Re:Hyperlight WASM: Fast, secure, and OS-free
by algorithmmonkey on Wednesday March 26, 2025 @12:53PM
(#43484204)
This example (https://github.com/hyperlight-dev/hyperlight-wasm-sockets-ex...) demonstrates starting a sandbox and loading a component. You could imagine you'd write an app that starts and stops any number of components in their own sandboxes.
As for executing a tree of connected components, in the current state of Hyperlight-Wasm you'd probably want to take a collection of components and compose them together using something like https://github.com/bytecodealliance/wac to create a final component composed together from multiple components.
Re:Hyperlight WASM: Fast, secure, and OS-free
by infogulch on Wednesday March 26, 2025 @01:58PM
(#43484910)
Thank you for the illuminating references! So this sockets example is a host that runs on a raw vm (x86_64-unknown-none target) and spawns sandboxes. To get at my original idea, I could imagine a sandbox with special functions imported from the host that can spawn new sandboxes. This could be complicated by the fact that spawning these sandboxes and hooking up inputs/outputs seems to be statically compiled...
I wondered how components were supposed to be used. So wac takes a group of wasm components and merges them into a new .wasm file with inputs/outputs mapped according to a defined .wac file. Then you can just run the new .wasm file. Does this not obviate the isolation benefits of having separate wasm modules? Is there a path to running a tree of components directly while maintaining the sandbox between them?
Can you give a Wasm Component binary the capability to execute a tree of connected Wasm Components, delegate capabilities, and manage their life cycle?