7 ms·

Hyperlight WASM: Fast, secure, and OS-free

234 points by yoshuaw 2y ago

yoshuaw 2y ago
A couple of months ago we announced Hyperlight [1], a lightweight VMM that can spawn new VMs in about a millisecond. Today we’re happy to announce the Hyperlight Wasm guest based on the Wasmtime runtime. This makes it possible to run Wasm Component binaries on top of WASI interfaces without the need for a guest OS in the VM. In this post we explain how this works and walk through an example. [1]: https://news.ycombinator.com/item?id=42078476 https://news.ycombinator.com/item?id=42078476
- dochtman 2y ago
  How does performance compare to running native code?
  - yoshuaw 2y ago
    It depends on how which performance metrics you're interested in, where you draw the boundaries for individual workloads, and how you then schedule those workloads. Hyperlight can start new Wasm workloads so quickly that you might not need to keep any idling instances around ("scale to zero"). That's new, and it makes comparisons a little more complicated. For example: - If we take VMs as our boundary and compare cold start times, Hyperlight confidently comes out on top. That's 1-2ms vs 125ms+. - If we take warm instances and measure network latency for requests, Hyperlight will come out on top if deployed to a CDN node (physics!). But if both workloads run in the same data center performance will be a lot closer. - Say we have a workload where we need to transmux a terabyte of video, and we care about doing that as quickly as possible. A native binary has access to native instructions that will almost certainly outperform pure-Wasm workloads. I think about Hyperlight Wasm is as yet another tool in the toolbox. There are some things it's great at (cold-starts, portability, security) and some other things it isn't. At least, not yet. Whether it's a good fit for what you're doing will depend on what you're doing.
    - deleted 2y ago
      [deleted]
- deleted 2y ago
  [deleted]
- ThePhysicist 2y ago
  So is Hyperlight a competitor to things like Firecracker or does it serve a different niche?
  - whs 2y ago
    From what I understand Hyperlight's boot process is more similar to a microcontroller than a PC (although it use your CPU architecture) - the VM directly boot into your code. Unlike Firecracker, Hyperlight VM doesn't have any hardware while Firecracker do have VirtIO devices, serial console and keyboard so that traditional operating systems can be adapted to Firecracker. Host-Guest communication is done with shared memory.
  - yoshuaw 2y ago
    Though both share the ability so securely execute multi-tenant workloads, but they make very different tradeoffs when it comes to compatibility vs performance. To compare: Firecracker is great if you want to securely execute an OS image. It has the benefit of compatibility with many existing programs, but that comes at the cost of some overhead. Hyperlight is great if you want to securely execute program runtimes. This requires bespoke guest bindings, but it has the benefit of having less overhead. There’s a place for both approaches, and I see both happily co-exist.
ecshafer 2y ago
This seems interesting. So the use case of this would be if you wanted to role your own Cloudflare Workers or Lambda equivalent with WASM?
- yoshuaw 2y ago
  That’s the idea! This is at the heart of our upcoming Azure Front Door Edge Actions platform. Our CTO Mark Russinovich talked more about this at Ignite last fall: https://youtu.be/EYCA0cR1dkI https://youtu.be/EYCA0cR1dkI
- Muromec 2y ago
  You pretty much get deployability of docker with a size of npm package. In theory
Havoc 2y ago
Any ideas on how one might cram this into a promox setup for testing purposes? As I understand it this is designed to sit on bare metal and this is all a bit hamfisted but I don’t have a spare bare metal x86 around. Guessing just throw this into a vm and accept that it’s nested virt?
- amne 2y ago
  (looks at laptop running a Node app hosted in minikube running on Podman in WSL2 in Windows) of course. easy peasy
  - 38 2y ago
    [flagged]
dakom 2y ago
Cool. Trying to understand the value-add here, how does this differ from executing via wasmtime?
- Muromec 2y ago
  I think they skipped the middlemam and run wasmtime under hypervisor without linux inbetween
- huijzer 2y ago
  Good question. I think it’s the additional security? From [1]: > Hyperlight is able to create new VMs in one to two milliseconds. While this is still slower than using sandboxed runtimes like V8 or Wasmtime directly, with Hyperlight we can take those same runtimes and place them inside of a VM that provides additional protection in the event of a sandbox escape. [1]: https://opensource.microsoft.com/blog/2024/11/07/introducing-hyperlight-virtual-machine-based-security-for-functions-at-scale/ https://opensource.microsoft.com/blog/2024/11/07/introducing...
- Jtsummers 2y ago
  It's the same reasoning that leads people to move things from running in an OS process to running in a VM. In theory, it adds security and better isolation. Hyperlight appears to substantially reduce the overhead of running VMs which makes it more appealing as a target if this fits your needs and you want the isolation of VMs.
- algorithmmonkey 2y ago
  A Wasm component running inside of Wasmtime is just fine. However, when you start to use resources from outside of Wasm, e.g. systems, network interfaces, GPUs, etc., Wasmtime uses OS resources from the host that it is running upon. If this host is running on your trusted compute base, then it implies you are trusting the host implementations in Wasmtime, which for some is just fine. However, Hyperlight-Wasm gives platform builders the ability to describe the interface between the guest and the host explicitly, so you could only expose the host functionality you would want with the trusted implementation you'd want. For example, if I'm building a FaaS, I may want to provide only an exported event handler and an imported key/value interface to the guest for which I've built a safe, multi-tenant implementation and strictly disallow all other host provided functionality.
anon291 2y ago
So essentially we have a VM (wasm) meant to sandbox programs running in a hardware VM meant to sandbox programs running in a user space process (Linux process) which is an abstraction meant to isolate programs. Have we ever thought of .... Using Unix processes for what they were meant to do, which is .. isolate programs?
- vacuity 2y ago
  Unfortunately Unix processes aren't up to snuff, hence we introduced a bunch of dubious add-ons. Recently HN had a post on seL4; microkernels and capabilities were brought up. But of course backwards compatibility is tough...
  - anon291 2y ago
    Right but the course of action should be to add on to them, not invent entirely new stacks.
    - deleted 2y ago
      [deleted]
  - wahern 2y ago
    The reason processes aren't enough for isolation is primarily because of the large (and growing) number of syscalls, especially for complicated, bleeding-edge subsystems, exposing significant kernel surface area that's susceptible to exploits when kernel bugs are discovered. The WASM ecosystem is recapitulating this stage of affairs by increasing the surface area with external systems in the same fashion. Unix processes combined with seccomp (or pledge) to reduce exposed kernel surface and landlock (or unveil) to limit filesystem access puts you back at square one. Processes running WASM interpreters should be leveraging those interfaces, anyhow. What really differentiates WASM is the "compile once, run anywhere" portability allure. But we live in an age of open source (in the literal sense). Ecosystems like Go and Rust assume source code availability; binary blobs are the exception. There's not much of a difference between C, Go, or Rust textual source code on the one hand and a WASM binary on the other; both are going to be compiled to native code by the downstream user. When you have the source code available to compile, then standards like POSIX should suffice. But they don't (at least not completely), because people are always chasing newer features that various environments invent to differentiate themselves. I don't see how WASM resolves that fundamental dynamic. Though I don't deny there are marginal benefits, just like there were with the JVM, which in many niches effectively resolved the Unix/Windows portability issue, allowing people to migrate platforms easier as preferences and requirements change.
weinzierl 2y ago
All these cool and interesting projects make me think that WASM is successful everywhere except the browser. Maybe we should drop the Web from Web Assembly and call it something else?
- apitman 2y ago
  WASM is widely used and very successful in the browser.
  - weinzierl 2y ago
    That is not the world I see. Where is WASM in the browser really used apart from crypto miners? The world I see is one where WASM is a permanent second class citizen and probably already has reached its peak adoption. Not that I hope for it, quite the contrary, but that is what it looks to me. EDIT: crypto miners and fancy tech demos I should say
    - rstat1 2y ago
      >>Where is WASM in the browser really used apart from crypto miners? Amazon's Twitch service (and by extension also AWS's Interactive Video Service product that uses all the same backend stuff). Their video player is either fully a WASM thing or has some WASM components, I'm not completely sure which.
      - weinzierl 2y ago
        "has some WASM components" See, that's the problem. As long as WASM is not able to pull its own weight and needs JavaScript to provide the spine it will languish in a niche or two. Ultimately someone will decide that supporting two different languages and ecosystems is too expensive and not worth the marginal advantage and it will go back to JavaScript only. We've been there and we have done that with Java applets.
        tadfisher 2y ago
temp0826 2y ago
So a unikernel/library os?
- algorithmmonkey 2y ago
  There are definitely some similarities. I think the main difference is the compatibility of Wasm / WASI. Often for unikernel / libOS, you would need to recompile applications to target the specific unikernel / libOS. The goal is that you should be able to take a component that you would run with Wasmtime or other component model compatible runtime and be able to run that on Hyperlight-Wasm.
infogulch 2y ago
How are instances started and managed? Via some API? Can you give a Wasm Component binary the capability to execute a tree of connected Wasm Components, delegate capabilities, and manage their life cycle?
- algorithmmonkey 2y ago
  This example (https://github.com/hyperlight-dev/hyperlight-wasm-sockets-example/blob/de8d0692b1073dbe6951054b09f37a7dd46c649e/src/main.rs#L73-L101 https://github.com/hyperlight-dev/hyperlight-wasm-sockets-ex...) demonstrates starting a sandbox and loading a component. You could imagine you'd write an app that starts and stops any number of components in their own sandboxes. As for executing a tree of connected components, in the current state of Hyperlight-Wasm you'd probably want to take a collection of components and compose them together using something like https://github.com/bytecodealliance/wac https://github.com/bytecodealliance/wac to create a final component composed together from multiple components.
  - infogulch 2y ago
    Thank you for the illuminating references! So this sockets example is a host that runs on a raw vm (x86_64-unknown-none target) and spawns sandboxes. To get at my original idea, I could imagine a sandbox with special functions imported from the host that can spawn new sandboxes. This could be complicated by the fact that spawning these sandboxes and hooking up inputs/outputs seems to be statically compiled... I wondered how components were supposed to be used. So wac takes a group of wasm components and merges them into a new .wasm file with inputs/outputs mapped according to a defined .wac file. Then you can just run the new .wasm file. Does this not obviate the isolation benefits of having separate wasm modules? Is there a path to running a tree of components directly while maintaining the sandbox between them?
stusmall 2y ago
I'm really excite about this! I've got hopes that WASM/WASI will grow into the dream of the JVM from the 90s. A memory-safe target for development that allows easy of porting and testing across multiple platforms. WASM can, and hopefully will, be for so much more than browsers.
- tliltocatl 2y ago
  WASM isn't memory-safe through (no more than just having the application running in a separate process) because it doesn't type tag the memory. JVM was safe but that's also a serious disadvantage, because it bakes type system into the runtime system.
  - zozbot234 2y ago
    WASM Components are supposed to be memory safe, even in-process. Besides, you can compile from a memory-safe source language to WASM.
  - pie_flavor 2y ago
    Why is 'more memory safe than just having the application running in a separate process' the benchmark? Literally nothing can clear that bar. It is more memory safe than most existing VM languages, which is all anyone actually cares about.
    - deleted 2y ago
      [deleted]
    - tliltocatl 2y ago
      > Literally nothing can clear that bar. That's just not true. Every language that doesn't allow casting pointers to integers (that is, JVM, Javascript, Python and literally everything but C/C++) is more memory-safe that WASM. Yes, performance on these more or less sucks. But what I'm trying to tell, the only advantage WASM has over native code is portability, it's no more safe than native code, most interpreted languages (where "interpreted" includes bytecode and JIT) are safer.
apitman 2y ago
I started using WebAssembly in earnest a few months ago to make a backend auth library that works in several different languages[0]. It's built on Extism[1], which abstracts away some of the interfacing complexity. It's been an awesome experience. Frequently feels like magic. WASM is in an interesting place. The value has clearly been proved with a pretty minimal core spec. Now there's a big push to implement a much larger API surface for WASI and the Component Model. A lot of people in the community are concerned about this direction, or at least the way it's happening[2]. For my part, I hope WASM doesn't go the way of the rest of web browsers where it gets so complicated that only big tech is capable of making implementations and experimenting. [0]: https://github.com/lastlogin-net/decent-auth https://github.com/lastlogin-net/decent-auth [1]: https://extism.org/ https://extism.org/ [2]: https://www.assemblyscript.org/standards-objections.html https://www.assemblyscript.org/standards-objections.html
- pjmlp 2y ago
  It will be re-inventing the whole application containers ecosystems we had back a few decades ago across JVM and CLR ecosystems.
  - apitman 2y ago
    When you jump into every WASM thread with this take, what are you trying to accomplish?
    - pjmlp 2y ago
      Make everyone aware, born after 2000's what is being re-invented, while being sold as innovative. You are free to ignore my comments.
      - apitman 2y ago
        That's a fair reason. It's important to realize how often we re-invent the wheel in our field. As an example, you're an expert in distributed systems, which I've only recently started dabbling in. In the process I'm learning how so many of the fancy "new" distributed systems and we have today were essentially invented decades ago. But in the WASM case, to what end? There's a cost to your comments. I'm sharing an example of how WASM has helped me solve a real problem, and might solve real problems for other people. Your comments create noise to these types of discussions. Maybe it's worth the tradeoff in your mind, but I'm curious what your end goal is?
ryukafalz 2y ago
Since Wasmtime can run programs built for Wasm GC, I'm curious if this can as well. Would be neat if so.

234 points by yoshuaw 2y ago

A couple of months ago we announced Hyperlight [1], a lightweight VMM that can spawn new VMs in about a millisecond. Today we’re happy to announce the Hyperlight Wasm guest based on the Wasmtime runtime. This makes it possible to run Wasm Component binaries on top of WASI interfaces without the need for a guest OS in the VM. In this post we explain how this works and walk through an example. [1]: https://news.ycombinator.com/item?id=42078476 https://news.ycombinator.com/item?id=42078476

dochtman 2y ago
How does performance compare to running native code?
- yoshuaw 2y ago
  It depends on how which performance metrics you're interested in, where you draw the boundaries for individual workloads, and how you then schedule those workloads. Hyperlight can start new Wasm workloads so quickly that you might not need to keep any idling instances around ("scale to zero"). That's new, and it makes comparisons a little more complicated. For example: - If we take VMs as our boundary and compare cold start times, Hyperlight confidently comes out on top. That's 1-2ms vs 125ms+. - If we take warm instances and measure network latency for requests, Hyperlight will come out on top if deployed to a CDN node (physics!). But if both workloads run in the same data center performance will be a lot closer. - Say we have a workload where we need to transmux a terabyte of video, and we care about doing that as quickly as possible. A native binary has access to native instructions that will almost certainly outperform pure-Wasm workloads. I think about Hyperlight Wasm is as yet another tool in the toolbox. There are some things it's great at (cold-starts, portability, security) and some other things it isn't. At least, not yet. Whether it's a good fit for what you're doing will depend on what you're doing.
  - deleted 2y ago
    [deleted]
deleted 2y ago
[deleted]
ThePhysicist 2y ago
So is Hyperlight a competitor to things like Firecracker or does it serve a different niche?
- whs 2y ago
  From what I understand Hyperlight's boot process is more similar to a microcontroller than a PC (although it use your CPU architecture) - the VM directly boot into your code. Unlike Firecracker, Hyperlight VM doesn't have any hardware while Firecracker do have VirtIO devices, serial console and keyboard so that traditional operating systems can be adapted to Firecracker. Host-Guest communication is done with shared memory.
- yoshuaw 2y ago
  Though both share the ability so securely execute multi-tenant workloads, but they make very different tradeoffs when it comes to compatibility vs performance. To compare: Firecracker is great if you want to securely execute an OS image. It has the benefit of compatibility with many existing programs, but that comes at the cost of some overhead. Hyperlight is great if you want to securely execute program runtimes. This requires bespoke guest bindings, but it has the benefit of having less overhead. There’s a place for both approaches, and I see both happily co-exist.

ecshafer 2y ago

This seems interesting. So the use case of this would be if you wanted to role your own Cloudflare Workers or Lambda equivalent with WASM?

yoshuaw 2y ago
That’s the idea! This is at the heart of our upcoming Azure Front Door Edge Actions platform. Our CTO Mark Russinovich talked more about this at Ignite last fall: https://youtu.be/EYCA0cR1dkI https://youtu.be/EYCA0cR1dkI
Muromec 2y ago
You pretty much get deployability of docker with a size of npm package. In theory

Havoc 2y ago

Any ideas on how one might cram this into a promox setup for testing purposes? As I understand it this is designed to sit on bare metal and this is all a bit hamfisted but I don’t have a spare bare metal x86 around. Guessing just throw this into a vm and accept that it’s nested virt?

amne 2y ago
(looks at laptop running a Node app hosted in minikube running on Podman in WSL2 in Windows) of course. easy peasy
- 38 2y ago
  [flagged]

dakom 2y ago

Cool. Trying to understand the value-add here, how does this differ from executing via wasmtime?

Muromec 2y ago
I think they skipped the middlemam and run wasmtime under hypervisor without linux inbetween
huijzer 2y ago
Good question. I think it’s the additional security? From [1]: > Hyperlight is able to create new VMs in one to two milliseconds. While this is still slower than using sandboxed runtimes like V8 or Wasmtime directly, with Hyperlight we can take those same runtimes and place them inside of a VM that provides additional protection in the event of a sandbox escape. [1]: https://opensource.microsoft.com/blog/2024/11/07/introducing-hyperlight-virtual-machine-based-security-for-functions-at-scale/ https://opensource.microsoft.com/blog/2024/11/07/introducing...
Jtsummers 2y ago
It's the same reasoning that leads people to move things from running in an OS process to running in a VM. In theory, it adds security and better isolation. Hyperlight appears to substantially reduce the overhead of running VMs which makes it more appealing as a target if this fits your needs and you want the isolation of VMs.
algorithmmonkey 2y ago
A Wasm component running inside of Wasmtime is just fine. However, when you start to use resources from outside of Wasm, e.g. systems, network interfaces, GPUs, etc., Wasmtime uses OS resources from the host that it is running upon. If this host is running on your trusted compute base, then it implies you are trusting the host implementations in Wasmtime, which for some is just fine. However, Hyperlight-Wasm gives platform builders the ability to describe the interface between the guest and the host explicitly, so you could only expose the host functionality you would want with the trusted implementation you'd want. For example, if I'm building a FaaS, I may want to provide only an exported event handler and an imported key/value interface to the guest for which I've built a safe, multi-tenant implementation and strictly disallow all other host provided functionality.

anon291 2y ago

So essentially we have a VM (wasm) meant to sandbox programs running in a hardware VM meant to sandbox programs running in a user space process (Linux process) which is an abstraction meant to isolate programs. Have we ever thought of .... Using Unix processes for what they were meant to do, which is .. isolate programs?

vacuity 2y ago
Unfortunately Unix processes aren't up to snuff, hence we introduced a bunch of dubious add-ons. Recently HN had a post on seL4; microkernels and capabilities were brought up. But of course backwards compatibility is tough...
- anon291 2y ago
  Right but the course of action should be to add on to them, not invent entirely new stacks.
  - deleted 2y ago
    [deleted]
- wahern 2y ago
  The reason processes aren't enough for isolation is primarily because of the large (and growing) number of syscalls, especially for complicated, bleeding-edge subsystems, exposing significant kernel surface area that's susceptible to exploits when kernel bugs are discovered. The WASM ecosystem is recapitulating this stage of affairs by increasing the surface area with external systems in the same fashion. Unix processes combined with seccomp (or pledge) to reduce exposed kernel surface and landlock (or unveil) to limit filesystem access puts you back at square one. Processes running WASM interpreters should be leveraging those interfaces, anyhow. What really differentiates WASM is the "compile once, run anywhere" portability allure. But we live in an age of open source (in the literal sense). Ecosystems like Go and Rust assume source code availability; binary blobs are the exception. There's not much of a difference between C, Go, or Rust textual source code on the one hand and a WASM binary on the other; both are going to be compiled to native code by the downstream user. When you have the source code available to compile, then standards like POSIX should suffice. But they don't (at least not completely), because people are always chasing newer features that various environments invent to differentiate themselves. I don't see how WASM resolves that fundamental dynamic. Though I don't deny there are marginal benefits, just like there were with the JVM, which in many niches effectively resolved the Unix/Windows portability issue, allowing people to migrate platforms easier as preferences and requirements change.

weinzierl 2y ago

All these cool and interesting projects make me think that WASM is successful everywhere except the browser. Maybe we should drop the Web from Web Assembly and call it something else?

apitman 2y ago
WASM is widely used and very successful in the browser.
- weinzierl 2y ago
  That is not the world I see. Where is WASM in the browser really used apart from crypto miners? The world I see is one where WASM is a permanent second class citizen and probably already has reached its peak adoption. Not that I hope for it, quite the contrary, but that is what it looks to me. EDIT: crypto miners and fancy tech demos I should say
  - rstat1 2y ago
    >>Where is WASM in the browser really used apart from crypto miners? Amazon's Twitch service (and by extension also AWS's Interactive Video Service product that uses all the same backend stuff). Their video player is either fully a WASM thing or has some WASM components, I'm not completely sure which.
    - weinzierl 2y ago
      "has some WASM components" See, that's the problem. As long as WASM is not able to pull its own weight and needs JavaScript to provide the spine it will languish in a niche or two. Ultimately someone will decide that supporting two different languages and ecosystems is too expensive and not worth the marginal advantage and it will go back to JavaScript only. We've been there and we have done that with Java applets.
      - tadfisher 2y ago

temp0826 2y ago

So a unikernel/library os?

algorithmmonkey 2y ago
There are definitely some similarities. I think the main difference is the compatibility of Wasm / WASI. Often for unikernel / libOS, you would need to recompile applications to target the specific unikernel / libOS. The goal is that you should be able to take a component that you would run with Wasmtime or other component model compatible runtime and be able to run that on Hyperlight-Wasm.

infogulch 2y ago

How are instances started and managed? Via some API? Can you give a Wasm Component binary the capability to execute a tree of connected Wasm Components, delegate capabilities, and manage their life cycle?

algorithmmonkey 2y ago
This example (https://github.com/hyperlight-dev/hyperlight-wasm-sockets-example/blob/de8d0692b1073dbe6951054b09f37a7dd46c649e/src/main.rs#L73-L101 https://github.com/hyperlight-dev/hyperlight-wasm-sockets-ex...) demonstrates starting a sandbox and loading a component. You could imagine you'd write an app that starts and stops any number of components in their own sandboxes. As for executing a tree of connected components, in the current state of Hyperlight-Wasm you'd probably want to take a collection of components and compose them together using something like https://github.com/bytecodealliance/wac https://github.com/bytecodealliance/wac to create a final component composed together from multiple components.
- infogulch 2y ago
  Thank you for the illuminating references! So this sockets example is a host that runs on a raw vm (x86_64-unknown-none target) and spawns sandboxes. To get at my original idea, I could imagine a sandbox with special functions imported from the host that can spawn new sandboxes. This could be complicated by the fact that spawning these sandboxes and hooking up inputs/outputs seems to be statically compiled... I wondered how components were supposed to be used. So wac takes a group of wasm components and merges them into a new .wasm file with inputs/outputs mapped according to a defined .wac file. Then you can just run the new .wasm file. Does this not obviate the isolation benefits of having separate wasm modules? Is there a path to running a tree of components directly while maintaining the sandbox between them?

stusmall 2y ago

I'm really excite about this! I've got hopes that WASM/WASI will grow into the dream of the JVM from the 90s. A memory-safe target for development that allows easy of porting and testing across multiple platforms. WASM can, and hopefully will, be for so much more than browsers.

tliltocatl 2y ago
WASM isn't memory-safe through (no more than just having the application running in a separate process) because it doesn't type tag the memory. JVM was safe but that's also a serious disadvantage, because it bakes type system into the runtime system.
- zozbot234 2y ago
  WASM Components are supposed to be memory safe, even in-process. Besides, you can compile from a memory-safe source language to WASM.
- pie_flavor 2y ago
  Why is 'more memory safe than just having the application running in a separate process' the benchmark? Literally nothing can clear that bar. It is more memory safe than most existing VM languages, which is all anyone actually cares about.
  - deleted 2y ago
    [deleted]
  - tliltocatl 2y ago
    > Literally nothing can clear that bar. That's just not true. Every language that doesn't allow casting pointers to integers (that is, JVM, Javascript, Python and literally everything but C/C++) is more memory-safe that WASM. Yes, performance on these more or less sucks. But what I'm trying to tell, the only advantage WASM has over native code is portability, it's no more safe than native code, most interpreted languages (where "interpreted" includes bytecode and JIT) are safer.

apitman 2y ago

I started using WebAssembly in earnest a few months ago to make a backend auth library that works in several different languages[0]. It's built on Extism[1], which abstracts away some of the interfacing complexity. It's been an awesome experience. Frequently feels like magic. WASM is in an interesting place. The value has clearly been proved with a pretty minimal core spec. Now there's a big push to implement a much larger API surface for WASI and the Component Model. A lot of people in the community are concerned about this direction, or at least the way it's happening[2]. For my part, I hope WASM doesn't go the way of the rest of web browsers where it gets so complicated that only big tech is capable of making implementations and experimenting. [0]: https://github.com/lastlogin-net/decent-auth https://github.com/lastlogin-net/decent-auth [1]: https://extism.org/ https://extism.org/ [2]: https://www.assemblyscript.org/standards-objections.html https://www.assemblyscript.org/standards-objections.html

pjmlp 2y ago
It will be re-inventing the whole application containers ecosystems we had back a few decades ago across JVM and CLR ecosystems.
- apitman 2y ago
  When you jump into every WASM thread with this take, what are you trying to accomplish?
  - pjmlp 2y ago
    Make everyone aware, born after 2000's what is being re-invented, while being sold as innovative. You are free to ignore my comments.
    - apitman 2y ago
      That's a fair reason. It's important to realize how often we re-invent the wheel in our field. As an example, you're an expert in distributed systems, which I've only recently started dabbling in. In the process I'm learning how so many of the fancy "new" distributed systems and we have today were essentially invented decades ago. But in the WASM case, to what end? There's a cost to your comments. I'm sharing an example of how WASM has helped me solve a real problem, and might solve real problems for other people. Your comments create noise to these types of discussions. Maybe it's worth the tradeoff in your mind, but I'm curious what your end goal is?

ryukafalz 2y ago

Since Wasmtime can run programs built for Wasm GC, I'm curious if this can as well. Would be neat if so.