Skip to content
Search

Hyperlight WASM

lastmod 2025-04-09created 2025-04-091 edits

hyperlight-wasm is a rust library crate that enables Wasm Modules and components to be run inside lightweight Virtual Machine backed Sandbox. It is built on top of Hyperlight.

Fast, secure, and OS-Free

  • Hyperlight Wasm is the latest extension of Hyperlight, the ultra-lightweight virtual machine (VM) technology Microsoft donated to the CNCF, and runs WebAssembly (Component Model-based) workloads quickly and securely
  • Unlike traditional VMs, it exposes only a memory slice and CPU with no OS or virtual devices, offering a fast boot time of 1–2ms
  • Can run wasm components written in various languages (C, Rust, Go, Python, JS, etc.) under hypervisor protection

Key features of Hyperlight Wasm

  • Faster than traditional VMs
    • Traditional VM: device initialization → kernel loading → OS boot → application execution (about 125ms)
    • Hyperlight Wasm: runs with just memory slice creation + Wasm loading (1–2ms, with a future goal of <1ms)
    • Fast execution speed favors on-demand serverless execution or a minimal warm pool setup
  • Runs various languages without an operating system
    • Based on the standard WASI and WebAssembly Component Model, it can run components written in most languages
    • With the wasmtime runtime built in, interpreted languages such as Python, JavaScript, and C# can also run with their runtime included
    • For developers, simply compiling for the wasm32-wasip2 target makes code runnable on Hyperlight
  • Improved security (double sandbox)
    • Dual protection structure of the Wasm sandbox + hypervisor-based VM sandbox
    • Even if an attacker escapes wasm, they must additionally bypass the VM sandbox

Development example: running a Rust-based UDP Echo server

  • Download and compile the wasm binary with the wkg CLI
  • Convert the WASI interface definition file (.wit) to a binary to generate bindings
  • Automatically generate bindings for Wasm import/export interfaces via hyperlight_component_macro and host_bindgen!
  • Define the echo server logic by implementing the UdpSocket interface
  • Create a hyperlight-wasm sandbox to load and run the wasm component
  • Ahead-of-Time compilation
    • AOT-compile wasm with the hyperlight-wasm-aot tool to reduce execution time
    • Run the server with cargo run; test UDP with the nc -u command

Scalability and future plans

  • Hyperlight Wasm will support the Arm64 architecture in addition to x86
  • Currently the WASI interfaces must be implemented directly, but default bindings are planned
  • Plans to make it possible to quickly sandbox simple services such as HTTP servers

Getting involved in the open-source community

  • Hyperlight is a Microsoft open-source project released under the Apache 2.0 license and registered in the CNCF Sandbox
  • Hyperlight Wasm aims to provide a fast and secure execution environment suited to cloud-native computing
  • Code can be viewed and contributed to through the GitHub repository

See also

Favorite site

author Zer0 sitemap