9 ms·

Python on the Edge: Fast, sandboxed, and powered by WebAssembly

399 points by baalimago 1y ago

pumanoir 1y ago
How would i use numpy from javascript using this?
- syrusakbary 1y ago
  Using Wasmer-JS that should be doable. We just need to release a new version!
  - pumanoir 1y ago
    thanks. it'd be great to have a quick tutorial on doing so. this is close to my dream of creating Frankenstein apps with the web platform instead of graal :) https://www.graalvm.org/latest/reference-manual/polyglot-programming/ https://www.graalvm.org/latest/reference-manual/polyglot-pro...
simonw 1y ago
OK this looks promising: brew install wasmer wasmer run python/python@=0.2.0 Running that gave me a Python 3.12 shell apparently running entirely in a WebAssembly sandbox! I've been trying to find a robust, reliable and easy way to run a Python process in WebAssembly (outside of a browser) for a few years.
- theanonymousone 1y ago
  Hasn't Pyodide been available for some years now?
  - simonw 1y ago
    Yes but it works only in the browser - running Pyodide outside of a browser is a lot of extra work. My previous attempts are described here: - https://til.simonwillison.net/deno/pyodide-sandbox https://til.simonwillison.net/deno/pyodide-sandbox - https://til.simonwillison.net/webassembly/python-in-a-wasm-sandbox https://til.simonwillison.net/webassembly/python-in-a-wasm-s...
    - almostgotcaught 1y ago
      not true pyodide venv .venv-pyodide source .venv-pyodide/bin/activate I don't know what runtime it uses but I have tests in nightly CI that run exactly like this. see https://pyodide.org/en/stable/development/building-packages-from-source.html#testing-packages-against-pyodide https://pyodide.org/en/stable/development/building-packages-...
      - simonw 1y ago
        Interesting - I hadn't seen that before: > Pyodide provides an experimental command line runner for testing packages against Pyodide. Using it requires nodejs version 20 or newer. Looks like it's a recent addition?
        almostgotcaught 1y ago
        No clue - I added that CI job around 6 months ago.
        simonw 1y ago
        I tracked it down to this PR from September 2022, so it's been around for a while: https://github.com/pyodide/pyodide/pull/2976 https://github.com/pyodide/pyodide/pull/2976
    - ZhiqiangWang 1y ago
      What is the point of running python in webassembly outside browser?
      - simonw 1y ago
        See comment here: https://news.ycombinator.com/item?id=45365165 https://news.ycombinator.com/item?id=45365165 I want a robust sandbox I can run untrusted code in, outside of the browser.
- syrusakbary 1y ago
  Thanks! Forgot to put it on the article, but the latest Python requires the Wasmer rc.5 to run! (the final release will be coming very soon) curl https://get.wasmer.io -sSfL | sh -s "v6.1.0-rc.5" wasmer run python/python
  - klas_segeljakt 1y ago
    I tried to run these commands. It downloads python@3.13.1, but then hangs without producing any output. However, it seems to work for wasmer run python/python@=0.2.0
- deleted 1y ago
  [deleted]
- behnamoh 1y ago
``` ╰─ wasmer run python/python error: Spawn failed ╰─▶ 1: compile error: Validate("exceptions proposal not enabled (at offset 0x191a)") ```
- the_duke 1y ago
  You'll need the latest wasmer RC for proper exceptions support. We unfortunately didn't get the final release out quite in time... curl https://get.wasmer.io -sSfL | sh -s "v6.1.0-rc.5" wasmer run python/python
  - simonw 1y ago
    How long should it take for "wasmer run python/python" to start showing me output? It's been hung for a while for me now (I upgraded to wasmer 6.1.0-rc.5). "wasmer run python/python@=0.2.0" on the same machine gets me into Python 3.12.0 almost instantly.
    - the_duke 1y ago
      Compilation with LLVM takes quite a while (the final release will show a spinner...). So please wait a bit - subsequent runs will be fast, since compiled Python will be cached.
      simonw 1y ago
      Oh so it's actually compiling everything on my machine? Any chance `wasmer run python/python` might download a pre-compiled version in the future?
      the_duke 1y ago
      Yeah, that's mentioned as a small side note in the blog post - we are working on it, and will hopefully have it ready in a week or two!
      1y ago
- giancarlostoro 1y ago
  Everyday we grow closer to my dream of having a WASM based template engine for Python, similar to how Blazor takes Razor and builds it to WASM. I might have to toy with this when I get home.
  - BiteCode_dev 1y ago
    Ideally, something that we could share between JS and Python.
- mr_toad 1y ago
  > I've been trying to find a robust, reliable and easy way to run a Python process in WebAssembly (outside of a browser) for a few years. reply What’s the use case? Is it the sandboxing? Is it easier than running Python in a container?
  - NeutralForest 1y ago
    The sandboxing, especially for AI Agents.
  - simonw 1y ago
    I want to be able to run code from untrusted sources (other people, users of my SaaS application, LLMs) in an environment, where I can control the blast radius if something goes wrong.
    - BeefySwain 1y ago
      What's wrong with Docker for this?
      - hmmokidk 1y ago
        Docker would be hacky and cumbersome especially when compared to anything assembly like.
      - simonw 1y ago
        I keep on hearing that Docker isn't designed as a security boundary for this kind of thing. Firecracker is meant to be secure but it's a lot harder to work with.
        phrotoma 1y ago
        Hey Simon, given it's you ... are you concerned about LLMs attempting to escape from within the confines of a Docker container or is this more about mitigating things like supply chain attacks?
- trehans 1y ago
  Does this work for packages with C/C++ extensions e.g. numpy and scipy?
  - ashvardanian 1y ago
    Seems like it already does for some, assuming Pillow and FFMpeg are on the list.
  - zebreus 1y ago
    Building packages with C/C++ extensions is still a bit tricky but you can see a list of all prebuilt packages for wasmer at https://pythonindex.wasix.org https://pythonindex.wasix.org . numpy is available there, scipy not (yet).
    - Art9681 1y ago
      Bummer. Back to Docker then.
    - gvkhna 1y ago
      Wow, this is the key. If it just had python that’s not as useful but the major frameworks is the real value. Definitely going to keep an eye on this. I built a sandbox with deno for ai code generation. It works well enough but there are some use cases where python may make more sense. Nice!
      - indigodaddy 1y ago
        Any chance your deno thing is on GH?
        gvkhna 1y ago
        Yup, github.com/gvkhna/vibescraper in the sandbox package. Def needs a cleanup but it’s heavily tested and works great at aivibescraper.com
codedokode 1y ago
I tried to understand what is "Wasmer Edge" but couldn't. They say on the front page "Make any app serverless. The cheapest, fastest and most scalable way to deploy is on the edge." and it seems like I can upload the source code of any app and they will convert it for me? Unlikely so. Also it says "Pay CDN-like costs for your cloud applications – that’s Wasmer Edge." and I don't understand why I need to pay for the cloud if the app is serverless. That's exactly the point of serverless app that you don't need to pay for the servers because, well, the name implies that there is no server.
- syrusakbary 1y ago
  Thanks for the feedback. Normally, if you want to run your apps serverlessly you'll need to adapt your source code to it (both AWS Lambda and Cloudflare Workders require creating a custom HTTP handler). In our case, you can run your normal server (lets say uvicorn) without any code changes required from our side. Of course, you can already do this in Docker-enabled workloads: Google Cloud or Fly.io, for example. But that means that your apps will have long cold-start times at a way higher cost (no serverless). Hope this makes things clear!
  - codedokode 1y ago
    Thank you for the explanation, now I can better see the differences between "serverless" platforms although I am still a little disappointed that so called "serverless" apps still require a (paid) server despite the name.
    - __MatrixMan__ 1y ago
      This bugs me all the time. Ethernet is serverless. Minesweeper is serverless. AWS Lambda is quite serverful, you're just not allowed to get a shell on that server.
- mvhv 1y ago
  I believe "serverless" in this sense means "like AWS lambda". Theoretically you upload some small scripts and they're executed on-demand out of a big resource pool, rather than you paying for/running an entire server yourself. It seems like a horrible way to build a system with any significant level of complexity, but idk maybe it makes sense for very rarely used and light routes?
LudwigNagasena 1y ago
Does your solution support interop between modules written in different languages? I would love to be able to pass POD objects between Python and JS inside the same runtime.
- theanonymousone 1y ago
  For a backend project in Java, I use Jep for Python interoperability and making use of Python ecosystem. It gives me a "non-restricted" Python to have in my Java code, something I'm quite happy with. Wondering how this compares to that . See https://github.com/ninia/jep https://github.com/ninia/jep
999900000999 1y ago
I actually want browsers to support other languages natively. Brendan Eich ( the creator of JavaScript) was kind enough chime in that it would be impossible for variety of reasons. Obviously he knows more about this than me, but I think Google could put Dart in there if they really wanted. WebAssembly is pretty close though.
- willseth 1y ago
  Ideally, sure, but that would increase the already enormous burden of building a standards compliant web browser. For a healthy web ecosystem it's important that not only trillion dollar companies can contribute or compete.
  - 999900000999 1y ago
    Not every single website needs to support every single browser. This is a modern convenience, I was doing QA back in the day when we still had to support Internet explorer. Internet explorer just didn't provide the same experience as Chrome.
    - tclancy 1y ago
      I was doing building and qa when we had to support Netscape Navigator. Not having a varied set of options for browsers comes with clear downsides.
      - 999900000999 1y ago
        I think we agree ? For example if Firefox decides to add Rust support it doesn't mean every other browser needs to support it. Just a handful of web experiences are going to be exclusive to Firefox. As is having Chrome as the only browser most people use isn't great for innovation.
        lomase 1y ago
        Back to Internet Explorer ActiveX times.
theanonymousone 1y ago
Wondering how this compares to e.g. Jep for Java/Python interoperability (https://github.com/ninia/jep https://github.com/ninia/jep). Would be way more exciting if it could _compile_ Python to Wasm (or does it?).
- Imustaskforhelp 1y ago
  wait why is this the first time I saw something like this! I remember when I was in 6th grade wanting to make some minecraft mods but didn't want to learn java for it and wanted something like python. I also remember a video that did something like that but it was highly limited or smth iirc. Could this be used to create a minecraft plugin in python? Edit: Damn, there is this pyspigot thing which seems really fascinating.. https://pyspigot-docs.magicmq.dev/#getting-started https://pyspigot-docs.magicmq.dev/#getting-started Tbh, nowadays I would prefer writing minecraft mods in kotlin but the pyspigot code is also definitely really interesting!
didip 1y ago
How does WASM replace/implement language specific features like goroutines or Python's asyncio loop, or the specifics of each language's GC?
- kg 1y ago
  Depending on the language, GC is either implemented in userspace using linear memory, or using the new GC extension to webassembly. The latter has some restrictions that mean not every language can use it and it's not a turnkey integration (you have to do a lot of work), but there are a bunch of implementations now that use wasm's native GC. If you use wasm's native GC your objects are managed by the WASM runtime (in browsers, a JS runtime). For things like goroutines you would emulate them using wasm primitives like exception handling, unless you're running in a host that provides syscalls you can use to do stuff like stack switching natively. (IIRC stack switching is proposed but not yet a part of any production WASM runtime - see https://webassembly.org/features/ https://webassembly.org/features/) Based on what I read in a quick search, what Go does is generate each goroutine as a switch statement based on a state variable, so that you can 'resume' a goroutine by calling the switch with the appropriate state variable to resume its execution at the right point.
- rtpg 1y ago
  currently CPython's WASI build does not have asyncio support out of the box (at least according to [0]). This is, by my understanding, downstream of asyncio implementations in the standard library being built off of primitives around sockets and the like. And WASI, again by my understanding, does not support sockets. In a browser environment there are theoretically ways you could piggyback off of the async support in the native ecosystem. But CPython is written to certain systems, so you're talking about CPython patches. BUT the kind of beautiful thing is you can show up with your own asyncio event loop! So for example Pyodide just ships its own asyncio event loop[1]. This is possible thanks to Python's async infra just being built off of its generator concepts. async/await is, in itself, not something that "demands" I/O, just asyncio is. [0]: https://docs.python.org/3.13/library/asyncio.html https://docs.python.org/3.13/library/asyncio.html [1]: https://pyodide.org/en/stable/project/release-notes/v0.17.0.html https://pyodide.org/en/stable/project/release-notes/v0.17.0....
PaulHoule 1y ago
FFI support (like they have) is essential for any alternative Python to be worthwhile because so much of what makes Python useful today is numpy and keras and things like that. That said, there is a need for accelerating branchy pure-python workloads too, I did a lot of work with rdflib where PyPy made all the difference and we also need runtimes that can accelerate those workloads.
brumar 1y ago
Are dependencies easier to install or does it work only for packages that have pure wheel support?
alex_reg 1y ago
Hmm, I tried it out. > wasmer app create --template=static-website gets you from empty folder to initialized template and deployed static website in like 10 seconds when logged in. Pretty nice.
- 01HNNWZ0MV43FF 1y ago
  What does that do? A static website with some language compiled to wasm running in the browser?
pzo 1y ago
Would it be possible to make it work on iOS or android? I always missed better support of python on mobiles. In the past used PythonKit rapid prototype and interop with Swift but had limited set of modules. Wish to use this in react native for interop between js and python
- syrusakbary 1y ago
  Yes, running Wasmer Python package on iOS or Android is 100% doable. In fact, we want to even run it on browsers. We are small team, so we have to pick our battles very carefully, but we would welcome any patch to make it work (if it doesn't work already!).
HPsquared 1y ago
JuputerLite also does this. Uses local storage and Pyodide kernel (python on wasm). It has a special version of pip, and wasm versions of a lot of libraries which usually use native code (numpy etc). Super impressive. https://jupyter.org/try-jupyter/lab/ https://jupyter.org/try-jupyter/lab/
- syrusakbary 1y ago
  We are actually going on another direction. Philosophically speaking I believe we should not require a special version of pip to install packages, nor a "lite" version of Jupyter to run in WebAssembly. We should be able to run Jupyter fully within the Wasmer ecosystem without requiring any changes on the package (to run either in the browser or the server).
  - amluto 1y ago
    How close is this to working? Can this new stack run a Jupyter kernel within a browser and get the front end to talk to it in the same browser?
rcarmo 1y ago
Nice, but every time I look into WASM I have to wonder if containers and/or lite weight VMs wouldn’t be simpler and have less restrictions. We seem to have forgotten about microkernels and custom runtimes (like the various Erlang ones) as well… Still, that close to native Python is an interesting place to be.
- r9295 1y ago
  WASM runs in the browser which is why it receives so much consideration (rightfully so).
  - rcarmo 1y ago
    Yes, but I am more concerned with server-side, where you need to do a bit more and with better performance.
- 9cb14c1ec0 1y ago
  VMs are much more complex that running a wasm process.
  - rcarmo 1y ago
    Not at scale. At scale, kubevirt has you covered, even without lightweight hypervisors.
DonHopkins 1y ago
WASMBots: Fast, Cheap, and Out Of Control! https://people.csail.mit.edu/brooks/papers/fast-cheap.pdf https://people.csail.mit.edu/brooks/papers/fast-cheap.pdf
jonny_eh 1y ago
I get an https error at https://docs.wasmer.io/ https://docs.wasmer.io/: net::ERR_CERT_AUTHORITY_INVALID
spicypixel 1y ago
Are we at the point where I can store arbitrary scripts in a sql database and execute them with arguments, safely in a python sandbox from a host language that may or may not be python, and return the value(s) to the caller? I'd love to implement customer supplied transformation scripts for exports of data but I need this python to be fully sandboxed and only operate on the data I give it.
- btown 1y ago
  Arguably/pedantically, Pyodide has had this for a while: see https://developer.nvidia.com/blog/sandboxing-agentic-ai-workflows-with-webassembly/ https://developer.nvidia.com/blog/sandboxing-agentic-ai-work... for a use case. Wasmer's approach hints at faster cold starts and better overall performance; the benchmarking against pyodide is a bit unclear, and it's unclear to me whether that would make or break viability for a use case like this. But one thing this does make possible is if your arbitrary script is actually a persistent server, you can deploy that to edge servers, and interact with your arbitrary scripts over the network in a safe and sandboxed way!
  - simonw 1y ago
    I hadn't seen that NVIDIA article before... turns out they're running Python inside Pyodide inside WebAssembly inside Chrome inside Playwright inside Node.js! https://github.com/JosephTLucas/wasm-plotly/blob/main/server.js https://github.com/JosephTLucas/wasm-plotly/blob/main/server... I'm always on the lookout for ways to run Python in a sandbox but that feels like one too many levels for me. Pyodide inside Deno removes at least the headless browser layer: https://til.simonwillison.net/deno/pyodide-sandbox https://til.simonwillison.net/deno/pyodide-sandbox
- simonw 1y ago
  That's almost exactly what I want to do too. I've experimented a bit with QuickJS for this - there's a Python module here that looks reasonably robust https://pypi.org/project/quickjs/ https://pypi.org/project/quickjs/ - but my ideal would be a WebAssembly sandbox since that's the world's most widely tested sandbox at this point.
- 1y ago
IshKebab 1y ago
To be clear "fast" means "almost as fast as native Python", not "actually fast". Impressive achievement anyway.
- lomase 1y ago
  "fast" is not "blazing fast"
  - wiseowise 1y ago
    “Fast” applies to Java/C#/Node, if it’s native Python then it is anything but fast.
crashabr 1y ago
I'm not sure I understand correctly: is it a new serverless offering competing with the likes of vercel and fly.io, but with a different technology and pricing strategy? And the wasm container means that I can deploy my streamlit of FastAPI ETL apps without the Docker overhead or slowness of streamlit cloud?
indigodaddy 1y ago
Would the app have outbound network access to do some Python scheduling stuff that involves pulling from another endpoint? Eg something like this flask-based app? (Yes the code is shit, I’m just a sysadmin learning Python with some AI support at that time). https://github.com/jgbrwn/my-upc/blob/main/app.py https://github.com/jgbrwn/my-upc/blob/main/app.py Also, if wasmer supports Starlette, I assume it would support FastHTML (web framework that uses Starlette under the hood) ?
- jph00 1y ago
  Yes, since it supports Starlette/ASGI, FastHTML should work just fine.
  - syrusakbary 1y ago
    FastHTML requires apsw (SQLite wrapper) even if you don't use it. We already compiled apsw to WASIX but it also requires publishing a new version of Python to Wasmer (with sqlite dynamically linked instead of statically linked). We will release a new Python version by the end of this week / beginning of next one, so by then FastHTML should be fully work in Wasmer! (both runtime and Edge)
    - indigodaddy 1y ago
      Sounds awesome!
- indigodaddy 1y ago
  Actually I’d imagine probably scheduling won’t work at all with wasmer?
  - syrusakbary 1y ago
    Wasmer already support jobs (cron jobs, and jobs after certain triggers: deployment, app creation, ...), although is not fully documented yet. We'll be improving our docs soon!
1024bees 1y ago
this rocks, using python as an embedded scripting language is Easy and Cool but also Dangerous and Evil, feel like this could make it less dangerous.
zzzeek 1y ago
> Now, you can run any kind of Python API server, powered by fastapi, django, flask, or starlette, connected to a MySQL database automatically when needed I assume this is targeting the standalone WebAssembly use case, we're not...running MySQL in browsers right?
neuroelectron 1y ago
How are you going to sandbox WebAsm when it's not even defined?
liqilin1567 1y ago
I am so excited about python edge supported by wasm because I used python on cloudflare worker but there are so many limitations just simple pure python code supported.
Panzerschrek 1y ago
Isn't it just Python built with Emscripten?
- the_duke 1y ago
  Wasmer doesn't use Emscripten, but WASIX. See https://wasix.org/ https://wasix.org/
koeng 1y ago
Very cool! I’ve been looking at using lua for something like this: basically, users will be able to program robots in my lab (biotech) to do things, and I need a scripting language I can easily embed and control the runtime of in the larger system. Lua is theoretically better in… almost every way, except everyone in bio uses python. So it could allow more easy modification of LLM generated scripts (not worried about the libraries because I mostly want to limit them: the scripts are mainly to just run robots, and you can have them webhook out if you need complicated stuff) My question would be: would running a python sandbox vs a lua sandbox actually be appreciably better? Not sure yet, but will have to investigate with this new package (since it has Go bindings!)
- ModernMech 1y ago
  Curious given you looked at both why you considered Lua to be better. I'd like to use Lua to teach freshmen and I need some arguments as to why it's better than Python.
  - koeng 1y ago
    Much better embedability and much easier to make it safely embedded. Doesn't require a wasm compilation, just can be in raw C, and that lua can directly integrate with host functions and vice versa - something even these wasm implementations struggle with. Also, with luajit, it is much faster.
jiri 1y ago
Wouldnt be better to have sandboxing built directly to cpython? Why there is no such thing already "include" in cpython? Or maybe to create some limited sandboxed venv?
deleted 1y ago
[deleted]
anentropic 1y ago
The close to 'native' Python performance looks promising! Just want to point out that this section avoids mentioning the best way to do it: > AWS Lambda doesn't natively run unmodified Python apps: > > - You need adapters (such as https://github.com/slank/awsgi or https://github.com/Kludex/mangum) for running your WSGI sites. > - WebSockets are unsupported. > - Setup is complex, adapters are often unmaintained. AWS provides https://github.com/awslabs/aws-lambda-web-adapter https://github.com/awslabs/aws-lambda-web-adapter which is a) supported and b) written Rust, providing a translation of Lambda requests back into HTTP so you can use your usual entry point to the WSGI app. It is simple to set up. WebSockets still not supported of course, but the issue of adapters is solved.
- kketch 1y ago
  You can also use Websockets with AWS Lambda through API Gateway. And you can also use Websockets with Cloudflare workers: https://developers.cloudflare.com/workers/runtime-apis/websockets/ https://developers.cloudflare.com/workers/runtime-apis/webso... However it's worth point that due to the concurrency model of AWS Lambda (1 client request / ws message = 1 lambda invocation / one process only ever handles one request at a time before it can handle the next one), you would end up spawning much more AWS Lambda instances than you would with Cloudflare workers or Wasmer Edge. There are cost implications obviously, but AWS lambda works this way also to make concurrency and scaling "simpler" by providing an easier mental model. Though much more expensive in theory
Mikhail_K 1y ago
Words "Python" and "fast" do not belong in the same sentence.
- ModernMech 1y ago
  Yeah, when I see these kinds of headlines about Python, I'm always left wondering what they mean by "fast". In this case, "fast" means "still slower than Python usually is".
- dominicrose 1y ago
  python is fast because computers are fast, but yea compared to rust it isn't, and in a lot of cases it doesn't have to be
xrd 1y ago
I don't see a mention of uv here. Since LLMs have made me so lazy that I never bother to search or read on my own, can someone tell me whether I can use uv as my project management tool with wasmer? What's the story here? I simply CANNOT go back to use packages without uv, it would be unthinkable to me. Actually, now that I think of it, my laziness might have started when I learned perl 30 years ago.
- baalimago 1y ago
  It may be built in different ways, but uv is one of them yes. Check out the fastapi + websockets example here: https://github.com/wasmer-examples/python-fastapi-websockets https://github.com/wasmer-examples/python-fastapi-websockets
BinaryIgor 1y ago
Interesting - do they compile Python to WebAssembly or just have a Python interpreter compiled to WebAssembly and running as usual?
- syrusakbary 1y ago
  This time we compiled the Python interpreter to WebAssembly. If you are curious on compiling Python to WebAssembly please check py2wasm: https://wasmer.io/posts/py2wasm-a-python-to-wasm-compiler https://wasmer.io/posts/py2wasm-a-python-to-wasm-compiler
  - BinaryIgor 1y ago
    Interesting; I wonder what the limitations of WebAssembly are in this context, as compared to the machine code
- deleted 1y ago
  [deleted]
selinkocalar 1y ago
The sandboxing benefits are real, especially for multi-tenant environments where you can't trust user code. Performance is still going to be hit-or-miss depending on the workload.

399 points by baalimago 1y ago

pumanoir 1y ago

How would i use numpy from javascript using this?

syrusakbary 1y ago
Using Wasmer-JS that should be doable. We just need to release a new version!
- pumanoir 1y ago
  thanks. it'd be great to have a quick tutorial on doing so. this is close to my dream of creating Frankenstein apps with the web platform instead of graal :) https://www.graalvm.org/latest/reference-manual/polyglot-programming/ https://www.graalvm.org/latest/reference-manual/polyglot-pro...

simonw 1y ago

OK this looks promising: brew install wasmer wasmer run python/python@=0.2.0 Running that gave me a Python 3.12 shell apparently running entirely in a WebAssembly sandbox! I've been trying to find a robust, reliable and easy way to run a Python process in WebAssembly (outside of a browser) for a few years.

theanonymousone 1y ago
Hasn't Pyodide been available for some years now?
- simonw 1y ago
  Yes but it works only in the browser - running Pyodide outside of a browser is a lot of extra work. My previous attempts are described here: - https://til.simonwillison.net/deno/pyodide-sandbox https://til.simonwillison.net/deno/pyodide-sandbox - https://til.simonwillison.net/webassembly/python-in-a-wasm-sandbox https://til.simonwillison.net/webassembly/python-in-a-wasm-s...
  - almostgotcaught 1y ago
    not true pyodide venv .venv-pyodide source .venv-pyodide/bin/activate I don't know what runtime it uses but I have tests in nightly CI that run exactly like this. see https://pyodide.org/en/stable/development/building-packages-from-source.html#testing-packages-against-pyodide https://pyodide.org/en/stable/development/building-packages-...
    - simonw 1y ago
      Interesting - I hadn't seen that before: > Pyodide provides an experimental command line runner for testing packages against Pyodide. Using it requires nodejs version 20 or newer. Looks like it's a recent addition?
      - almostgotcaught 1y ago
        No clue - I added that CI job around 6 months ago.
        simonw 1y ago
        I tracked it down to this PR from September 2022, so it's been around for a while: https://github.com/pyodide/pyodide/pull/2976 https://github.com/pyodide/pyodide/pull/2976
  - ZhiqiangWang 1y ago
    What is the point of running python in webassembly outside browser?
    - simonw 1y ago
      See comment here: https://news.ycombinator.com/item?id=45365165 https://news.ycombinator.com/item?id=45365165 I want a robust sandbox I can run untrusted code in, outside of the browser.
syrusakbary 1y ago
Thanks! Forgot to put it on the article, but the latest Python requires the Wasmer rc.5 to run! (the final release will be coming very soon) curl https://get.wasmer.io -sSfL | sh -s "v6.1.0-rc.5" wasmer run python/python
- klas_segeljakt 1y ago
  I tried to run these commands. It downloads python@3.13.1, but then hangs without producing any output. However, it seems to work for wasmer run python/python@=0.2.0
deleted 1y ago
[deleted]
behnamoh 1y ago
``` ╰─ wasmer run python/python error: Spawn failed ╰─▶ 1: compile error: Validate("exceptions proposal not enabled (at offset 0x191a)") ```
- the_duke 1y ago
  You'll need the latest wasmer RC for proper exceptions support. We unfortunately didn't get the final release out quite in time... curl https://get.wasmer.io -sSfL | sh -s "v6.1.0-rc.5" wasmer run python/python
  - simonw 1y ago
    How long should it take for "wasmer run python/python" to start showing me output? It's been hung for a while for me now (I upgraded to wasmer 6.1.0-rc.5). "wasmer run python/python@=0.2.0" on the same machine gets me into Python 3.12.0 almost instantly.
    - the_duke 1y ago
      Compilation with LLVM takes quite a while (the final release will show a spinner...). So please wait a bit - subsequent runs will be fast, since compiled Python will be cached.
      - simonw 1y ago
        Oh so it's actually compiling everything on my machine? Any chance `wasmer run python/python` might download a pre-compiled version in the future?
        the_duke 1y ago
        Yeah, that's mentioned as a small side note in the blog post - we are working on it, and will hopefully have it ready in a week or two!
        1y ago
giancarlostoro 1y ago
Everyday we grow closer to my dream of having a WASM based template engine for Python, similar to how Blazor takes Razor and builds it to WASM. I might have to toy with this when I get home.
- BiteCode_dev 1y ago
  Ideally, something that we could share between JS and Python.
mr_toad 1y ago
> I've been trying to find a robust, reliable and easy way to run a Python process in WebAssembly (outside of a browser) for a few years. reply What’s the use case? Is it the sandboxing? Is it easier than running Python in a container?
- NeutralForest 1y ago
  The sandboxing, especially for AI Agents.
- simonw 1y ago
  I want to be able to run code from untrusted sources (other people, users of my SaaS application, LLMs) in an environment, where I can control the blast radius if something goes wrong.
  - BeefySwain 1y ago
    What's wrong with Docker for this?
    - hmmokidk 1y ago
      Docker would be hacky and cumbersome especially when compared to anything assembly like.
    - simonw 1y ago
      I keep on hearing that Docker isn't designed as a security boundary for this kind of thing. Firecracker is meant to be secure but it's a lot harder to work with.
      - phrotoma 1y ago
        Hey Simon, given it's you ... are you concerned about LLMs attempting to escape from within the confines of a Docker container or is this more about mitigating things like supply chain attacks?
trehans 1y ago
Does this work for packages with C/C++ extensions e.g. numpy and scipy?
- ashvardanian 1y ago
  Seems like it already does for some, assuming Pillow and FFMpeg are on the list.
- zebreus 1y ago
  Building packages with C/C++ extensions is still a bit tricky but you can see a list of all prebuilt packages for wasmer at https://pythonindex.wasix.org https://pythonindex.wasix.org . numpy is available there, scipy not (yet).
  - Art9681 1y ago
    Bummer. Back to Docker then.
  - gvkhna 1y ago
    Wow, this is the key. If it just had python that’s not as useful but the major frameworks is the real value. Definitely going to keep an eye on this. I built a sandbox with deno for ai code generation. It works well enough but there are some use cases where python may make more sense. Nice!
    - indigodaddy 1y ago
      Any chance your deno thing is on GH?
      - gvkhna 1y ago
        Yup, github.com/gvkhna/vibescraper in the sandbox package. Def needs a cleanup but it’s heavily tested and works great at aivibescraper.com

codedokode 1y ago

I tried to understand what is "Wasmer Edge" but couldn't. They say on the front page "Make any app serverless. The cheapest, fastest and most scalable way to deploy is on the edge." and it seems like I can upload the source code of any app and they will convert it for me? Unlikely so. Also it says "Pay CDN-like costs for your cloud applications – that’s Wasmer Edge." and I don't understand why I need to pay for the cloud if the app is serverless. That's exactly the point of serverless app that you don't need to pay for the servers because, well, the name implies that there is no server.

syrusakbary 1y ago
Thanks for the feedback. Normally, if you want to run your apps serverlessly you'll need to adapt your source code to it (both AWS Lambda and Cloudflare Workders require creating a custom HTTP handler). In our case, you can run your normal server (lets say uvicorn) without any code changes required from our side. Of course, you can already do this in Docker-enabled workloads: Google Cloud or Fly.io, for example. But that means that your apps will have long cold-start times at a way higher cost (no serverless). Hope this makes things clear!
- codedokode 1y ago
  Thank you for the explanation, now I can better see the differences between "serverless" platforms although I am still a little disappointed that so called "serverless" apps still require a (paid) server despite the name.
  - __MatrixMan__ 1y ago
    This bugs me all the time. Ethernet is serverless. Minesweeper is serverless. AWS Lambda is quite serverful, you're just not allowed to get a shell on that server.
mvhv 1y ago
I believe "serverless" in this sense means "like AWS lambda". Theoretically you upload some small scripts and they're executed on-demand out of a big resource pool, rather than you paying for/running an entire server yourself. It seems like a horrible way to build a system with any significant level of complexity, but idk maybe it makes sense for very rarely used and light routes?

LudwigNagasena 1y ago

Does your solution support interop between modules written in different languages? I would love to be able to pass POD objects between Python and JS inside the same runtime.

theanonymousone 1y ago
For a backend project in Java, I use Jep for Python interoperability and making use of Python ecosystem. It gives me a "non-restricted" Python to have in my Java code, something I'm quite happy with. Wondering how this compares to that . See https://github.com/ninia/jep https://github.com/ninia/jep

999900000999 1y ago

I actually want browsers to support other languages natively. Brendan Eich ( the creator of JavaScript) was kind enough chime in that it would be impossible for variety of reasons. Obviously he knows more about this than me, but I think Google could put Dart in there if they really wanted. WebAssembly is pretty close though.

willseth 1y ago
Ideally, sure, but that would increase the already enormous burden of building a standards compliant web browser. For a healthy web ecosystem it's important that not only trillion dollar companies can contribute or compete.
- 999900000999 1y ago
  Not every single website needs to support every single browser. This is a modern convenience, I was doing QA back in the day when we still had to support Internet explorer. Internet explorer just didn't provide the same experience as Chrome.
  - tclancy 1y ago
    I was doing building and qa when we had to support Netscape Navigator. Not having a varied set of options for browsers comes with clear downsides.
    - 999900000999 1y ago
      I think we agree ? For example if Firefox decides to add Rust support it doesn't mean every other browser needs to support it. Just a handful of web experiences are going to be exclusive to Firefox. As is having Chrome as the only browser most people use isn't great for innovation.
      - lomase 1y ago
        Back to Internet Explorer ActiveX times.

theanonymousone 1y ago

Wondering how this compares to e.g. Jep for Java/Python interoperability (https://github.com/ninia/jep https://github.com/ninia/jep). Would be way more exciting if it could _compile_ Python to Wasm (or does it?).

Imustaskforhelp 1y ago
wait why is this the first time I saw something like this! I remember when I was in 6th grade wanting to make some minecraft mods but didn't want to learn java for it and wanted something like python. I also remember a video that did something like that but it was highly limited or smth iirc. Could this be used to create a minecraft plugin in python? Edit: Damn, there is this pyspigot thing which seems really fascinating.. https://pyspigot-docs.magicmq.dev/#getting-started https://pyspigot-docs.magicmq.dev/#getting-started Tbh, nowadays I would prefer writing minecraft mods in kotlin but the pyspigot code is also definitely really interesting!

didip 1y ago

How does WASM replace/implement language specific features like goroutines or Python's asyncio loop, or the specifics of each language's GC?

kg 1y ago
Depending on the language, GC is either implemented in userspace using linear memory, or using the new GC extension to webassembly. The latter has some restrictions that mean not every language can use it and it's not a turnkey integration (you have to do a lot of work), but there are a bunch of implementations now that use wasm's native GC. If you use wasm's native GC your objects are managed by the WASM runtime (in browsers, a JS runtime). For things like goroutines you would emulate them using wasm primitives like exception handling, unless you're running in a host that provides syscalls you can use to do stuff like stack switching natively. (IIRC stack switching is proposed but not yet a part of any production WASM runtime - see https://webassembly.org/features/ https://webassembly.org/features/) Based on what I read in a quick search, what Go does is generate each goroutine as a switch statement based on a state variable, so that you can 'resume' a goroutine by calling the switch with the appropriate state variable to resume its execution at the right point.
rtpg 1y ago
currently CPython's WASI build does not have asyncio support out of the box (at least according to [0]). This is, by my understanding, downstream of asyncio implementations in the standard library being built off of primitives around sockets and the like. And WASI, again by my understanding, does not support sockets. In a browser environment there are theoretically ways you could piggyback off of the async support in the native ecosystem. But CPython is written to certain systems, so you're talking about CPython patches. BUT the kind of beautiful thing is you can show up with your own asyncio event loop! So for example Pyodide just ships its own asyncio event loop[1]. This is possible thanks to Python's async infra just being built off of its generator concepts. async/await is, in itself, not something that "demands" I/O, just asyncio is. [0]: https://docs.python.org/3.13/library/asyncio.html https://docs.python.org/3.13/library/asyncio.html [1]: https://pyodide.org/en/stable/project/release-notes/v0.17.0.html https://pyodide.org/en/stable/project/release-notes/v0.17.0....

PaulHoule 1y ago

FFI support (like they have) is essential for any alternative Python to be worthwhile because so much of what makes Python useful today is numpy and keras and things like that. That said, there is a need for accelerating branchy pure-python workloads too, I did a lot of work with rdflib where PyPy made all the difference and we also need runtimes that can accelerate those workloads.

brumar 1y ago

Are dependencies easier to install or does it work only for packages that have pure wheel support?

alex_reg 1y ago

Hmm, I tried it out. > wasmer app create --template=static-website gets you from empty folder to initialized template and deployed static website in like 10 seconds when logged in. Pretty nice.

01HNNWZ0MV43FF 1y ago
What does that do? A static website with some language compiled to wasm running in the browser?

pzo 1y ago

Would it be possible to make it work on iOS or android? I always missed better support of python on mobiles. In the past used PythonKit rapid prototype and interop with Swift but had limited set of modules. Wish to use this in react native for interop between js and python

syrusakbary 1y ago
Yes, running Wasmer Python package on iOS or Android is 100% doable. In fact, we want to even run it on browsers. We are small team, so we have to pick our battles very carefully, but we would welcome any patch to make it work (if it doesn't work already!).

HPsquared 1y ago

JuputerLite also does this. Uses local storage and Pyodide kernel (python on wasm). It has a special version of pip, and wasm versions of a lot of libraries which usually use native code (numpy etc). Super impressive. https://jupyter.org/try-jupyter/lab/ https://jupyter.org/try-jupyter/lab/

syrusakbary 1y ago
We are actually going on another direction. Philosophically speaking I believe we should not require a special version of pip to install packages, nor a "lite" version of Jupyter to run in WebAssembly. We should be able to run Jupyter fully within the Wasmer ecosystem without requiring any changes on the package (to run either in the browser or the server).
- amluto 1y ago
  How close is this to working? Can this new stack run a Jupyter kernel within a browser and get the front end to talk to it in the same browser?

rcarmo 1y ago

Nice, but every time I look into WASM I have to wonder if containers and/or lite weight VMs wouldn’t be simpler and have less restrictions. We seem to have forgotten about microkernels and custom runtimes (like the various Erlang ones) as well… Still, that close to native Python is an interesting place to be.

r9295 1y ago
WASM runs in the browser which is why it receives so much consideration (rightfully so).
- rcarmo 1y ago
  Yes, but I am more concerned with server-side, where you need to do a bit more and with better performance.
9cb14c1ec0 1y ago
VMs are much more complex that running a wasm process.
- rcarmo 1y ago
  Not at scale. At scale, kubevirt has you covered, even without lightweight hypervisors.

DonHopkins 1y ago

WASMBots: Fast, Cheap, and Out Of Control! https://people.csail.mit.edu/brooks/papers/fast-cheap.pdf https://people.csail.mit.edu/brooks/papers/fast-cheap.pdf

jonny_eh 1y ago

I get an https error at https://docs.wasmer.io/ https://docs.wasmer.io/: net::ERR_CERT_AUTHORITY_INVALID

spicypixel 1y ago

Are we at the point where I can store arbitrary scripts in a sql database and execute them with arguments, safely in a python sandbox from a host language that may or may not be python, and return the value(s) to the caller? I'd love to implement customer supplied transformation scripts for exports of data but I need this python to be fully sandboxed and only operate on the data I give it.

btown 1y ago
Arguably/pedantically, Pyodide has had this for a while: see https://developer.nvidia.com/blog/sandboxing-agentic-ai-workflows-with-webassembly/ https://developer.nvidia.com/blog/sandboxing-agentic-ai-work... for a use case. Wasmer's approach hints at faster cold starts and better overall performance; the benchmarking against pyodide is a bit unclear, and it's unclear to me whether that would make or break viability for a use case like this. But one thing this does make possible is if your arbitrary script is actually a persistent server, you can deploy that to edge servers, and interact with your arbitrary scripts over the network in a safe and sandboxed way!
- simonw 1y ago
  I hadn't seen that NVIDIA article before... turns out they're running Python inside Pyodide inside WebAssembly inside Chrome inside Playwright inside Node.js! https://github.com/JosephTLucas/wasm-plotly/blob/main/server.js https://github.com/JosephTLucas/wasm-plotly/blob/main/server... I'm always on the lookout for ways to run Python in a sandbox but that feels like one too many levels for me. Pyodide inside Deno removes at least the headless browser layer: https://til.simonwillison.net/deno/pyodide-sandbox https://til.simonwillison.net/deno/pyodide-sandbox
simonw 1y ago
That's almost exactly what I want to do too. I've experimented a bit with QuickJS for this - there's a Python module here that looks reasonably robust https://pypi.org/project/quickjs/ https://pypi.org/project/quickjs/ - but my ideal would be a WebAssembly sandbox since that's the world's most widely tested sandbox at this point.
1y ago

IshKebab 1y ago

To be clear "fast" means "almost as fast as native Python", not "actually fast". Impressive achievement anyway.

lomase 1y ago
"fast" is not "blazing fast"
- wiseowise 1y ago
  “Fast” applies to Java/C#/Node, if it’s native Python then it is anything but fast.

crashabr 1y ago

I'm not sure I understand correctly: is it a new serverless offering competing with the likes of vercel and fly.io, but with a different technology and pricing strategy? And the wasm container means that I can deploy my streamlit of FastAPI ETL apps without the Docker overhead or slowness of streamlit cloud?

indigodaddy 1y ago

Would the app have outbound network access to do some Python scheduling stuff that involves pulling from another endpoint? Eg something like this flask-based app? (Yes the code is shit, I’m just a sysadmin learning Python with some AI support at that time). https://github.com/jgbrwn/my-upc/blob/main/app.py https://github.com/jgbrwn/my-upc/blob/main/app.py Also, if wasmer supports Starlette, I assume it would support FastHTML (web framework that uses Starlette under the hood) ?

jph00 1y ago
Yes, since it supports Starlette/ASGI, FastHTML should work just fine.
- syrusakbary 1y ago
  FastHTML requires apsw (SQLite wrapper) even if you don't use it. We already compiled apsw to WASIX but it also requires publishing a new version of Python to Wasmer (with sqlite dynamically linked instead of statically linked). We will release a new Python version by the end of this week / beginning of next one, so by then FastHTML should be fully work in Wasmer! (both runtime and Edge)
  - indigodaddy 1y ago
    Sounds awesome!
indigodaddy 1y ago
Actually I’d imagine probably scheduling won’t work at all with wasmer?
- syrusakbary 1y ago
  Wasmer already support jobs (cron jobs, and jobs after certain triggers: deployment, app creation, ...), although is not fully documented yet. We'll be improving our docs soon!

1024bees 1y ago

this rocks, using python as an embedded scripting language is Easy and Cool but also Dangerous and Evil, feel like this could make it less dangerous.

zzzeek 1y ago

> Now, you can run any kind of Python API server, powered by fastapi, django, flask, or starlette, connected to a MySQL database automatically when needed I assume this is targeting the standalone WebAssembly use case, we're not...running MySQL in browsers right?

neuroelectron 1y ago

How are you going to sandbox WebAsm when it's not even defined?

liqilin1567 1y ago

I am so excited about python edge supported by wasm because I used python on cloudflare worker but there are so many limitations just simple pure python code supported.

Panzerschrek 1y ago

Isn't it just Python built with Emscripten?

the_duke 1y ago
Wasmer doesn't use Emscripten, but WASIX. See https://wasix.org/ https://wasix.org/

koeng 1y ago

Very cool! I’ve been looking at using lua for something like this: basically, users will be able to program robots in my lab (biotech) to do things, and I need a scripting language I can easily embed and control the runtime of in the larger system. Lua is theoretically better in… almost every way, except everyone in bio uses python. So it could allow more easy modification of LLM generated scripts (not worried about the libraries because I mostly want to limit them: the scripts are mainly to just run robots, and you can have them webhook out if you need complicated stuff) My question would be: would running a python sandbox vs a lua sandbox actually be appreciably better? Not sure yet, but will have to investigate with this new package (since it has Go bindings!)

ModernMech 1y ago
Curious given you looked at both why you considered Lua to be better. I'd like to use Lua to teach freshmen and I need some arguments as to why it's better than Python.
- koeng 1y ago
  Much better embedability and much easier to make it safely embedded. Doesn't require a wasm compilation, just can be in raw C, and that lua can directly integrate with host functions and vice versa - something even these wasm implementations struggle with. Also, with luajit, it is much faster.

jiri 1y ago

Wouldnt be better to have sandboxing built directly to cpython? Why there is no such thing already "include" in cpython? Or maybe to create some limited sandboxed venv?

deleted 1y ago

[deleted]

anentropic 1y ago

The close to 'native' Python performance looks promising! Just want to point out that this section avoids mentioning the best way to do it: > AWS Lambda doesn't natively run unmodified Python apps: > > - You need adapters (such as https://github.com/slank/awsgi or https://github.com/Kludex/mangum) for running your WSGI sites. > - WebSockets are unsupported. > - Setup is complex, adapters are often unmaintained. AWS provides https://github.com/awslabs/aws-lambda-web-adapter https://github.com/awslabs/aws-lambda-web-adapter which is a) supported and b) written Rust, providing a translation of Lambda requests back into HTTP so you can use your usual entry point to the WSGI app. It is simple to set up. WebSockets still not supported of course, but the issue of adapters is solved.

kketch 1y ago
You can also use Websockets with AWS Lambda through API Gateway. And you can also use Websockets with Cloudflare workers: https://developers.cloudflare.com/workers/runtime-apis/websockets/ https://developers.cloudflare.com/workers/runtime-apis/webso... However it's worth point that due to the concurrency model of AWS Lambda (1 client request / ws message = 1 lambda invocation / one process only ever handles one request at a time before it can handle the next one), you would end up spawning much more AWS Lambda instances than you would with Cloudflare workers or Wasmer Edge. There are cost implications obviously, but AWS lambda works this way also to make concurrency and scaling "simpler" by providing an easier mental model. Though much more expensive in theory

Mikhail_K 1y ago

Words "Python" and "fast" do not belong in the same sentence.

ModernMech 1y ago
Yeah, when I see these kinds of headlines about Python, I'm always left wondering what they mean by "fast". In this case, "fast" means "still slower than Python usually is".
dominicrose 1y ago
python is fast because computers are fast, but yea compared to rust it isn't, and in a lot of cases it doesn't have to be

xrd 1y ago

I don't see a mention of uv here. Since LLMs have made me so lazy that I never bother to search or read on my own, can someone tell me whether I can use uv as my project management tool with wasmer? What's the story here? I simply CANNOT go back to use packages without uv, it would be unthinkable to me. Actually, now that I think of it, my laziness might have started when I learned perl 30 years ago.

baalimago 1y ago
It may be built in different ways, but uv is one of them yes. Check out the fastapi + websockets example here: https://github.com/wasmer-examples/python-fastapi-websockets https://github.com/wasmer-examples/python-fastapi-websockets

BinaryIgor 1y ago

Interesting - do they compile Python to WebAssembly or just have a Python interpreter compiled to WebAssembly and running as usual?

syrusakbary 1y ago
This time we compiled the Python interpreter to WebAssembly. If you are curious on compiling Python to WebAssembly please check py2wasm: https://wasmer.io/posts/py2wasm-a-python-to-wasm-compiler https://wasmer.io/posts/py2wasm-a-python-to-wasm-compiler
- BinaryIgor 1y ago
  Interesting; I wonder what the limitations of WebAssembly are in this context, as compared to the machine code
deleted 1y ago
[deleted]

selinkocalar 1y ago

The sandboxing benefits are real, especially for multi-tenant environments where you can't trust user code. Performance is still going to be hit-or-miss depending on the workload.