Wasmer 3.0

https://wasmer.io/posts/announcing-wasmer-3.0

by syrusakbary • 4 years ago

305 183 4 years ago

Off topic but is there a good way of running wasi on browser?

There are multiple ways! I'd recommend `@wasmer/wasi` since it uses the same WASI implementation as Wasmer (compiled from Rust to Wasm using wasm-bindgen):

https://www.npmjs.com/package/@wasmer/wasi

williamstein3• 4 years ago

wasi-js is another one I’m actively supporting that is in pure JavaScript (hence small and easily hackable): https://www.npmjs.com/package/wasi-js

This is based on what wasmer used to provide for wasi in the browser before they did their major rewrite in rust mentioned above. I personally find the JavaScript version more useful for my projects so I revived their old project and am maintaining it.

Jaxkr• 4 years ago

support for multi-value functions

Link to example for this? Tried Wasmer about a year ago and had too much trouble passing multiple non-int args with a Rust host (so no JS bindgen)

syrusakbary5• 4 years ago

This test might be useful (although it might be a bit hard to read because of the usage of macros) [1]. We will create a simple example of multivalue to showcase how it can be used

[1] https://github.com/wasmerio/wasmer/blob/master/tests/compile...

nycticorax• 4 years ago

Can someone ELI5 what problem this solves? I think of WebAssembly as being a tool for getting code written in <random language> to run in a web client. Can't I already run code written in <random language> on a server that I control? Heck, PG went on at some length in one of his early essays about how that was one of the great things about the Web: you could use any language you wanted on the server. Even Common Lisp...

iknowstuff• 4 years ago

It lets you run untrusted code. Great for exposing a plugin API.

rglullis3• 4 years ago

"dumb clients" don't exist anymore. Why run things on the server and have to deal with scaling issues, if I can just distribute super complex applications easily and as reliably as publishing a web page?

satvikpendem2• 4 years ago

Next.js' (and others') server side rendering exists and React Server Components exist as well. We're seeing a reversion back to the server due to SEO and performance concerns.

clscott2• 4 years ago

It's also valuable for running code written in <random language> to be executed in <another random language>.

Write a library in Rust and compile it to WASM, theoretically any language with WASM bindings could run it.

This could really make niche languages more easily adopted if their execution environment supported libraries in WASM.

Imagine using Java's JDBC from something like Nim. Nim could take advantage of a 30 year old mature and fast database access framework without haveing to envest that ime and effort themselves.

Or even something more modern like the polars dataframe library.

ptx• 4 years ago

Imagine using Java's JDBC from something like Nim.

You can already do this with JNI. How does WASM improve things? In both cases (WASM or native code) you get the overhead of two runtimes and the hassle of converting data types, don't you?

MuffinFlavored3• 4 years ago

Write a library in Rust and compile it to WASM

this misses the fact that (unless I'm wrong), WASM by itself can't really do anything like file system/network operations

I know that's not the main usecase of where to put WASM logic that needs to be performant (it's the opposite really)

I just think it's worth calling out that a WASM library really can't do much from what I understand. Like... basic math? You have to supply it (through a WASM runtime) interop to other functions it can call... I think?

Would love to be taught/proven wrong.

cpeterso• 4 years ago

Firefox uses this approach to create a lightweight, in-process sandbox (called "RLBox") for some third-party libraries. The library is compiled from C/C++ to wasm and then wasm is transpiled back to C++, all at Firefox compile time so no wasm compilation is needed at Firefox run time.

https://hacks.mozilla.org/2021/12/webassembly-and-back-again...

hahnchen• 4 years ago

I think it’s meant to make it easier to use. They also have their whole package manager to use

jasonwatkinspdx• 4 years ago

WASM has an OS abstraction API that ends up being pretty good. There's work in progress on cross language resource sharing, interface types, etc. It's early days yet but this is generating excitement for WASM as a sort of very lightweight cross language container/vm.

It's also useful in "plugin" scenarios, like say filtering code in a network proxy. Or if you wanted to make your own Function as a Service system.

zrail2• 4 years ago

I'm not sure if it's mainstream but my thoughts on server-side WASM always run to user-provided logic. WASM provides a helpful building block for a generic user-provided logic sandboxed runtime.

Think about a workflow engine embedded in a marketing product. Usually there's some kind of GUI builder which generates an AST to be interpreted directly at runtime. What if instead the GUI generated a WASM artifact to be run on sandboxed runtimes?

What if, furthermore, you offered advanced users the opportunity to upload WASM binaries where they could implement arbitrarily complex logic to be executed in the sandbox?

I think this is a super powerful concept, although of course making a business case for implementing it is the trick.

fwsgonzo• 4 years ago

I don't think a server-side sandbox makes sense for anything that is JIT-based (or even binary translation). We already have KVM which is actual native performance, and it can run anything you would ever want, and then some. WASM is bytecode working on a 2GB linear arena, and it fits OK in a browser.

moralestapia• 4 years ago

wasm is a specification for a VM (VM as in Java, not as in AWS/docker).

wasm gives you the bare minimum to run, other projects fill the gaps between that and what you would normally expect for an execution environment (ABIs, file system access, stacks, etc...). wasmer is one of such projects.

trh0awayman• 4 years ago

WASM is basically a misnomer at this point. People are using it as a universal virtual machine/runtime. Whether that makes any sense is still an open question.

kbaker• 4 years ago

In your view, why does it not make sense? It certainly seems appealing as a universal runtime, and lives up to its claims as long as things like WASI get standardized.

CharlesW• 4 years ago

WASM is basically a misnomer at this point.

Web standards/technologies are in wide use outside of browsers (via things like Electron), so you may find that the name makes more sense when viewed through that lens.

thecosmicfrog• 4 years ago

An example of this is Microsoft Flight Simulator. Packages such as aircraft are distributed/compiled as WASM modules and run (as I understand it) in a sandboxed environment within the simulator.

cheriot• 4 years ago

Plugins for desktop apps would be safer if the plugin is run with WASM.

flohofwoe9• 4 years ago

WASM is also useful for distributing a single binary blob that runs on different Operating Systems and CPU architectures, instead of 'stamping out' NxM native executables. This area overlaps more with Java and .NET (but with more/different language options) than 'an alternative to JS in the browser'.

For instance I have a C++ shader compiler which includes some massive 3rd party libraries (glslangValidator, SPIRVTools and SPIRVCross) which takes forever to compile, so distributing in source code form is not really an option, and the only alternative is to ship precompiled binaries for each supported OS/CPU combination. Currently I do this via GH Actions, which kinda works, but just building a single WASM blob and shipping that to users (who then would need to install one of the WASM runtimes though) sounds kinda interesting.

PS: WASM may also be useful as universal plugin format. For instance the new Microsoft flight sim uses WASM instead of scripting or native DLLs for modding:

https://docs.flightsimulator.com/html/Programming_Tools/WASM...

kaba015• 4 years ago

Java’s GraalVM can do plenty of languages, on top of running managed ones much faster. I don’t see novelty here.

pjmlp11• 4 years ago

Basically what IBM and Unisys mainframes have been doing the last 60 years.

stefs• 4 years ago

i'd really wish game mods would be run with WASM. the current solution of downloading native code from third party websites always makes me highly uncomfortable.

Sodman• 4 years ago

Being able to add arbitrary logic to an otherwise static binary has a lot of interesting use cases. For example Envoy Proxy supports hot-loading arbitrary HTTP filters compiled to WASM into its filter-chain. This allows users to extend the feature set of Envoy, by adding custom logic to request parsing, reporting custom metrics, calling out to other services before forwarding the request, etc etc.

This allows their unique custom use-case-specific code to be managed separately to Envoy, so it can be ported across upgrades etc. It also means that if there's a very particular feature you want that's unique to your business, and wouldn't make sense to contribute to the upstream OSS project, you can write a WASM module for it.

It's somewhat niche, because anything built in this way which is generally useful to many users, will probably just be made a native feature of the host platform. Conversely, anything that does something significantly complex and custom should probably live as it's own stand-alone microservice somewhere. There's still a lot of room for value between the two extremes though!

brundolf2• 4 years ago

- Running code on a server you don't control

- Running code you don't fully trust on a server you do control

WASM comes with powerful sandboxing, and if you combine that with static linking you can pretty much drop Docker for your PaaS (and all the overhead/complexity/insecurity that comes with it). This is what Cloudflare Workers do

FooBarWidget• 4 years ago

And can someone ELI5 why WebAssembly is useful, given that there are already a myriad of other virtual machines out there (JVM, CLR, BEAM, etc)?

And why could/did those other virtual machines not evolve to fulfill the need that WebAssembly fulfills? Why is a new machine language and new virtual machine necessary?

IshKebab2• 4 years ago

Webassembly can be targeted by C/C++ and Rust. It's also designed with security in mind. The JVM is not a reliable sandbox.

indymike3• 4 years ago

And why could/did those other virtual machines not evolve to fulfill the need that WebAssembly fulfills?

All three were designed primarily as bytecode interpeters that would run as a layer between the OS and application, and were primarily designed to run stand-alone (i.e. desktop/server apps). Java was originally included in most web browsers, but the applet model just didn't get it done for users - and most Java software moved either be web applications (i.e. serving HTML) or desktop or mobile applications.

Why is a new machine language and new virtual machine necessary?

WASM was designed to be embedable (and secure), streamable and is now ubiquitous as it is supported by all three major browsers, plus Node (and Deno) and many desktop web-app platforms (e.g. Electron). The embedable part is what makes it really different than JVM, CLR and BEAM - for example, you can include a WASM runtime in your application and call WASM code from a C or Rust app just like the browser does.

andrewaylett• 4 years ago

In a real sense, WASM isn't a new VM. It's an evolution of Javascript, via asm.js, so it builds on the sandboxing that browsers need for JS.

As part of that, it really doesn't do very much. Other more general purpose VMs first let you do things. This has implications for running untrusted code: the JVM has never _quite_ managed to lock things down, and has a model where we restrict code that would otherwise have access (via reflection) to a lot of things we don't want it to have access to.

WASM starts with a bounded set of "RAM" and the ability to define code that runs on a "CPU". There's no mechanism for the CPU to access anything outside of the data it's been explicitly allocated. That makes it more difficult to actually do anything, but also more difficult for malicious code to do anything it shouldn't.

With much stricter invariants comes the ability to statically validate the invariants, too. Which is where projects like Mozilla's use of WASM as an intermediate format that's then converted to C are really interesting: correctly written C will maintain these invariants too, but we can't validate them directly. We can validate the invariants in WASM then maintain them by construction as we convert to C and onwards to native code.

mike_hearn2• 4 years ago

The main thing is that browser makers can implement it on top of their existing JS engines at relatively low cost, and the language model is basically just C so there's no difficult consensus building. In other words it's expedient for the browser guys, given that Mozilla killed all prior attempts to do things like NaCL, there was also an earlier initiative to teach V8 how to run JVM bytecode that got killed off by the same problem. Mozilla just systematically killed off any attempt to non-JS stuff. WASM sort of snuck in via the backdoor using hacks like Emscripten and asm.js and Firefox was losing market share, so WASM is what we ended up with.

Outside the browser as the other comments say it's about sandboxing primarily, and the feeling that it's not too dependent on a single vendor. Of course that means not much useful code runs inside WASM. The hard bit about sandboxing is not actually doing it, so much as allowing a usefully flexible set of permissions and features for sandboxed code.

Interestingly, Graal is also developing a sandbox. And with native-image you can compile the language implementations down to native code. So you could soon (even today actually but it's not really advertised) load a sandboxing JS or Python or Ruby or indeed WASM implementation from a shared library using a simple C API. Again though the hard part is actually that "real" code tends to have extensive OS dependencies. The JS ecosystem finds wide usage partly because so many modules are written for the browser which allows very little, whereas in the Python/Java/etc ecosystems modules frequently will assume things like filesystem access.

duped• 4 years ago

WASM is JVM with lessons learned

sanxiyn4• 4 years ago

What lessons did it learn?

pjmlp11• 4 years ago

VC money searching out the next gold mine for re-inventing P-Code, IBM TIMI, Burroughs, M-Code, EM intermediate language, JVM bytecode, MSIL, ....

intelVISA• 4 years ago

Is it really that well-funded? I doubt there's much money in P-Code v2 - most devs see right through it.

oblio3• 4 years ago

Yeah, but what's the business angle to sell to VCs?

Putting ads in the low level runtime? :-))))

nuc1e0n• 4 years ago

Does the exe generation need any runtime like vb needed vbrun.dll back in the day?

fschuett4• 4 years ago

No, it's a standalone binary. It compiles the wasm file to native assembly (depending on target), then uses zig build-exe to link libc and libunwind into a final exe file.

$ wasmer create-exe --target x86_64-windows-gnu qjs.wasm -o ./js.exe && llvm-objdump -p ./js.exe | grep DLL

    DLL Name: KERNEL32.dll
    DLL Name: msvcrt.dll
    DLL Name: WS2_32.dll
    DLL Name: ADVAPI32.dll
    DLL Name: USERENV.dll
    DLL Name: bcrypt.dll

lijogdfljk• 4 years ago

The `create-exe` subcommand is interesting!

For any language with decent cross compiling capability, is there a use case for `create-exe`? Eg i use Rust these days.. and i wonder if there's any use case for me to cross compile via wasmer instead of natively. My project(s) do work on WASM as a target (for browser reasons), maybe it would be easier to setup cross compiling via wasmer and not manage the release pipelines i have?

Though for some of my performance critical applications i may not want to bother with it. Simply because i'd suspect wasmer might not have the same platform specific optimizations that natively compiling would give me.

williamstein3• 4 years ago

Wasm provides very extensive sandboxing capabilities that are extremely valuable for certain applications (plugins, real-time collaboration, multi tenant hosting), and pointless for others. You can leverage that by using wasm and create-exe.

samtheprogram• 4 years ago

Running WASM outside of a web browser? Obligatory Gary Bernhardt, “The Birth and Death of JavaScript”: https://www.destroyallsoftware.com/talks/the-birth-and-death...

walrus_pen• 4 years ago

Javascript and WASM are unrelated

jamil7• 4 years ago

The parent comment didn't say they are. It's a very well known talk in which the speaker describes a hypothetical future technology that looks a lot like WASM.

kaba015• 4 years ago

Are they? Wasm is just asm.js turned into an independent thing.

kthakore• 4 years ago

Great work Wasmer team :)

lioeters2• 4 years ago

Cross-compiling to different targets with `create-exe` command is a very intriguing idea.

In Wasmer 3.0 we used the power of Zig for doing cross-compilation from the C glue code into other machines.
This made almost trivial to generate a [binary] for macOS from Linux (as an example).
So by default, if you are cross-compiling we try to use zig cc instead of cc so we can easily cross compile from one machine to the other with no extra dependencies.

https://wasmer.io/posts/wasm-as-universal-binary-format-part...

Using the wasmer compiler we compile all WASI packages published to WAPM to a native executable for all available platforms, so that you don't need to ship a complete WASM runtime to run your wasm files.

https://wasmer.io/posts/wasm-as-universal-binary-format-part...

h4x0rr2• 4 years ago

one thing to note is that the performance is still on the level of normal wasmer exexution and thus inferior to natively compiled code in most instances

coder5434• 4 years ago

thus inferior to natively compiled code in most instances

Do you have a source for this claim? Using a JIT with AOT binaries (which is what this seems to be) can sometimes be very beneficial. It's like doing PGO without the manual work of doing PGO properly.

I'm sure the JIT can make poor decisions sometimes, but I would want to see a comprehensive set of benchmarks, like The Benchmarks Game and TechEmpower showing this. Benchmarks aren't always reflective of reality, but good ones are usually more insightful than random opinions.

The only Wasmer benchmarks I could readily find were from three years ago, and that was before Wasmer 1.0, let alone 3.0.

EDIT: Reading more... maybe `create-exe` doesn't include the JIT at all, so it is just making an AOT binary from the source WASM? In which case, benchmarks are just as necessary to understand how it affects performance compared to a normally-compiled native binary.

jillesvangurp• 4 years ago

Which should be mostly fine unless you are doing some particularly slow things or need hardware acceleration that is difficult to get via wasm. For lots of code, your CPU is going to be idling while it runs. Wasm is fine for that type of code. It will idle slightly less. You won't notice the difference.

gary_02• 4 years ago

The docs.wasmer.io page could use some work (it looks nice, though!) For instance, under the C/C++ section, the MinGW link at the bottom leads to a hijacked domain, and the "Wasmer C API" link in the sidebar leads to a 404.

tromp• 4 years ago

Can this be compared to something like αcτµαlly pδrταblε εxεcµταblε [1], that makes a single executable run on Linux, MacOS, Windows, FreeBSD, OpenBSD, and NetBSD?

While wasmer seems to support more source languages, it requires running the executable under a WASM virtual machine. Are there other important differences?

[1] https://justine.lol/ape.html

brundolf2• 4 years ago

WASM also gives you sandboxing

gary_02• 4 years ago

And it works the same regardless of the host CPU architecture, whereas APE is built around x86_64.

lioeters2• 4 years ago

There's another blog post by Wasmer where they compare with ape/cosmopolitan.

How is this approach different? ape is aiming to create one standalone binary that works everywhere (same chipset, x86 as lingua franca). On the other hand, Wasmer aims to have one standalone lingua franca (Wasm), that can target multiple OSes (macOS, Linux, Windows), chipsets (x86, ARM, RISC-V) and programming languages (Python, Rust, Go…).
On one hand, both ape and Wasmer rely on a “universal binary interface” to interact universally with the Operating System: Cosmopolitan (as a universal libc POSIX interface) in the case of ape, and WASI in the case of Wasmer.
On the other hand, since Wasmer relies on WASI it can also offer a full-sandboxed execution when running the binary (this means that by default no files or sockets could be accessed or created by the binary unless explicitly allowed, for example).

WebAssembly as a Universal Binary Format (Part II: WAPM) - Portable Executables - https://wasmer.io/posts/wasm-as-universal-binary-format-part...

devops3• 4 years ago

Cool! Does this support compiling of games to WASM, with deployment at the edge?

fschuett4• 4 years ago

It does, using the wasm4 console target: https://itch.io/jam/wasm4-v2

TUSF2• 4 years ago

Other than some fantasy consoles like WASM-4, which have some retro-inspired limitations, there isn't really a standard way to do any kind of GUI in Wasm yet. Wasmer has a non-standard way[1], which they hide behind compilation flags, and involves writing to a bitmap framebuffer, so no hardware acceleration.

[1] https://medium.com/wasmer/wasmer-io-devices-announcement-6f2...

TobyTheDog1232• 4 years ago

While I'm glad to see WASM get more attention, iirc wasmer has had some behavioral issues / drama in the past.

However, it seems they're making far more progress than wasmtime, so taking the bad with the good I guess.

benatkin• 4 years ago

That progress is mostly boilerplate. For instance if you want a memory filesystem, you probably want a dedicated filesystem module with features like an overlay filesystem. If you want an executable, you can just add it to your build scripts.

karmasimida• 4 years ago

I have a use case in mind

I have a piece of library written in rust that i need to run on multiple different hosting environment due to business reasons, like java/js. They will all call this library to validate part of the logic at the same time do something else

Could wasmer help in this case for me to write once and have consistent behavior everywhere ?

sanxiyn4• 4 years ago

Yes.

tracker1• 4 years ago

One annoyance, on the wapm website, seems you can't click on search results to open in a new tab. :-/

Wasmer seems pretty cool, and may in fact be a future for micro-services.

supermatt2• 4 years ago

Im a bit confused with the WASM landscape. It seems there are numerous implementations of the runtime. How do I go about finding WHICH runtime is best for my needs? Is there a list of them available somewhere?

Nicole9• 4 years ago

It depends on your needs. This awesome wasm list also is confusing. https://github.com/appcypher/awesome-wasm-runtimes

supermatt2• 4 years ago

Many thanks. Ill dig through them and see what I can find

Wasmer 3.0

Related Stories