5 ms·

Spin 3.0 – open-source tooling for building and running WASM apps

175 points by triplechill 2y ago

VyseofArcadia 2y ago
Purple and green some to have become the colors of dev tooling. I'm seeing that color scheme everywhere.
- triyambakam 2y ago
  I can see that at least Vite also uses those colors. In part inspired by terminal colors but purple (instead of black) makes it feel more modern and sophisticated.
  - politelemon 2y ago
    That's the neat thing about trends, the next wave of colours will always feel more modern and sophisticated.
barrrrald 2y ago
Component dependency is pretty wild and could massively simplify some complex apps
- Onavo 2y ago
  You still need to cross the JS FFI boundary for wasm, I don't think WebAssembly has a specification for cross language FFI directly between WebAssembly languages.
  - rgrmrts 2y ago
    Wasm components can talk to each other, you do not need the JS FFI boundary.
    - Onavo 2y ago
      Can you give an example? Say between a wasm component written in Rust and wasm component written in dart.
      - phickey 2y ago
        One of the biggest goals of the component model is that it doesn't matter what language your component is written in. Composition can happen anytime one component exports an interface and another component imports it. https://component-model.bytecodealliance.org/creating-and-consuming/composing.html https://component-model.bytecodealliance.org/creating-and-co...
        nilslice 2y ago
        won’t happen. all will crumble with the startups pumping it.
        laerus 2y ago
        it's already happening
        nilslice 2y ago
        it’s not. it’s being presented as such. but it’s not.
      - no_circuit 2y ago
        WASM is basically similar to JVM bytecode. So the comparison would be like using compiled code from Java, Scala and/or Kotlin for example. The source language only determines how the code is expressed in WASM and whether or not it also needs to bundle / compile-in some runtime code baggage for it to work.
        sjrd 2y ago
        I develop the Scala-to-Wasm compiler, and also maintain the JVM backend of Scala. I can tell you that Wasm is very different from JVM bytecode. The fundamental difference is that the JVM bytecode has an object model. When they talk to each other, Java, Scala and Kotlin do so at the abstraction level of the JVM object model. You can directly call methods between them because virtual dispatch of methods is a concept with semantics in the bytecode. There's no such thing in Wasm, even with the GC extension. You get structs and arrays, but nothing like methods. If you want virtual dispatch, you encode it yourself using your own design of virtual method tables. That means Java, Scala and Kotlin, despite all having their Wasm GC backend at this point, cannot call each other's methods in Wasm.
- no_circuit 2y ago
  Yes, its great to see progress in the tooling [1] so that the component building is easier. Although I do like to think of the component model as the "ABI linking model". You can only bind one implementation to an interface import. [1] https://developer.fermyon.com/spin/v3/writing-apps#declaring-component-dependencies https://developer.fermyon.com/spin/v3/writing-apps#declaring...
simonw 2y ago
Does anyone know what the simplest possible recipe for running a Python script in a WASM sandbox using Spin is? I basically want to do something like this: my-sandbox-cli-tool 'print("hello world") And have the snippet of Python code I provide run inside a WebAssembly container that runs one of the Python compiled to WASM builds (https://github.com/brettcannon/cpython-wasi-build https://github.com/brettcannon/cpython-wasi-build for example) - with a time limit and restrictions on memory usage, and file system access, and network access. I am on a continued quest to figure out the cleanest way to achieve this, I have so many projects I would want to build on top of this capability!
- conroy 2y ago
  wasmtime works as long as you make sure to include the lib directory % wasmtime run --dir .::/ python.wasm -c 'print("hello world")' hello world disclaimer: I run a code execution API service (https://riza.io/playground https://riza.io/playground) that does this and more (HTTP, packages, etc.)
  - simonw 2y ago
    Wow that's almost what I want. wget https://github.com/brettcannon/cpython-wasi-build/releases/download/v3.13.0/python-3.13.0-wasi_sdk-24.zip unzip python-3.13.0-wasi_sdk-24.zip wasmtime run --dir .::/ python.wasm -c 'print("hello world")' So far so good! But... it looks like that --dir option mounts the current directory as both readable and writable: wasmtime run --dir .::/ python.wasm -c 'print(len(open("python.wasm", "rb").read()))' # Outputs 28775526 But malicious code can break the system like this: wasmtime run --dir .::/ python.wasm -c 'open("python.wasm", "wb").write(b"blah")' And now it fails with an error if you try to run it because we over-wrote python.wasm. Even if I move python.wasm out of the current directory I'd still be able to break things by breaking those other lib files. Although... I guess I could use unix filesystem permissions to make those read-only? That could work.
    - compressedgas 2y ago
      You might need to wrap the wasmtime command in firejail or bubblewrap with appropriate arguments to get the operation restrictions you want.
tholm 2y ago
Having worked heavily with gRPC before I like how syntactically similar WIT is to proto. Looks like its time to start experimenting more with web assembly component interop :).
jauntywundrkind 2y ago
I really wish there were signs that maybe perhaps wasm components would be usable as such in the browser, sometime in the next handful of years. We have this whole amazing modular code system, but once again like with esm the browser gaps persist and drag on. We finally in 2024 sort of have esm for workers, for example. But not import-maps, so the distributed esm modules aren't directly usable. This category of "making using the spec actually possible" problems tends to dwell for far too long alas.
rkunnamp 2y ago
Asking a question here that I long wanted to ask. Is it possible to have a python handler function that uses duckdb to query a S3 hosted parquet file and that uses pandas for some data manipulation, run as a WASM app? (leveraging all features of duckdb like predicate pushdown etc)
- chrisjc 2y ago
  Maybe something like this? https://duckdb.org/2024/10/02/pyodide.html https://duckdb.org/2024/10/02/pyodide.html
deleted 2y ago
[deleted]
euroderf 2y ago
I like the idea of CLI-first. But then could the tooling make it simple & convenient to run the exact same configuration in a browser ? With the choice of either (a) a shell-like prompt, or (b) an auto-generated basic GUI with the appropriate input widgets ?
deleted 2y ago
[deleted]

175 points by triplechill 2y ago

VyseofArcadia 2y ago

Purple and green some to have become the colors of dev tooling. I'm seeing that color scheme everywhere.

triyambakam 2y ago
I can see that at least Vite also uses those colors. In part inspired by terminal colors but purple (instead of black) makes it feel more modern and sophisticated.
- politelemon 2y ago
  That's the neat thing about trends, the next wave of colours will always feel more modern and sophisticated.

barrrrald 2y ago

Component dependency is pretty wild and could massively simplify some complex apps

Onavo 2y ago
You still need to cross the JS FFI boundary for wasm, I don't think WebAssembly has a specification for cross language FFI directly between WebAssembly languages.
- rgrmrts 2y ago
  Wasm components can talk to each other, you do not need the JS FFI boundary.
  - Onavo 2y ago
    Can you give an example? Say between a wasm component written in Rust and wasm component written in dart.
    - phickey 2y ago
      One of the biggest goals of the component model is that it doesn't matter what language your component is written in. Composition can happen anytime one component exports an interface and another component imports it. https://component-model.bytecodealliance.org/creating-and-consuming/composing.html https://component-model.bytecodealliance.org/creating-and-co...
      - nilslice 2y ago
        won’t happen. all will crumble with the startups pumping it.
        laerus 2y ago
        it's already happening
        nilslice 2y ago
        it’s not. it’s being presented as such. but it’s not.
    - no_circuit 2y ago
      WASM is basically similar to JVM bytecode. So the comparison would be like using compiled code from Java, Scala and/or Kotlin for example. The source language only determines how the code is expressed in WASM and whether or not it also needs to bundle / compile-in some runtime code baggage for it to work.
      - sjrd 2y ago
        I develop the Scala-to-Wasm compiler, and also maintain the JVM backend of Scala. I can tell you that Wasm is very different from JVM bytecode. The fundamental difference is that the JVM bytecode has an object model. When they talk to each other, Java, Scala and Kotlin do so at the abstraction level of the JVM object model. You can directly call methods between them because virtual dispatch of methods is a concept with semantics in the bytecode. There's no such thing in Wasm, even with the GC extension. You get structs and arrays, but nothing like methods. If you want virtual dispatch, you encode it yourself using your own design of virtual method tables. That means Java, Scala and Kotlin, despite all having their Wasm GC backend at this point, cannot call each other's methods in Wasm.
no_circuit 2y ago
Yes, its great to see progress in the tooling [1] so that the component building is easier. Although I do like to think of the component model as the "ABI linking model". You can only bind one implementation to an interface import. [1] https://developer.fermyon.com/spin/v3/writing-apps#declaring-component-dependencies https://developer.fermyon.com/spin/v3/writing-apps#declaring...

simonw 2y ago

Does anyone know what the simplest possible recipe for running a Python script in a WASM sandbox using Spin is? I basically want to do something like this: my-sandbox-cli-tool 'print("hello world") And have the snippet of Python code I provide run inside a WebAssembly container that runs one of the Python compiled to WASM builds (https://github.com/brettcannon/cpython-wasi-build https://github.com/brettcannon/cpython-wasi-build for example) - with a time limit and restrictions on memory usage, and file system access, and network access. I am on a continued quest to figure out the cleanest way to achieve this, I have so many projects I would want to build on top of this capability!

conroy 2y ago
wasmtime works as long as you make sure to include the lib directory % wasmtime run --dir .::/ python.wasm -c 'print("hello world")' hello world disclaimer: I run a code execution API service (https://riza.io/playground https://riza.io/playground) that does this and more (HTTP, packages, etc.)
- simonw 2y ago
  Wow that's almost what I want. wget https://github.com/brettcannon/cpython-wasi-build/releases/download/v3.13.0/python-3.13.0-wasi_sdk-24.zip unzip python-3.13.0-wasi_sdk-24.zip wasmtime run --dir .::/ python.wasm -c 'print("hello world")' So far so good! But... it looks like that --dir option mounts the current directory as both readable and writable: wasmtime run --dir .::/ python.wasm -c 'print(len(open("python.wasm", "rb").read()))' # Outputs 28775526 But malicious code can break the system like this: wasmtime run --dir .::/ python.wasm -c 'open("python.wasm", "wb").write(b"blah")' And now it fails with an error if you try to run it because we over-wrote python.wasm. Even if I move python.wasm out of the current directory I'd still be able to break things by breaking those other lib files. Although... I guess I could use unix filesystem permissions to make those read-only? That could work.
  - compressedgas 2y ago
    You might need to wrap the wasmtime command in firejail or bubblewrap with appropriate arguments to get the operation restrictions you want.

tholm 2y ago

Having worked heavily with gRPC before I like how syntactically similar WIT is to proto. Looks like its time to start experimenting more with web assembly component interop :).

jauntywundrkind 2y ago

I really wish there were signs that maybe perhaps wasm components would be usable as such in the browser, sometime in the next handful of years. We have this whole amazing modular code system, but once again like with esm the browser gaps persist and drag on. We finally in 2024 sort of have esm for workers, for example. But not import-maps, so the distributed esm modules aren't directly usable. This category of "making using the spec actually possible" problems tends to dwell for far too long alas.

rkunnamp 2y ago

Asking a question here that I long wanted to ask. Is it possible to have a python handler function that uses duckdb to query a S3 hosted parquet file and that uses pandas for some data manipulation, run as a WASM app? (leveraging all features of duckdb like predicate pushdown etc)

chrisjc 2y ago
Maybe something like this? https://duckdb.org/2024/10/02/pyodide.html https://duckdb.org/2024/10/02/pyodide.html

deleted 2y ago

[deleted]

euroderf 2y ago

I like the idea of CLI-first. But then could the tooling make it simple & convenient to run the exact same configuration in a browser ? With the choice of either (a) a shell-like prompt, or (b) an auto-generated basic GUI with the appropriate input widgets ?

deleted 2y ago

[deleted]