of course.

techntoke 7y ago

Some things to note: - Wasmer isn't available as a package on most distros from what I can tell. Instead they want you to curl a script directly to your shell, which is bad practice. - They do not have a reproducible benchmark or a test suite to prove that it is actually faster than Docker and it is likely you can't even compare them. The Docker daemon and containers generally have very fast startup times. - Docker containers are OS independent as well, but rely on Linux kernel features so they run more native on Linux. This isn't a negative. Most microservice apps are Linux-based. - Adding abstractions for the chipset has always been slower than optimizing and compiling for multiple architectures. This is like someone saying Java is better because it provides a VM that translates everything. Instead Java has a reputation for being clunky and slow because of it. Well built apps and pipelines can easily be compiled for multiple architectures. See Alpine Linux for example.

jdnenej 7y ago

This sounds like a great idea. Docker on ARM is such a pain if you aren't building everything yourself because half the packages are x86 only

geerlingguy 7y ago
More than half, I’d say 90%.