8 ms·

mod_wasm: Run WebAssembly with Apache

124 points by ereslibre 4y ago

MR4D 4y ago
So, is this like mod_CGI, but more modern technology?
- encryptluks2 4y ago
  WASM isn't more more "modern", it is just being hyped up because it caters to the JS developers.
  - tracker1 4y ago
    You have that exactly backwards... WASM allows you to build in whatever language you like and target portable operation that includes a browser.
    - encryptluks2 4y ago
      GoReleaser and Cargo do that already. Cross-compilation is nothing new.
      - atahanacar 4y ago
        I think there is a difference between "compile once, run everywhere" and "code once, compile (for) everywhere".
        encryptluks2 4y ago
        Well, one the developers are smart enough to create optimized packages for each architecture but instead if they wanted to cater to bad practice JS fans they could create a universal binary.
        tracker1 4y ago
        Yeah sandbox security and isolated runtimes are horrible and all.
        encryptluks2 4y ago
        Those already exist without WASM
        tracker1 4y ago
        And portability without recompile or negotiating different delivery for different targets, and being able to run in a common browser that nearly every user connected internet capable device already has.
  - int_19h 4y ago
    WASM is basically a way to deliver the old JVM promise of "compiled once, run everywhere, sandbox if needed", with the additional constraint of "close-to-native performance" and "any language can compile down to it". It's a good thing if it delivers on all those promises. And it's especially a good thing if you don't like JS, because it's our best shot at dethroning JS.
    - encryptluks2 4y ago
      I think Cargo and GoReleaser already make this simple enough. Heck, even Alpine Linux has down the process of compiling for multiple architectures for multiple languages. It really isn't that much of a challenge to do so and there are already sandboxing solutions for each operating system. WASM doesn't get rid of JS, it just puts sandboxing into a JS-based engine. The last thing people should want is to run binary blobs in your browsers which is exactly what it does. The same browsers who gladly trade privacy at ever iteration. Might as well just go publish your browsing history online cause that is where this will lead.
      - int_19h 4y ago
        Wasm doesn't get rid of JS in the browsers right away (but long-term I suspect that JS is going to be implemented on top of wasm). Wasm itself is not JS-based tho, as evidenced by all the standalone wasm runtimes. And it's not any more or less transparent than a minified blob of JS.
ereslibre 4y ago
Apache httpd is a modular web server that powers 31% of all websites you access every day. One of its most compelling features is the ability to extend it with new modules. Developers can choose among different modules to add or remove features like CGI, TLS, PHP, and many others. Today, we announce a new Apache module to run WebAssembly modules: mod_wasm. This module opens a new set of possibilities as many languages and projects can run securely in Apache.
gzurl 4y ago
https://github.com/vmware-labs/mod_wasm https://github.com/vmware-labs/mod_wasm
ofrzeta 4y ago
so .. OCTO is the Office of the CTO at VMware.
api 4y ago
WASM is still too unapproachable. I've looked into how to build things for WASI/WASM and it seems like you're just dropped into this world of tooling and development practices that I'm sure makes tons of sense to people who are already steeped in the WASM ecosystem but is disorienting for someone new. WASM really needs some getting started guides that describe what the hell is going on and what the capabilities and limitations are and how to... well... get started.
- angelmm 4y ago
  Hey, dev here :) Totally agree with you. WebAssembly has a lot of potential, but currently the entry barries is quite high and for some use cases, it's not mature enough. As you mention, tooling is unclear, and the ecosystem misses important features such as debugging capabilities. However, at the same it's an exciting ecosystem for the same reason: there's a lot to explore and improve. Hopefully, these projects we are building gathers the interest from different communities and more people start adding ideas. And for future ideas, what would you like to be covered in an article about WebAssembly? Thanks!
- jillesvangurp 4y ago
  I think you need to look at the WASM documentation for specific languages rather than generic wasm. For example Rust has decent documentation for this. The tools and instructions are going to be language specific.
- tehbeard 4y ago
  Another issue is host environment interop. All the tooling seems geared to outputting "glue code" as typescript or javascript, and I've yet to find any real documentation on if it's even possible to do so for other languages without massive amounts of manual work. So my initial elation at finding a warm extension for php (wasmer-php), which would let us bolt in secure, sandboxed scripting languages for customer projects... Is now on the back burner as while it can run some example wasm, anything made with wasi or emscriptem is unusable.
politelemon 4y ago
I struggle to understand wasm, though I'm interested. What does this part mean? > Internally, it uses the wasmtime runtime to configure, initialize, and run the Wasm modules. What is wasmtime? I looked at its page and couldn't figure out what they mean by a wasm runtime. I thought the runtime was in the browser. Wouldn't a user just need to compile and just a binary?
- lbhdc 4y ago
  It is a runtime for wasm. Wasm is not executable in the same way an x86 binary is. It needs to run in a vm. Wasmtime is one such vm. In a browser context that vm is v8. https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime
  - egberts1 4y ago
    Or for Firefox, SpiderMonkey JIT. V8 is a chrome-specific thingie.
- callahad 4y ago
  > I thought the runtime was in the browser. It can be both! Like JavaScript, WebAssembly started in the browser but is now moving to the server-side, too. With JavaScript, the most common serverside runtime is Node.js. With WebAssembly, it's Wasmtime. There are alternatives (like Deno or Bun for serverside JavaScript), but Wasmtime is the main one at the moment.
  - politelemon 4y ago
    Thanks the NodeJS analogy helps me.
- pdpi 4y ago
  Easiest comparison is the JVM. You can run Java wherever you have a JVM, be it the browser or the server or a desktop application. WASM is basically the moral equivalent of JVM bytecode, so you need the moral equivalent of the JVM to run it. While all major browsers have wasm support (the wasm "JVM") as part of their javascript stack, there's also standalone wasm runtimes, with wasmtime being one of those.
MobiusHorizons 4y ago
What is the actual problem this is trying to solve? Are there programming languages it was previously hard to write web apps in? Do people not like setting up nginx? From my understanding the benefit of wasm on the server side is generally that you get the sandboxing inherent in the VM. Why would you want that in the context of Apache? Are people planning on running untrusted code? If mod_wasm is designed to address any of those issues (which are touched on only briefly in the article), it would be nice for it to describe how using wasm improves over other techniques one might use to solve those problems like using containers or VMs for encapsulating the execution environment.
- moralestapia 4y ago
  Two types of developers I guess. ¯\_(ツ)_/¯ I think this has a bright future ahead: * wasm has a lot of traction, just yesterday I wrote a first test on deploying wasm to cloudflare workers (the latency when the deployed function was really low) * apache httpd is still one of the most used http servers in the wild So, I think it's just a natural fit. wasm will be huge, btw, if you haven't noticed that you haven't been paying attention.
- colordrops 4y ago
  One of the reasons PHP gained so much traction was because it is very easy to deploy and run, no dependency hell. WASM is self-contained and has the same property.
  - egberts1 4y ago
    Now it is the battle of keeping the zillions of JavaScript packages vs PHP packages up … to … date. I think WASM may have bigger problems with external vulnerability assessment team identifying those modules by version that got broken.
    - _joel 4y ago
      I don't think they're different issues in terms of solution, important, of course.
skibz 4y ago
Does nginx have any (third-party?) modules that are roughly equivalent to this?
- joecot 4y ago
  wasm-nginx-module https://wasmedge.org/book/en/use_cases/frameworks/mesh/wasm-nginx-module.html https://wasmedge.org/book/en/use_cases/frameworks/mesh/wasm-...
  - VWWHFSfQ 4y ago
    So it requires the nginx Lua module which is then used to load the wasm blobs? what a weird module. So somehow this thing is going through at least 2 or 3 different VMs (LuaJIT + WASI) so that you can eventually run your Python script in nginx...
NoGravitas 4y ago
sdze 4y ago
Is that the same shared nothing architecture just like when I am invoking a php script via cgi call or mod-php?
baby 4y ago
I always found it uber cumbersome to deal with apache to setup different webservers with different domains and different stacks (php, golang, node, etc.) on a linux server. I’ve been doing it for more than 10 years and I still hate it and I’m still quite lost in the commands I need to run, the folders and files and cfgs I need to maintain. Am I just a linux noob and this is completely normal user experience?
- BeefWellington 4y ago
  Apache itself is eminently manageable on its own; IMO the real issue is how insanely over-complicated and opinionated every distribution makes their configuration. I tend to discard any given distribution's default configuration for a more simplistic one where httpd.conf is the source of truth. This is very simple for 90% of my use cases, and for the other 10% I can adopt of a "modules-enabled, sites-enabled, conf-enabled, kitchen-sink-enabled" type approach.
- orev 4y ago
  The biggest problem with Apache httpd is how many awful copy/paste blogs there are out there telling you how to do things on Ubuntu, which has no resemblance at all to actually managing httpd. Everything explains how to use some silly wrapper script like a2enmod to do something when all you really need is to make a symlink or something like that. IMO, the Ubuntu method of managing httpd could easily be responsible for why so many people think nginx is easier. Use a RHEL based system and manually edit the files yourself. It’s very easy.
d883kd8 4y ago
Does this mean I could write a web api in Rust and deploy it to e.g. Hostgator or Bluehost?
- yjftsjthsd-h 4y ago
  It would still require the host to have the module installed, right? That might come to be common, but it is a requirement that I don't expect everyone to decide to implement

124 points by ereslibre 4y ago

MR4D 4y ago

So, is this like mod_CGI, but more modern technology?

encryptluks2 4y ago
WASM isn't more more "modern", it is just being hyped up because it caters to the JS developers.
- tracker1 4y ago
  You have that exactly backwards... WASM allows you to build in whatever language you like and target portable operation that includes a browser.
  - encryptluks2 4y ago
    GoReleaser and Cargo do that already. Cross-compilation is nothing new.
    - atahanacar 4y ago
      I think there is a difference between "compile once, run everywhere" and "code once, compile (for) everywhere".
      - encryptluks2 4y ago
        Well, one the developers are smart enough to create optimized packages for each architecture but instead if they wanted to cater to bad practice JS fans they could create a universal binary.
        tracker1 4y ago
        Yeah sandbox security and isolated runtimes are horrible and all.
        encryptluks2 4y ago
        Those already exist without WASM
        tracker1 4y ago
        And portability without recompile or negotiating different delivery for different targets, and being able to run in a common browser that nearly every user connected internet capable device already has.
- int_19h 4y ago
  WASM is basically a way to deliver the old JVM promise of "compiled once, run everywhere, sandbox if needed", with the additional constraint of "close-to-native performance" and "any language can compile down to it". It's a good thing if it delivers on all those promises. And it's especially a good thing if you don't like JS, because it's our best shot at dethroning JS.
  - encryptluks2 4y ago
    I think Cargo and GoReleaser already make this simple enough. Heck, even Alpine Linux has down the process of compiling for multiple architectures for multiple languages. It really isn't that much of a challenge to do so and there are already sandboxing solutions for each operating system. WASM doesn't get rid of JS, it just puts sandboxing into a JS-based engine. The last thing people should want is to run binary blobs in your browsers which is exactly what it does. The same browsers who gladly trade privacy at ever iteration. Might as well just go publish your browsing history online cause that is where this will lead.
    - int_19h 4y ago
      Wasm doesn't get rid of JS in the browsers right away (but long-term I suspect that JS is going to be implemented on top of wasm). Wasm itself is not JS-based tho, as evidenced by all the standalone wasm runtimes. And it's not any more or less transparent than a minified blob of JS.

ereslibre 4y ago

Apache httpd is a modular web server that powers 31% of all websites you access every day. One of its most compelling features is the ability to extend it with new modules. Developers can choose among different modules to add or remove features like CGI, TLS, PHP, and many others. Today, we announce a new Apache module to run WebAssembly modules: mod_wasm. This module opens a new set of possibilities as many languages and projects can run securely in Apache.

gzurl 4y ago

https://github.com/vmware-labs/mod_wasm https://github.com/vmware-labs/mod_wasm

ofrzeta 4y ago

so .. OCTO is the Office of the CTO at VMware.

api 4y ago

WASM is still too unapproachable. I've looked into how to build things for WASI/WASM and it seems like you're just dropped into this world of tooling and development practices that I'm sure makes tons of sense to people who are already steeped in the WASM ecosystem but is disorienting for someone new. WASM really needs some getting started guides that describe what the hell is going on and what the capabilities and limitations are and how to... well... get started.

angelmm 4y ago
Hey, dev here :) Totally agree with you. WebAssembly has a lot of potential, but currently the entry barries is quite high and for some use cases, it's not mature enough. As you mention, tooling is unclear, and the ecosystem misses important features such as debugging capabilities. However, at the same it's an exciting ecosystem for the same reason: there's a lot to explore and improve. Hopefully, these projects we are building gathers the interest from different communities and more people start adding ideas. And for future ideas, what would you like to be covered in an article about WebAssembly? Thanks!
jillesvangurp 4y ago
I think you need to look at the WASM documentation for specific languages rather than generic wasm. For example Rust has decent documentation for this. The tools and instructions are going to be language specific.
tehbeard 4y ago
Another issue is host environment interop. All the tooling seems geared to outputting "glue code" as typescript or javascript, and I've yet to find any real documentation on if it's even possible to do so for other languages without massive amounts of manual work. So my initial elation at finding a warm extension for php (wasmer-php), which would let us bolt in secure, sandboxed scripting languages for customer projects... Is now on the back burner as while it can run some example wasm, anything made with wasi or emscriptem is unusable.

politelemon 4y ago

I struggle to understand wasm, though I'm interested. What does this part mean? > Internally, it uses the wasmtime runtime to configure, initialize, and run the Wasm modules. What is wasmtime? I looked at its page and couldn't figure out what they mean by a wasm runtime. I thought the runtime was in the browser. Wouldn't a user just need to compile and just a binary?

lbhdc 4y ago
It is a runtime for wasm. Wasm is not executable in the same way an x86 binary is. It needs to run in a vm. Wasmtime is one such vm. In a browser context that vm is v8. https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime
- egberts1 4y ago
  Or for Firefox, SpiderMonkey JIT. V8 is a chrome-specific thingie.
callahad 4y ago
> I thought the runtime was in the browser. It can be both! Like JavaScript, WebAssembly started in the browser but is now moving to the server-side, too. With JavaScript, the most common serverside runtime is Node.js. With WebAssembly, it's Wasmtime. There are alternatives (like Deno or Bun for serverside JavaScript), but Wasmtime is the main one at the moment.
- politelemon 4y ago
  Thanks the NodeJS analogy helps me.
pdpi 4y ago
Easiest comparison is the JVM. You can run Java wherever you have a JVM, be it the browser or the server or a desktop application. WASM is basically the moral equivalent of JVM bytecode, so you need the moral equivalent of the JVM to run it. While all major browsers have wasm support (the wasm "JVM") as part of their javascript stack, there's also standalone wasm runtimes, with wasmtime being one of those.

MobiusHorizons 4y ago

What is the actual problem this is trying to solve? Are there programming languages it was previously hard to write web apps in? Do people not like setting up nginx? From my understanding the benefit of wasm on the server side is generally that you get the sandboxing inherent in the VM. Why would you want that in the context of Apache? Are people planning on running untrusted code? If mod_wasm is designed to address any of those issues (which are touched on only briefly in the article), it would be nice for it to describe how using wasm improves over other techniques one might use to solve those problems like using containers or VMs for encapsulating the execution environment.

moralestapia 4y ago
Two types of developers I guess. ¯\_(ツ)_/¯ I think this has a bright future ahead: * wasm has a lot of traction, just yesterday I wrote a first test on deploying wasm to cloudflare workers (the latency when the deployed function was really low) * apache httpd is still one of the most used http servers in the wild So, I think it's just a natural fit. wasm will be huge, btw, if you haven't noticed that you haven't been paying attention.
colordrops 4y ago
One of the reasons PHP gained so much traction was because it is very easy to deploy and run, no dependency hell. WASM is self-contained and has the same property.
- egberts1 4y ago
  Now it is the battle of keeping the zillions of JavaScript packages vs PHP packages up … to … date. I think WASM may have bigger problems with external vulnerability assessment team identifying those modules by version that got broken.
  - _joel 4y ago
    I don't think they're different issues in terms of solution, important, of course.

skibz 4y ago

Does nginx have any (third-party?) modules that are roughly equivalent to this?

joecot 4y ago
wasm-nginx-module https://wasmedge.org/book/en/use_cases/frameworks/mesh/wasm-nginx-module.html https://wasmedge.org/book/en/use_cases/frameworks/mesh/wasm-...
- VWWHFSfQ 4y ago
  So it requires the nginx Lua module which is then used to load the wasm blobs? what a weird module. So somehow this thing is going through at least 2 or 3 different VMs (LuaJIT + WASI) so that you can eventually run your Python script in nginx...

NoGravitas 4y ago

sdze 4y ago

Is that the same shared nothing architecture just like when I am invoking a php script via cgi call or mod-php?

baby 4y ago

I always found it uber cumbersome to deal with apache to setup different webservers with different domains and different stacks (php, golang, node, etc.) on a linux server. I’ve been doing it for more than 10 years and I still hate it and I’m still quite lost in the commands I need to run, the folders and files and cfgs I need to maintain. Am I just a linux noob and this is completely normal user experience?

BeefWellington 4y ago
Apache itself is eminently manageable on its own; IMO the real issue is how insanely over-complicated and opinionated every distribution makes their configuration. I tend to discard any given distribution's default configuration for a more simplistic one where httpd.conf is the source of truth. This is very simple for 90% of my use cases, and for the other 10% I can adopt of a "modules-enabled, sites-enabled, conf-enabled, kitchen-sink-enabled" type approach.
orev 4y ago
The biggest problem with Apache httpd is how many awful copy/paste blogs there are out there telling you how to do things on Ubuntu, which has no resemblance at all to actually managing httpd. Everything explains how to use some silly wrapper script like a2enmod to do something when all you really need is to make a symlink or something like that. IMO, the Ubuntu method of managing httpd could easily be responsible for why so many people think nginx is easier. Use a RHEL based system and manually edit the files yourself. It’s very easy.

d883kd8 4y ago

Does this mean I could write a web api in Rust and deploy it to e.g. Hostgator or Bluehost?

yjftsjthsd-h 4y ago
It would still require the host to have the module installed, right? That might come to be common, but it is a requirement that I don't expect everyone to decide to implement