8 ms·
Wazero: Zero dependency WebAssembly runtime written in Go
- evacchi 3y agoHey I am on the dev team if someone has questions :)
- dilyevsky 3y agoProbably dumb q - are there security implications of using aot for untrusted workloads? Are there plans to do jit?
- evacchi 3y agoIt depends on what you mean for JIT. wazero is load-time AoT; i.e. we compile the module in-memory on load, for efficient execution later, when you instantiate, it is not AoT in the sense that we produce a stand-alone executable, the runtime is always hosting that executable code that is generated, and we go back-and-forth between translated wasm and "Go space" at run-time in many cases. It is AoT in the sense that we do not tune the generated code depending on tracing or profiling information, because we don't track it for compilation. The Wasm model itself gives a certain degree of safety: e.g. you do not have complete control over the host OS, because you have to explicitly expose functions to the gues module; we also provide a certain degree of control over e.g. execution time (you can instantiate a module in such a way that executions can be cancelled or set a timeout) and memory space. We also provide an interpreter for all platforms where Go runs, and Takeshi (the founder of the project) is also working on bootstrapping an optimizing compiler that should soon land on main, and more work will happen in that space.
- circuit10 3y agoJIT/AOT just refers to the time that compilation is done, it doesn’t necessarily have anything to do with security.
- dilyevsky 3y agoIt does when you hadn’t built the .wasm yourself. Example: https://github.com/WasmEdge/WasmEdge/issues/1631 https://github.com/WasmEdge/WasmEdge/issues/1631
- circuit10 3y agoThat’s a bug/oversight in a specific VM implementation. A JIT with a code cache (like V8) could have the same type of bug. It says nothing about about the inherent security of JIT vs AOT
- kouteiheika 3y agoHow does the performance compare to wasmtime or wasmer?
- evacchi 3y agowasmtime and wasmer are basically state-of-the-art. Our compilation backend is a fast, but straightforward translator from wasm to binary (think v8 liftoff vs turbofan), so it's faster than interpreting, but still slower than a well-crafted optimizing compiler. However depending on your use case, that kind of performance may not be everything: e.g. when I/O dominates . The good news is an optimizing backend is being worked on as we speak and should be available very soon :)
- kouteiheika 3y agoI don't suppose you have any concrete benchmark numbers, e.g. coremark? (: Also, how do you sandbox the guest program? Just bounds checks on memory accesses? Do you use the same trick as wasmtime does where they map a ton of inaccessible address space and depend on a SIGSEGV to catch violations? What about potential stack overflows - how do you protect against those?
- evacchi 3y agoso as for the first question, I'll refer to Adrian's reply on an older thread https://news.ycombinator.com/item?id=31415317 https://news.ycombinator.com/item?id=31415317 as for the second, that's an excellent question but I'll have to be honest and tell you that I am the n00b of the team and I don't know the answer :D I can refer you to these possibly related docs - https://github.com/tetratelabs/wazero/blob/main/RATIONALE.md#background-on-moduleconfig-design https://github.com/tetratelabs/wazero/blob/main/RATIONALE.md... - https://wazero.io/docs/how_do_compiler_functions_work/ https://wazero.io/docs/how_do_compiler_functions_work/ (e.g. traps are handled on the Go side) ...and then my awesome team mates might get back to you with a proper answer later when they wake up :^)
- ncruces 3y agoThis is coremark for wazero: https://github.com/ncruces/wazero-coremark https://github.com/ncruces/wazero-coremark Also, there's been some progress since this was published, but results are still mostly valid: https://00f.net/2023/01/04/webassembly-benchmark-2023/ https://00f.net/2023/01/04/webassembly-benchmark-2023/ An optimizing compiler is being worked on; the current single pass compiler compiles fast, but generated code quality is hard to improve.
- verst 3y agoI'm one of the Dapr (Distributed Application Runtime) maintainers which has a wazero based wasm integration. The wazero team contributed this integration. I just wanted to say that the wazero team has done a great job keeping the integration up to date and have been very responsive. For example, our project also supports Linux Arm32 and wazero was initially not testing against that architecture which led to a compile issue for us. Once we pointed this out they fixed this and added this architecture to their CI tests as well. EDIT: Also because our project can be compiled for any common O/S and architecture combination the pure Go implementation is critical. We do not accept use of CGO.
- segphault 3y agoAny plans to support the WebAssembly GC proposal? Binaryen supports GC structs and arrays now, but there aren’t a lot of runtimes that have it yet. It would be cool if Wazero could do it in a way where managed structs can be seamlessly shared across the Wasm/Go boundary using the native Go GC.
- evacchi 3y agoWe are tracking the evolution of most proposals but we are a tiny team so we try to concentrate our efforts on those that have a higher degree of maturity, but I am sure we will at some point :)
- vira28 3y agoWhat are other such web assembly runtimes and how does Wazero compares to those?
- evacchi 3y agoas far as I know wazero is the only zero-dependency Wasm runtime written in Go. This is not just one of those "written in $LANG" kinda deal: most other runtimes require linking against a native library; this in turn plays against a lot of the killer features of Go, such as good tooling, easy cross-compilation, goroutines [0]; so, not requiring Cgo means a team may bring wazero to their Go project without a second thought. As for other features, we may not be as bleeding edge as other projects, but we are a rather tiny team. If you expect support for WASI (preview 1) we have it :) we try to concentrate our effort on high-quality support of stable specs. EDIT: oh, and a huge shout-out to Stealthrocket, they are building a lot of cool stuff on top of wazero: - wzprof, a wasm profiler integrating with pprof https://github.com/stealthrocket/wzprof https://github.com/stealthrocket/wzprof - timecraft, a wasm time-traveling runtime https://github.com/stealthrocket/timecraft https://github.com/stealthrocket/timecraft [0] see "CGO is not Go" https://dave.cheney.net/2016/01/18/cgo-is-not-go https://dave.cheney.net/2016/01/18/cgo-is-not-go
- vira28 3y agoThanks. My question is more of other runtime not specifically about the ones written in Go.
- alecthomas 3y agoThere are a few, but I suspect the most widely used would be wasmtime. It's written in Rust and can be used from Go [2] but requires CGo (as mentioned by GP). [1] https://github.com/bytecodealliance/wasmtime https://github.com/bytecodealliance/wasmtime [2] https://github.com/bytecodealliance/wasmtime-go https://github.com/bytecodealliance/wasmtime-go
- pyrolistical 3y agoZig can directly compile to wasm. Since most of zig’s std is pure zig, you can use it as is. It’s also zero dep
- aatd86 3y agoNothing much to say apart from me being really hyped about this project. It's almost time I dive in. I would like to be able to call android/iOS routines with this. Wondering what the overhead would be too.
- ejcx 3y agoHappy wazero user here in production. The team supporting the project has been really helpful and it's a very solid project.
- Fire-Dragon-DoL 3y agoOh, this might be how we finally get plugins in Go
- evacchi 3y agoyou mean like this? https://github.com/knqyf263/go-plugin https://github.com/knqyf263/go-plugin ;) wazero under the hood, by one of our awesome community members
- Fire-Dragon-DoL 3y agoNice, oh damn the limitations are still heavy. Sigh
- candiddevmike 3y agoWhat's your definition of a plugin? =D
- hugozap 3y agoA dynamic routine that can run in a secure sandbox invoked from the host.
- Fire-Dragon-DoL 3y agoYeah, should have been more precise. Code that can be loaded at runtime, does not need to be compiled together with the host application, can be loaded by just providing a path to a file/directory and can be executed in the host, ideally securely (not a strict requirement for my usage). The plugin ideally runs with performance very close to host performance go plugin package gets close, but the compile part is completely broken, where in reality the plugin has dependencies that can collide with the host. It would be fine if it was just the go runtime requirement that must match, but in reality it forces usage of cgo and a set of problems that make it really hard to use.
- candiddevmike 3y agoHave you looked at https://github.com/hashicorp/go-plugin https://github.com/hashicorp/go-plugin?
- cube2222 3y agoI've used wazero for a pet project (raw wasm generation from simple query plans) and it was really nice to work with! I also had to play around a bit with wasm relocations and the encoding/decoding libraries they've built are very readable, too, so I was able to hack together what I needed. Fingers crossed for the optimizing compiler that's planned for some point!
- pdyc 3y agowhat are you using for generating wasm? tinygo or new go runtime support of wasm? what are the sizes of wasm binaries? last i checked helloworld was in the order of few MB's.
- evacchi 3y agotinygo still wins for size, and the reflection story got better (json works!). The traditional Go compiler produces larger binary but OTOH it's super-fast, as fast as native builds!
- cube2222 3y agoThe project was a custom compiler to turn a simple query plan (think select, where, group by) into wasm. So it was basically hand-written raw wasm generation. I did compile some helper functions from Rust though, which also served as the "skeleton" of the wasm artifact I was later generating my wasm into, since wasm doesn't have any kind of proper dynamic linking right now.
- eudoxus 3y agoLove to see what this looks like if its available to look at somewhere (Github?). Sounds super interesting, even as a toy project
- cube2222 3y agoNever got it to anything close to a finished state, instead moving on to doing the same prototype in llvm and then cranelift. That said, here's some of the wazero-based code on a branch - https://github.com/cube2222/octosql/tree/wasm-experiment/wasmsql https://github.com/cube2222/octosql/tree/wasm-experiment/was... It really is just a very very basic prototype.
- verdverm 3y agoCUE recently added initial WASM support, glad to see it was this library! https://github.com/cue-lang/cue/blob/0520a3f9e73e63d77e43c9b3a73c75982c15ee6d/cue/interpreter/wasm/runtime.go https://github.com/cue-lang/cue/blob/0520a3f9e73e63d77e43c9b...
- kinghajj 3y agoI'm curious, what's the use case for CUE in a WASM environment? So that web apps can compile configuration at runtime?
- stanleydrew 3y agoHaven't looked at it, but I assume the use-case is opposite of your suggestion, i.e. CUE wants to offer some kind of plugin integration and embedding a WASM runtime is the safest way.
- verdverm 3y agoIt's also to enable you to do non-CUE things in CUE or do things more efficiently (in the long run). Think of things like topological sort or processing a value recursively. Places where an imperative system is so much easier to do something.
- verdverm 3y agoThis is WASM in CUE, to unlock more possibilities while still preserving the language semantics. You can already do CUE via WASM, this is how the playground works. https://cuelang.org/play/?id=#cue@export@cue https://cuelang.org/play/?id=#cue@export@cue
- skybrian 3y agoI count one dependency, on wazero itself. Also, the Go SDK. There is also the OS and the hardware. I think what they mean to say is that their module has no additional dependencies on other modules. But, how much should users care? Go is pretty good at managing dependencies and they’re okay within reason. It seems like an odd way to name your module? I guess it shows commitment. But if they later decide on adding a dependency, they could rename it.
- evacchi 3y agoThe "zero-dependency" in this context really means zero dependencies from Cgo :) see https://news.ycombinator.com/item?id=36552401 https://news.ycombinator.com/item?id=36552401
- skybrian 3y ago“Pure Go” seems like a fairly common way to talk about that. But I suppose generated Go code should be okay? Definitions are hard.
- evacchi 3y agoit's a bit more nuanced than that, we are also trying to actually limit third-party dependencies, you can read more about it here https://github.com/tetratelabs/wazero/blob/main/RATIONALE.md#zero-dependencies https://github.com/tetratelabs/wazero/blob/main/RATIONALE.md...
- skybrian 3y agoThat’s a pretty deep rabbit-hole. Thanks!
- circuit10 3y agoThere’s a section on the site for this: “Why zero? By avoiding CGO, wazero avoids prerequisites such as shared libraries or libc, and lets you keep features like cross compilation. Being pure Go, wazero adds only a small amount of size to your binary. Meanwhile, wazero’s API gives features you expect in Go, such as safe concurrency and context propagation.” Though that seems to be more about specifically C dependencies
- babelfish 3y agoWow, could this be used to run an HTTP server on a Cloudflare Worker?
- stanleydrew 3y agoPretty neat. Maybe I'll take a crack at replacing wasmtime with this in sqlc.
- ncruces 3y agoWhat's your use case for wasmtime in sqlc? If you go that route (use wazero instead) and want to avoid cgo, you may be interested in my wazero based SQLite bindings: https://github.com/ncruces/go-sqlite3 https://github.com/ncruces/go-sqlite3
- nmhancoc 3y agoI used this to run ML models I compiled down to WASM from Go. Really useful to put generic, high performance HTTP / JSON handling in front of some common interchangeable code.
- szopa 3y agoThis sounds very interesting. Can you please elaborate?
- nmhancoc 3y agoI start out with a trained ML model, transform it into equivalent C code, then compile that C code targeting WASM. Then I have a HTTP server in Go, which loads the wasm module on startup, just like dlopen but with a small ~10% performance overhead, rips the HTTP payload out, and calls the WASM function with the arguments filled in.
- empressplay 3y agoNote that if your Go code doesn't actually use CGO, you can just compile to WebAssembly, nothing else required
- caust1c 3y agoWe're using it at RunReveal and I've got to say that we're extremely happy with it. At Segment I always wanted a good sandbox environment for running customer code. This is the ideal solution, and the fact that it doesn't require CGo: :chefs_kiss: Happy to answer any questions people considering using it might have!
- WhereIsTheTruth 3y agoLovely, also cross-compile to X86 and arm for all major platforms in just 30seconds Try it yourself, clone their repo and ``make dist`` That's what I love about Go
- koreanguy 3y ago[dead]
- tempodox 3y agoThis looks like you can write a Go app that can run WASM plugins. Very handy.
- morelish 3y agoCan someone explain this to me like I’m 5? I thought web assembly was primarily run in a browser. Is this saying you can run a wasm binary in your go project (outside of the browser)?
- evacchi 3y agoThat is correct. It is a webassembly runtime that you can embed in your go project. There are also other wasm runtimes that run outside the browser, this is one written in Go
- paulddraper 3y agoCorrect! Just like JavaScript was made to run in a browser, but additional runtimes have been created.
- yklcs 3y agoUsing WASM for things requiring low IO and high compute that are traditionally written in C/C++ makes a lot of sense to me. Image codecs are an example and native implementations for things like JPEG encoders are hard to come by. So, I used wazero to implement a few image codecs in Go^1. Codecs were compiled to WASM, and wazero works great for running them (albeit with overhead). For this use case, wazero appears to be the cleanest solution as it's the only runtime that doesn't need CGo. The biggest appeal to me embedding WASM in Go is avoiding CGo to allow cross compilation. If my dependency is using CGo anyway, I might as well as link against a C library. I think native WASM runtimes like wazero are currently the best options for porting code language-agnostically. ^1: https://github.com/yklcs/wasmimg https://github.com/yklcs/wasmimg