go VS OPA (Open Policy Agent)

Hey, this is mine. Thanks for submitting it. I'll answer some questions.

> Why?

I ported Trealla Prolog to WASM (WASI) and I was looking for something useful to test it against. I found Spin, which can run WASM+CGI, and landed on this. Making this project exposed a number of bugs in my port that have now been fixed, so consumers of more useful projects[1][2] benefit as well. Also, PHP style templates are just fun! There's something valuable to just being able to shove a little bit of code inside some HTML and get it up on the internet.

I started my webdev journey with PHP many many years ago, and it's nice to revisit it from a different perspective. I don't use the real (elephant) PHP anymore, but I've gained a newfound appreciation for how fun its quick & dirty development style is.

I hope this project can serve as an example of how to use Prolog for fun things. It does showcase some of the cooler dynamic aspects of the language, and the PHP parsing code is like 10 lines of DCG.

> Is it a joke?

Yes and no. The name is certainly a joke. I was pondering what 'Prolog on Rails' might be and thought calling it PHP would be funny. This led to the PHP-style templates which were quick to implement and pretty powerful. Despite the humorous presentation, it does actually work.

> Can you use Prolog for web services?

Yes! For example, SWI has a mature HTTP package: https://www.swi-prolog.org/pldoc/doc_for?object=section(%27p.... It's used to power SWISH, an online Prolog code sharing thing: https://swish.swi-prolog.org/

> Next steps?

I would like to support persistence somehow. I think it'd be really cool if you could use Prolog's dynamic database[3] as a persistent store. Spin has components for Postgres and Redis so it shouldn't be too hard to implement, but I lose the WASI compatibility if I do that... which means I can't use the binary from WAPM, etc.

I would also like to experiment with running Trealla on Cloudflare Workers. I have another project, worker-prolog[4], which uses Tau Prolog (a Prolog written in Javascript) on Workers.

On a somewhat related note, I've also been playing around with Cosmopolitan libc[5]. I got Trealla to compile to an APE executable but there's some issues with the embedded Prolog libraries getting garbled, so I need to improve my GDB skills and figure out what's going on there.

Finally, I'd like to say thanks to Andrew Davison (@infradig on GitHub), the author of Trealla Prolog, for letting me add WASM support to his project and helping me with lots of things. For example, PHP led to Andrew implementing improvements for using DCGs to parse Prolog terms, which is now super fast[6]!

[1]: https://github.com/guregu/trealla-js

[2]: https://github.com/trealla-prolog/go

[3]: https://www.swi-prolog.org/pldoc/man?predicate=assertz/1

[4]: https://github.com/guregu/worker-prolog

[5]: https://justine.lol/cosmopolitan/

[6]: https://github.com/trealla-prolog/trealla/issues/53

With trealla-prolog/go on the backend and trealla-js on the frontend, you can share the same validation code.

Other resources for logic programming and Go:

ichiban/prolog - ISO Prolog interpreter in pure Go, getting close to v1: https://github.com/ichiban/prolog

trealla-prolog/go - ISO Prolog interpreter embedded via WASM: https://github.com/trealla-prolog/go

guregu/pengine - library for interfacing with Pengines (SWI-Prolog's RPC protocol): https://github.com/guregu/pengine

biscuit-auth/biscuit-go - Biscuits are a fancy auth token with a little Datalog engine: https://github.com/biscuit-auth/biscuit-go

I'm a big fan of logic programming. We've been seeing a small resurgence of interest in it (for example Yarn using Prolog made some waves) and I have some optimism for its future.

Nice article! I think this is an exciting approach to cross-platform support. I took a similar approach for Trealla Prolog's Go library: https://github.com/trealla-prolog/go

The biggest roadblock at the moment is that Go WASM libraries are not in a very good state, except wazero. My assumption is that wazero will be slower than the cranelift-optimized wasmtime, etc. but I have not seen any benchmarks anywhere.

My impressions of the Go WASM libraries:

wazero: great Go-friendly API, not sure about performance, works on all OS (what the author chose)

wasmer: provides bare-minimum input and output for WASI, fast (it's what I chose for trealla-go). Doesn't work on Windows without significant pain, doesn't static compile the wasmer libraries so distribution is a pain. Seems essentially abandoned as its main contributor left the company.

wasmtime: basically impossible to get input and output in any reasonable way (unable to set stdin or read stdout; it can only inherit the FDs from the host), but might finally get buffers for I/O soon.

wasmedge: haven't investigated this yet, but it seems like it solves many of the problems above, promising

If anyone knows of a benchmark between these, I'd love to see it. I can try to run Trealla's against them if it doesn't take too much work.

It was just made private, I guess. Only the Go WebAssembly project is still public: https://github.com/trealla-prolog/trealla-go

How can we handle this? Are there any mechanisms to prevent or at least to some extent safeguard this kind of issues without falling back to a manual workflow? There is. One huge advantage of sticking to (de-facto) standards like Terraform is that first we are probably not the first ones to come up with this question and second there is a huge ecosystem around Terraform that might help us with such challenges. And for this specific scenario the solution is the Open Policy Agent. Let us take a closer look how the solution could look like.

A popular Policy-as-Code tool for Terraform is OPA, everyone's favorite versatile open-source policy engine that enforces security and compliance policies across your cloud-native stack, making it easier to manage and maintain consistent policy enforcement in complex, multi-service environments.

Harness Policy As Code uses Open Policy Agent (OPA) as the central service to store and enforce policies for the different entities and processes across the Harness platform. In this section, you will define a policy that will deny a pipeline execution if there is no approval step defined in a deployment stage.

OPA: While OPA is an open-source, general-purpose policy engine capable of enforcing unified and context-aware policies throughout the stack, it can also accept and output data in formats such as JSON, effectively functioning as a tool for generating or modifying configurations. Although it does not provide out-of-the-box schema definition support, it allows the integration of JsonSchema definitions.

In essence, container image signing involves adding a digital stamp to an image, affirming its authenticity. This digital assurance guarantees that the image is unchanged from creation to deployment. In this blog, I'll explain how to sign container images for Kubernetes using Cosign and the Open Policy Agent. I will also share a tutorial that demonstrates these concepts.

In this post we will explores two powerful solutions for addressing this issue: the Open Policy Language (OPA) and Google’s Zanzibar.

Rego is a declarative query language from the makers of the Open Policy Agent (OPA) framework. The Cloud Native Computing Foundation (CNCF) accepted OPA as an incubation-level hosted project in April 2019, and OPA graduated from incubating status in 2021.

Now there are more subdivided practice: * Policy as Code: Sentinel, OPA * Database as Code: bytebase * AppConfiguration as Code: KusionStack, Acorn * ...... (Welcome to add more)