webcontainer-core VS gc

How does it work? There is no backend whatsoever. The API Security Academy leverages WebContainers, a new technology that allows running full-blown node instances directly in the browser. Each WebContainer contains a live GraphQL application, so you'll not only understand why a vulnerability is risky, but also how to exploit it and, most importantly, how to fix it.

StackBlitz made the claim "... run Node.js, entirely inside your browser" #658, then had to revise it's claim to "We currently do not expose a way to use WebContainer outside of StackBlitz.com,".

> Wasm though seems like the likely general heir, and will have many different offerings for how to do that (Deno being one!).

I was recently blown away by some ideas that StackBlitz [0] apply based on WebContainers. The idea of a "server in the browser", they allow you to run Node-based environment like that via Wasm.

[0] https://stackblitz.com/

[1] https://webcontainers.io/

See https://webcontainers.io.

This very simple fact is well known flaw, which was already often criticized and asked for solutions by users. It doesn't only affect this kind of very exotic bootstrap applications but also significantly limits rusts usefulness in many other areas. Pure browser based scientific code documentation and example notebooks (e.g. jupyterLite) and sandboxed CI and IDE solutions (e.g. web containers) as available for many other languages are simply not available for rust because of this very fundamental issue.

Looks like they plan to open it. From the FAQ section of README (https://github.com/stackblitz/webcontainer-core#faqs):

> Is there a developer API?

I'm skeptical about stackblitz claims. The last time I checked that is closed source code https://github.com/stackblitz/webcontainer-core/issues/658.

StackBlitz claimed https://blog.stackblitz.com/posts/introducing-webcontainers/ to have implemented Node.js in the browser, though I have not observed any evidence of that being true and correct https://github.com/stackblitz/webcontainer-core/issues/658.

The other honorable mention is StackBlitz, a web-based web editor for making containers that run Javascript applications. Interestingly, StackBlitz is championing WebContainers, a technology that allows developers to start NodeJS servers within the browser. The downside is, this technology only works with Javascript-based projects (NodeJS, NextJS, etc). I include it here because WebContainers could easily be extended to support other languages via WASM, like Ruby. I’ll also add in Buildah, a tool for building OCI images. I won’t say much about this tool because it’s designed for building images; you still need another service, like Podman, to actually create the containers.

It may take some time for WasmGC to be usable by .NET. Based on the discussions the first version of WasmGC does not have a good way to handle a few .NET specific scenarios, and said scenarios are "post-post-mvp". [0]

My concern, of course, is that there is not much incentive for those features to be added if .NET is the only platform that needs them... at that point having a form of 'include' (to where a specific GC version can just be cached and loaded by another WASM assembly) would be more useful, despite the pain it would create.

[0] - https://github.com/WebAssembly/gc/issues/77

Yes, that's definitely true: a single GC will not be optimal for everything, or even possible. Atm interior pointers are not supported at all, for example, but they are on the roadmap for later:

https://github.com/WebAssembly/gc/blob/main/proposals/gc/Pos...

What launched now is enough WasmGC to support a big and useful set of languages (Java, Kotlin, Dart, OCaml, Scheme), but a lot more work will be required here!

GC proposal is from 2018: https://github.com/WebAssembly/proposals/issues/16 and there’s code: https://github.com/WebAssembly/gc/blob/master/proposals/gc/O...

Seems like an awefully long time for progress to be made, given all the possibilities it would unlock.

First is the size. Writing a server-side and client-side program is possible with Rust, and the resulting WASM package will be small enough. At the same time, Microsoft Blazor converts C# code to WASM, but the client delivery has to include the reduced .NET runtime, taking several megabytes for a script. The same is true for GoLang, even with an attempt to reduce the runtime delivery in TinyGo WASM. Developers want to work with their favorite languages, whether it is Java, Kotlin, Dart, C#, F#, Swift, Ruby, Python, C, C++, GoLang, or Rust. These languages produce groups of runtimes. For example, JVM and .NET have many common parts, Ruby and Python are dynamically interpreted at runtime, and all mentioned depend on automatic garbage collection. For smaller WASM packages, browser vendors can include extended runtime implementations, for example, by delivering a general garbage collector as part of WASM. Garbage collection support by WASM is currently in progress: WASM GC, .NET WASM Notes.

My understanding is that the main limitation is technical. WASM doens't do GC or the host system calling conventions and cannot interact directly with object from Javascript because of this. However, this is being worked[0] on and will be solved eventually. Even without this the performance overhead of bridging to JS is low enough that WASM frameworks can beat out React.

0: https://github.com/WebAssembly/gc/blob/main/proposals/gc/Ove...

I’ve just watched a video on YouTube from Google I/O 2023 on Flutter for the web. Kevin Moore explains that Flutter can compile to Wasm, but now that GC support has been added to the standard and WasmGC is supported in Chromium and Firefox, I’m quite intrigued.

I have found the main thread about using WebAssembly GC in C#: https://github.com/WebAssembly/gc/issues/77. If I understand it correctly, it is not possible to use the current prototype version of GC in C#.

The .net team has given their notes on it, the concern is more on the memory layout from what I remember. Though it may be possible still. The runtime would likely still ship some gc code, but only a subset for cases not supported by the wasm gc itself and a few more for interfacing with the gc service, which overall should still result on smaller payloads compared to current sizes.

I assume that's one of the parts of the work done at https://github.com/WebAssembly/gc - not happening any soon yet, but it'll eventually be done.