wizer VS quickjs-emscripten

> once by the wasm runtime to compile the rust-python wasm

I'm not sure what you mean by that. The runtime doesn't compile WASM, it simply executes it.

There are tools for dealing with interpreter runtime overhead this by pre-initalizing the environment like Wizer[0]. ComponentizeJS[1] uses it to pre-initialize the Spidermoney engine it packages to gain fast startup times (and you can then prune the initialization only code with wasm-opt). As techniques like ComponentizeJS are also being applied for a specific set of interpreted files, you can even prune parts of the interpreter that would never be used for that specific program. If you want to go even further you could record specific execution profiles and optimize further by those.

[0]: https://github.com/bytecodealliance/wizer

[1]: https://github.com/bytecodealliance/ComponentizeJS

Edge functions are typically run intermittently, with their runtime stopped to free up resources between runs. Therefore a big factor is startup and shutdown speed. Containers are pretty bad there. Deno is better, and WASM is unbeatable, especially with things like Wizer[0].

[0]https://github.com/bytecodealliance/wizer

I imagine startup cost could be amortized by something like wizer: https://github.com/bytecodealliance/wizer

There are security benefits to running each request in its own instance, as it helps prevent accidental leaking of state between requests. To avoid doing lots of expensive initializations, we have a tool called wizer which lets users run their program's initialization once, create a snapshot, and then use that snapshot to do fast startups that don't rerun the whole initialization each time.

See https://github.com/bytecodealliance/wizer for an implementation of this approach.

It should probably be named "Making JavaScript to startup fast on WebAssembly", since the runtime speed is not really improved by the approach they exposed.

Besides that I think Wizer [1] is both an elegant and a simple solution to speed up startup speed with Wasm.

[1] - https://github.com/bytecodealliance/wizer#using-wizer-as-a-l...

A similar project, for WebAssembly so with limited scope is this: https://github.com/bytecodealliance/wizer. And somehow similar but limited on LLVM IR a colleague worked on this for Cheerp (the compiler used here as backend): https://github.com/leaningtech/cheerp-meta/wiki/Cheerp-PreExecuter.

I’m not sure if wasm would be considered full process isolation but it does provide a software based sandboxing. I’m referring to running quickjs in wasm by compiling it with emscripten.

https://github.com/justjake/quickjs-emscripten

If you were not worried about preventing external requests and were okay with it being able to make requests as an arbitrary webpage unrelated to your site could if opened, then loading the code in an iframe with the sandbox="allow-scripts" attribute is enough.

If you needed tighter sandboxing than that, then I think WebAssembly is your best bet because you can control exactly what APIs are exposed to a WebAssembly module. You could then let users submit WebAssembly modules or let them submit JS that will be run in a JS interpreter running in WebAssembly. I think https://github.com/justjake/quickjs-emscripten or https://github.com/fermyon/StarlingMonkey (used by https://github.com/bytecodealliance/ComponentizeJS) look like the best bets for that currently.

The foundation of my package is built upon the excellent work done by the quickjs-emscripten project (https://github.com/justjake/quickjs-emscripten). They've done the crucial work of compiling QuickJS to WebAssembly, enabling its use in web and Node.js environments. What I've created is a high-level abstraction layer around this WebAssembly implementation, designed with developer experience in mind.

The underlying quickjs-emscripten library has APIs for exposing host functions, calling guest functions, custom module loaders, etc: https://github.com/justjake/quickjs-emscripten?tab=readme-ov...

The thing I want to achieve with WebAssembly is still proving a lot harder than I had anticipated.

I want to be able to take strings of untrusted code provided by users and execute them in a safe sandbox.

I have all sorts of things I want this for - think custom templates for a web application, custom workflow automation scripts (Zapier-style), running transformations against JSON data.

When you're dealing with untrusted code you need a really robust sandbox. WebAssembly really should be that sandbox.

I'd like to support Python, JavaScript and maybe other languages too. I want to take a user-provided string of code in one of those languages and execute that in a sandbox with a strict limit on both memory usage and time taken (so I can't be crashed by a "while True" loop). If memory or time limit are exceeded, I want to get an exception which I can catch and return an error message to the user.

I've been exploring options for this for quite a while now. The furthest I've got was running Pyodide inside of Deno: https://til.simonwillison.net/deno/pyodide-sandbox

Surprisingly I've not found a good pattern for running a JavaScript interpreter in a WASM sandbox yet. https://github.com/justjake/quickjs-emscripten looks promising but I've not found the right recipe to call it from server-side Python or Deno yet.

Can Extism help with this? I'm confident I'm not the only person who's looking for a solution here!

"Safely execute untrusted Javascript in your Javascript, and execute synchronous code that uses async functions" quickjs-emscripten, NPM

This maybe, as a start?

https://github.com/justjake/quickjs-emscripten

QuickJS Running in WebAssembly\ (17 comments)