13 ms·
WebVM: Server-less x86 virtual machines in the browser
- apignotti 5y agoHello HN, author of the post here, happy to answer questions.
- brian_herman 5y agoHow does this compare to https://bellard.org/jslinux/tech.html https://bellard.org/jslinux/tech.html? https://bellard.org/jslinux/ https://bellard.org/jslinux/
- easrng 5y agoAnd also https://copy.sh/v86 https://copy.sh/v86
- remisharrock 5y agoAnd jor1k (JavaScript openrisc processor emulator) : well, they emulate processors (x86, openrisc..) in JavaScript while WebVM execute (transpiled?) code in webassembly
- g3 5y agov86 also recompiles machine code to web assembly. The main difference is that v86 is a hobby project (of which I'm the original author, by the way), with much fewer contributors and no (known) commercial users, and is much less sophisticated than this project. On the other hand, v86 is open source, so you could make it sophisticated if you wanted to :-) I'm not sure what exactly cheerps is used for; v86 is mostly used to demo operating systems (mostly hobby and vintage). We recently got SerenityOS to run: http://copy.sh/v86/?profile=serenity http://copy.sh/v86/?profile=serenity
- apignotti 5y agoPerf. Our JIT is extremely advanced. Of course different workloads will behave differently, but you are welcome to try multiple payloads and see for yourselves.
- mhh__ 5y agoWhat constitutes advanced?
- easrng 5y agoIs there support for loopback networking (for IPC)? Is there a way to translate HTTP(S) requests to `fetch` requests? How difficult would it be to port a Go app that uses https://github.com/pion/webrtc https://github.com/pion/webrtc to use the browser's native WebRTC?
- apignotti 5y agoHTTP request could be intercepted, but due to CORS they would most likely not succeed. I have not studied the WebRTC protocol in detail but it might be possible.
- habitue 5y agoCan you run containers in webvm?
- deleted 5y ago[deleted]
- remisharrock 5y agoWill you open source your code one day and if no, why not?
- xmly 5y agoHow about the network stack? Is the VM can talk with other VMs from other browsers.
- apignotti 5y agoNot in the current implementation, but absolutely possible with WebRTC. We have done something equivalent some time ago: https://medium.com/p/29fbbc62c5ca https://medium.com/p/29fbbc62c5ca
- tlarkworthy 5y agoI have REDIS driver working in web using websockify bridges (and there are a few other options) https://observablehq.com/@tomlarkworthy/redis https://observablehq.com/@tomlarkworthy/redis
- Klasiaster 5y agoSo, this is a reimplementation of the Linux ABI and no Linux kernel source is involved, right?
- apignotti 5y agoThat's correct.
- Klasiaster 5y agoHave you tried compiling Linux as User Mode Linux with emscripten? I imagine something like this https://github.com/nabla-containers/nabla-linux https://github.com/nabla-containers/nabla-linux would run on wasm, too?
- apignotti 5y agoWell, User Mode Linux would still require an underlying Linux ABI, for example mmap to implement pagination. With sufficient work it might be possible to actually run UM Linux _on top_ of CheerpX / WebVM. Implementing the Linux ABI ourselves gives us the opportunity of a tighter integration with the Web platform anyway.
- btdmaster 5y agoIt seems to not work with my eager block settings. It works with a fresh Firefox profile though, so it's not clear what the issue exactly is though. I know for sure that the ext2 is never actually downloaded (0 byte response) and when I try to check anything in DevTools cxcore.wasm triggers a pause on debugger statement, which spikes the CPU. Any chance there could be a version with all the assets in one thing (say, GitHub Pages)?
- thekozmo 5y agoImpressive stuff! Worth to try to run the OSv unikernel (one of my babies) in it.
- arturventura 5y agoHey dude, I've been screwing around implementing plan9 semantics in a OS like system for the browser (https://github.com/intigos/possimpible https://github.com/intigos/possimpible). I'm interested in using a x86 emulator inside a webwoker that I'm using for processes so I can run x86 code. How hard is something like this? Can you give me some pointers on how to start working on this? Thanks!
- PeterisP 5y agoIs this tech a reasonable way for cross-platform emulation, e.g. a x86 VM running on a browser on ARM hardware like the new Apple chips? In essence, for this approach, would the x86-on-x86 performance hit be similar or very different than the x86-on-ARM performance hit?
- apignotti 5y agoThe actual host hardware does not matter, neither in terms of support or performance, theoretically. We currently optimize the codegen for Chrome/V8 on x86.
- bonzini 5y agoWhat performance bottlenecks are there that can still be improved? Right now I see a ~6x slowdown on small-code benchmarks like sieve, but it goes up to 50x or more for large code like GCC. For QEMU it's roughly 1.6x and 2-3x respectively, so it seems like your JIT is slower than QEMU's.
- dnautics 5y agowe are well on the way towards the death of yavascript, let's hope there the exclusion zone doesn't come true.
- 0x138d5 5y agoThe 5 year war seems mighty close though. One or two parallel universes away maybe.
- maltenuhn 5y agoNice! How does this compare to Web Containers (https://blog.stackblitz.com/posts/introducing-webcontainers/ https://blog.stackblitz.com/posts/introducing-webcontainers/, proprietary to Stackblitz)?
- remisharrock 5y agoFrom what I read on their website, web containers cannot run Linux binaries or compile c code or run python scripts / bash etc. - for example?
- westurner 5y agoIs WebVM a potential solution to "JupyterLite doesn't have a bash/zsh shell"? The current pyodide CPython Jupyter kernel takes like ~25s to start at present, and can load Python packages precompiled to WASM or unmodified Python packages with micropip: https://pyodide.org/en/latest/usage/loading-packages.html#loading-packages https://pyodide.org/en/latest/usage/loading-packages.html#lo... Does WebVM solve for workload transparency, CPU overutilization by one tab, or end-to-end code signing maybe with W3C ld-proofs and whichever future-proof signature algorithm with a URL?
- miohtama 5y agoThe VM cannot have full TCP/IP stack, so any data research tasks are likely to need a special code paths and support for downloads. No SQL databases, etc.
- Klasiaster 5y agoThe VM could have its own TCP/IP stack, possibly with a SLIRP layer for translation of connections to the outside. Internet connectivity can be done by limiting it to AJAX, or forwarding the packets to a proxy (something like http://artemyankov.com/tcp-client-for-browsers/ http://artemyankov.com/tcp-client-for-browsers/), or including a Tor client that connects to a Tor bridge, etc.
- westurner 5y agoIs all of that necessary to LD_PRELOAD sockets and tunnel them over WebSockets, WebRTC, etc? So e.g. curl doesn't work without (File System Access API,) local storage && translation of e.g. at least normal curl syscalls to just HTTP/3?
- westurner 5y agoFrom "Hosting SQLite Databases on GitHub Pages" https://news.ycombinator.com/item?id=28021766 https://news.ycombinator.com/item?id=28021766 https://westurner.github.io/hnlog/#comment-28021766 https://westurner.github.io/hnlog/#comment-28021766 : DuckDB can query [and page] Parquet from GitHub, sql.js-httpvfs, sqltorrent, File System Access API (Chrome only so far; IDK about resource quotas and multi-GB datasets), serverless search with WASM workers https://github.com/phiresky/sql.js-httpvfs https://github.com/phiresky/sql.js-httpvfs : > sql.js is a light wrapper around SQLite compiled with EMScripten for use in the browser (client-side). > This [sql.js-httpvfs] repo is a fork of and wrapper around sql.js to provide a read-only HTTP-Range-request based virtual file system for SQLite. It allows hosting an SQLite database on a static file hoster and querying that database from the browser without fully downloading it. > The virtual file system is an emscripten filesystem with some "smart" logic to accelerate fetching with virtual read heads that speed up when sequential data is fetched. It could also be useful to other applications, the code is in lazyFile.ts. It might also be useful to implement this lazy fetching as an SQLite VFS [*] since then SQLite could be compiled with e.g. WASI SDK without relying on all the emscripten OS emulation.
- didip 5y agoI always wonder if someone will eventually put Docker container up on the browser. It will make tons of experimentation work easy.
- mrtesthah 5y agois this some kind of joke to make computing as slow as possible?
- emteycz 5y agoSome people don't care that it's slow. Availability and uniformity is much more valuable for example in school environment, especially at one where they teach IT one hour per week and the teacher is not really a programmer themselves.
- geuis 5y agoYes but... The more likely case is you get corporate and military clients who adopt this for security (ya know, load a known 0-state image) to check email (which is loading some old version of outlook from the image), and it ends up taking the entire workday before you can briefly use your system. Basically giving a take on the recent https://www.airforcemag.com/fix-my-computer-cry-echos-on-social-media-air-force-cio-responds/ https://www.airforcemag.com/fix-my-computer-cry-echos-on-soc...
- emteycz 5y agoI don't care about them. If they wan't to wait for an e-mail all day, it's their problem. I won't hate this technology just because some users of it are dumb.
- didip 5y agoI can see why running Docker daemon on the browser can be seen as excessive. But running docker container does not need to use dockerd. One can flatten the filesystem and have systemd run the container directly.
- mahoro 5y agoWow, this is amazing! Now we could create a /dev/dom virtual device, and write dynamic web pages in pure bash. I love this.
- deleted 5y ago[deleted]
- colejohnson66 5y agoOr a DOMFS in /dom that's organized in the same hierarchy as the browser DOM. For example, to write a whole page: echo "...." > /dom Update the <title> tag: echo "TITLE" > /dom/html/head/title Change the charset: echo "EBCDIC" > /dom/html/head/meta[1].charset // second <meta> tag echo "EBCDIC" > /dom/html/head/1.charset // second child of <head> Even go full XPath and replace a tag's inner HTML: echo "<div>abc</div>" > /dom/[@id='myID'] This is a horrible idea...
- eurasiantiger 5y agoOracle Acquisitions team would like to discuss a business transaction.
- antocv 5y agoThis comment is worse and more horrible than the parent.
- asplake 5y agoXPath? What's wrong with the find command?
- colejohnson66 5y agoThe way I envisioned it was that attributes are also files themselves, and the contents contain the values. So: // given: <div id="myID"> // `id` attribute is located in /dom/html/body/…/div[n].id So unless you look at the contents of the files, you wouldn’t be able to find a certain ID. Because of that, DOMFS (when XPath is enabled) would expose that same "file" at `/dom/[@id='myID']` as well. I guess you could do something like this? grep "myID" /dev/**/*.id But why would you even use this “DOMFS”?
- syrusakbary 5y agoThis is awesome. Really. Props to all the Leaning Tech team (creators of Cheerp, an alternative to Emscripten)! I believe it will be possible to achieve similar state in the future just using Native Wasm/WASI (so no transpilation from x86 -> Wasm will be needed), but we are far from it given how slow the WASI standards move. The shell is impressive: https://webvm.io/ https://webvm.io/ (only downloads ~5Mb of resources for a full Debian distro)
- apignotti 5y agoThanks, appreciated. By the way, it's spelled "Cheerp", with a lowercase p :-)
- syrusakbary 5y agoCorrected!
- williamstein 5y agoThe JIT compilation to WebAssembly they are doing with WebVM is pretty cool! I didn't see any benchmarks on the linked to page. I tried their sample Fibonacci program, but up to 100000 and ONLY timing actual execution (using the time Python module) to not include startup time, and WebVM only took 6.7 times as long as native for me. That's very impressive. There's a similar open source project called https://copy.sh/v86/ https://copy.sh/v86/. Using their arch Linux image with the exact same Fibonacci benchmark, it take 44 times as long as native.
- syrusakbary 5y agoThanks for the benchmarks! I was curious about timing. Python is also a bit tricky because it does things with pointers that I believe are hard to optimize (or maybe not, who knows!). Have you tried other languages/programs?
- Recursing 5y agoAs a smoke test, I tried running `time python3 -c 'print(max(range(2*10**7)))'` It's about ~10x faster on webvm.io compared to copy.sh/v86 and only ~20x slower than native, impressive stuff
- hughrr 5y ago20x slower than native suggests this solution has its own ozone layer hole.
- benou 5y agoI timed a very simple loop in C: "for (volatile int i=0; i<N; i++);" (handful of arithmetic, compare and branch instructions) with N=1e9 and it was 70% the speed of native which looks really good. I'd love to see LINPACK now :)
- syrusakbary 5y agoThinking more about this. I'd love to try v8 there, so we can benchmark the WebVM v8 against the Native JS in the browser... all using the same engine (is a bit meta, isn't it?)
- bkyan 5y agoHow do you move files into or out of this VM?
- endisneigh 5y agoWhat needs to happen to enable the browser to act as a functioning web server?
- mrtesthah 5y agoUse Opera? https://www.ctrl.blog/entry/opera-unite.html https://www.ctrl.blog/entry/opera-unite.html
- apignotti 5y agoIt depends on the definition of "functioning". If you'd like to access a server from another tab / iframe of the same browser, that's almost possible already, just some UX work would be required. If you'd like users of the same page (or a separate specialized page) to connect, that could be possible with WebRTC. If you'd like arbitrary hosts to connect, that would require a server side proxy, there is no client-side only solution that I can see,
- tlarkworthy 5y agoI have it working here https://webcode.run https://webcode.run
- AshleysBrain 5y agoIt's not really a server but you can do some interesting stuff with intercepting fetches in Service Workers, e.g. https://servefolder.dev https://servefolder.dev - a little side project of mine.
- xiphias2 5y agoThis looks awesome. Would it be possible to compile GNU/Linux to WASM as a target platform? What's missing for that?
- s5806533 5y agoTruly an impressive feat, and a lot of work no doubt. But why? Recently it seems to be some kind of fad to demonstrate that everything can be done inside a web browser. Again: why? Scope creep of web browsers is already beyond repair.
- remisharrock 5y agoFor educational uses, I have plenty of use cases for large scale teaching and learning, without backend servers and without installing anything complex on the client side.
- pulse7 5y agoThis is cool if you are running Windows and want to test some Linux command immediately...
- blueflow 5y agoWhy?
- hunterb123 5y agoWhy?
- _57jb 5y agoGotta love the term serverless...on par with fullstack developer. It's either a server somewhere handling tasks in a queue or the client is the server. I hate that we have to care so much about "words" but I've seen far too many walking away with an impression that the server is unimportant or requires little maintenance in this model. I'd argue it becomes even more important because of how persistence, consensus, availability, etc works /rant That being said, always excited to see work coming out of webassembly. Network is the computer
- tiffanyh 5y agoWould love to see Cloudflare support this on Workers
- raggi 5y ago`su` sends the vm into a spin on a single core, is it going to get somewhere? Is there anywhere that documents the covered/uncovered syscall surface?
- zekrioca 5y agoYeah, happened to me as well..
- anonymousiam 5y agoPlayed with it for a minute or two. No network permissions. No sudo. There is a su, but it hangs after entering a password. So probably good for unprivileged non-networking applications.
- iFire 5y agoLicense check without commentary. > Copyright (c) Leaning Technologies Limited. All rights reserved. https://github.com/leaningtech/webvm/commit/6efab7e60bf6f173a24acfb45a7c2f19c6237714#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5R42 https://github.com/leaningtech/webvm/commit/6efab7e60bf6f173...
- parksy 5y agoThe repo doesn't contain the actual distro itself, it appears to be loading CheerPX's virtualisation engine and feeding it a disk image here https://github.com/leaningtech/webvm/blob/6efab7e60bf6f173a24acfb45a7c2f19c6237714/index.html#L239 https://github.com/leaningtech/webvm/blob/6efab7e60bf6f173a2... Assuming they wrote their own xterm interface (no idea if they did, I got as far as that), seems everything open-source is fetched by the client at runtime. This feels to me more like a bootloader than an OS. Not sure where that lands it license-wise whether merely linking to the image requires appropriate licensing and attribution but either way the work seems pretty straightforward to replicate assuming you have / can supply an xterminal-esque interface and can compile your OS image appropriately. I don't think they're doing anything wrong licensing-wise but I guess it depends on how the law defines including software as a library, whether that needs to happen at compile time or run time, or whatever. Seems like a grey area?
- exikyut 5y agoAfter the introductory message I initially saw lots of id: /lib/i386-linux-gnu/libpthread.so.0: unsupported version 0 of Verdef record id: error while loading shared libraries: /lib/i386-linux-gnu/libpthread.so.0: unsupported version 0 of Verneed record bash: [: : integer expression expected which would repeat no matter what command I try to run: user@:~$ ls -l ls: /lib/i386-linux-gnu/libpthread.so.0: unsupported version 0 of Verdef record ls: error while loading shared libraries: /lib/i386-linux-gnu/libpthread.so.0: unsupported version 0 of Verneed record Very curious. Turned out my hitting F5 (because things appeared to have frozen - I assumed resource downloads had hung, I have flaky internet) corrupted the local ext2 filesystem in a way the runtime didn't detect and catch upon reload. That's actually kind of interesting because HTTPS nowadays almost always means authenticated encryption, ie a guarantee that application data has absolutely explicitly not been modified. Thus, correct data was downloaded, but somehow corrupted on its way into IndexedDB, due to my hitting F5. I'm very curious as to why that's happening, but I could only blindly speculate as to why. Considering the bigger picture of the many block requests shown in the devtools, it would seem the ext2 block layer just transmits remote requests for small spans of "exactly what's needed right now", with no buffering or preemptive readahead. Given this runtime's nature as a likely-embedded component running specific bespoke applications (I get the impression this entire product exists solely or largely to run a retargeted version of the Linux Flash player) it is likely possible to optimize this quite effectively. In fact, because of the A (then) B (then) ... (then) N serially blocking nature of the problem space, it could actually be quite straightforward to implement a fairly effective solution: if the block layer were modified to understand "here are the bytes you asked for... please also cache this random unrelated list of chunks to cache as well", the web server could then be modified to aggregate s=...&e=... requests, find correlations between ranges, and then preemptively send data estimated to be relevant for correlations over a certain threshold. If you further modified the client to also implement a tagging system in the cache denoting "directly requested" or "preemptively sent by server (when requesting s=...&e=...)", when application code goes to request a given arbitrary block from disk, if that block turns out to have been preemptively cached and the preemption did indeed save a roundtrip, the runtime could send a pingback to the server to strengthen the relationship between the original request and the followup. (Given that this logic would be running on the server, and this approach provides a reward/feedback signal function, I'm almost tempted to wonder if a small neural network could be interesting to play with here, but it might be overkill.) In any case, I'm 119ms away from the disk CDN... which might help explain my motivation to do the above. My ADSL2+ is hit and miss; today it's doing 6Mbps, give or take (especially for small high-latency transfers which take time to ramp up). The devtools is saying a full reload (clear IndexedDB, hard reload) takes 33.75s. During that time it's entirely hung. Some sort of early-boot progress-bar (an extention of the logic that puts the introductory text on screen?) would probably be a good idea. Maybe extend the runtime with a "userspace reached" opcode (or some sort of equivalent magic noop) called at the very bottom of /etc/bashrc, which hides the progress bar. Lastly, a bit of an awkward problem that is Kind Of Interesting™ but doesn't have any straightforward next steps: while attempting to identify how long a cold start takes here I got into a bit of a fight trying to delete the IndexedDB with the site open. Naturally that didn't go down so well, with the app recovering and auto-recreating the DB. Somewhere in there between closing the tab and trying to reload everything, I realized the browser process had started using 100% CPU, and my laptop was at 94°C. Interestingly, everything was still entirely responsive (indeed the only reason I'm submitting this was because the form autosaver still worked; this was slightly too many butterflies at once to reason about and I completely forgot to save my post text), so I quit Chrome via the menu and... it didn't fully exit (I had to hit ^C twice (I run Chrome from a terminal) to make it fully quit). All the threads shut down but the root browser process was still yelling at my CPU. gdb decided it was stuck in futex_wait_cancelable(). Yay. Apparently the IndexedDB has a few handle leaks in it or something :/.
- suifbwish 5y agoWouldn’t this mean you can host a website in the browser if you run dynamic DNS to connect back to a webserver you have running in the vm on localhost?
- neurostimulant 5y ago> HTTP servers (microservices): By combining Service Workers with virtualized TCP sockets, we will allow HTTP servers inside the WebVM to be reachable from the browser itself. A JavaScript API will be exposed allowing to connect an iframe to the internal servers. This is mostly supported already, although not exposed on the current demo page. A similar solution could be used to support REST microservices as well since Service Workers also handle fetch/XHR requests. I wonder if this can be used to create a semi-decentralized website where visitors automatically served a vm to run, turning them into an edge server to offload requests from other visitors. The more active visitors, the more edge servers you have. Infinite scaling on the cheap! The visitors may not like you abusing their browser though, but there might be use case where this is acceptable, such as popular community run websites that too expensive to run due to huge amount of traffic.
- foota 5y agoI don't see how these could be exposed to another person's browser as an http site, my reading of this is that they are exposed to the user's environment running inside WebVM. To my knowledge the only way that one browser can talk to another is through peer to peer webrtc, but that requires a handshake.
- neurostimulant 5y agoWebsites rendered via websocket instead of http is already possible these days using various frameworks, right (e.g. Phoenix.LiveView)? It might be possible to add webrtc support in addition to websocket for transport. The initial connection is served from a centralized server, just enough to render the initial page and initialized webrtc handshake. After that, subsequent page navigation is handled over webrtc to available peers. The vm will also get downloaded over this channel, turning the visitor into a node to expand the network.
- foota 5y agoYeah, I was thinking about this, but at that point there's not much reason to prefer a vm over just writing a server that's compiled to wasm, if you're going to have to write something that renders via javascript instead of serving http?
- gk1256 5y agoThis is why I love Capitalism and Competition. This is amazing and fantastic.
- gk1256 5y agoThe downvoters are anti capitalists it seems. If you don't like me, don't downvote me, just leave it as it's. I never ever will downvote who loves socialism in HN.
- indigodaddy 5y agoThis would actually be super useful on Chromebook just as an alternative ssh client as I’m not super happy with existing ssh client solutions on Chromebook— especially that chrome ssh extension thingy which sucks pretty hard imo. Note I don’t like to put my Chromebooks in developer mode or do the crouton stuff or whatever the latest is on that front.. EDIT, nm it has no tcp stack or outbound connectivity
- indigodaddy 5y agoEDIT, nm it has no tcp stack or outbound connectivity
- yonixw 5y agoIf you already simulate linux on linux why not transfer TCP over HTTPS over TCP using a tunnel server? https://stackoverflow.com/questions/14080845/tunnel-any-kind-of-tcp-traffic-through-http-s https://stackoverflow.com/questions/14080845/tunnel-any-kind...
- 00000000005 5y ago>>> The web platform is well on its way to becoming the dominant platform for application distribution. Errrr…. yes, “on its way”.
- 5ESS 5y agoNot working on iPhone or iMac M1… not impressed by that..