EdgeWasm-Runtime

Ultra-fast WebAssembly-powered serverless execution platform. Execute untrusted WASM modules in isolated sandboxes with ~0.3 ms instantiation on cache misses (the first compile of a brand-new module takes ~100 ms), <15 MB base RSS (7.8 MiB measured idle), strict CPU/memory bounds, and hot in-memory compilation caching.

Engine	Rust · tokio/hyper · wasmtime (Cranelift AOT)
ABI	WASI preview 1 (wasm32-wasip1) — stdin/stdout data binding, no custom SDK
Sandbox	64 MiB memory cap (StoreLimits) · 500 ms deadline (epoch watchdog + tokio timeout)
Caching	LRU compiled-module cache + on-disk AOT artifact cache + hot-reload
Auth & limits	API-key auth (SHA-256 digests) · per-key rate limiting (local or Redis)
Observability	Structured JSON logs (tracing) · Prometheus /metrics
Deploy	Static musl binary · distroless container · Kubernetes manifests (deploy/k8s/)
License	MIT

---

Why

Traditional Docker-based FaaS suffers from slow cold starts (100 ms–10 s), heavy memory footprints, and per-function process overhead. EdgeWasm-Runtime compiles WASM bytecode to native machine code ahead of time, keeps the compiled modules in an in-memory LRU, and instantiates them inside a single long-lived process — so the hot path is compile-free instantiation and the base footprint is a single static binary.

Status (checkpoint flow)

Step	Deliverable	Status
1	Architecture & blueprint (repo skeleton, diagrams, build config)	✅ done
2	Core runtime & sandboxing engine (wasmtime, WASI, limits, epochs)	✅ done
3	AOT compiler & LRU module cache	✅ done
4	HTTP gateway & data binding + CLI	✅ done
5	E2E tests & sample functions	✅ done
6	Enterprise README, benchmarks, function guide	✅ done

Note: every deliverable is implemented and verified. make run boots the gateway against the real sample functions; make bench produces the latency/cold-start/RSS report (see docs/BENCHMARKS.md for the full methodology and recorded results).

Quickstart

# 1. Toolchain (first time)
rustup toolchain install stable
rustup target add wasm32-wasip1

# 2. Build the daemon
make build

# 3. Compile the sample functions and run
make run
# → edgewasmd serving on http://0.0.0.0:8080

# 4. Invoke a function (body → stdin, stdout → response)
curl -s -X POST http://localhost:8080/api/v1/functions/echo \
     -H 'content-type: application/json' \
     -d '{"hello":"wasm"}'

# 5. Deploy / undeploy / list functions
curl -s -X PUT --data-binary @my-function.wasm http://localhost:8080/api/v1/functions/my-function
curl -s -X DELETE http://localhost:8080/api/v1/functions/my-function
curl -s http://localhost:8080/api/v1/functions

# 6. Observability
curl -s http://localhost:8080/metrics | grep edgewasm

Repository layout

crates/
  edgewasm-core/     shared types, config, error taxonomy
  edgewasm-runtime/  wasmtime engine, WASI binding, sandbox, LRU cache, AOT
  edgewasm-gateway/  hyper gateway, router, registry, metrics
  edgewasm-cli/      edgewasmd binary (serve / compile / list)
examples/functions/  sample user functions (json-processor, echo, c-echo, …)
tests/e2e.rs         HTTP integration suite
docs/                architecture, plan, benchmarks, function guide

Documentation

• docs/ARCHITECTURE.md — blueprint, lifecycle diagrams, contracts
• docs/PLAN.md — implementation plan for steps 2–6
• docs/FUNCTION_GUIDE.md — write your own function in Rust or C
• docs/BENCHMARKS.md — methodology and recorded results
• docs/OPERATIONS.md — deploy, tune, secure, and observe

Development

make check      # type-check everything
make lint       # clippy, warnings are errors
make fmt-check  # formatting
make test-unit  # unit tests (no wasm toolchain needed)
make build-functions && make test   # full suite incl. e2e
cargo test -p edgewasm-runtime --test fuzz   # robustness fuzzing (wasm-smith)
make build-x86_64 / build-aarch64   # static musl cross-builds (docker + cross)
make docker                          # multi-stage container image

Security

Untrusted code runs inside wasmtime's sandbox with hard memory/table/time caps; unsafe is hard-forbidden workspace-wide except the one audited AOT-deserialization site (relaxed to deny in a single crate).

edgewasmd serve also ships API-key authentication and per-key rate limiting: set EDGEWASM_API_KEYS="admin-key,svc:invoke" and every request must carry X-API-Key (401/403/429 otherwise; only SHA-256 digests are stored). Rate limiting runs in-process (local) or shared across replicas via Redis (--rate-limit-backend redis, fail-closed). Unset keys = open dev mode with a startup warning. See docs/ARCHITECTURE.md §12 and docs/OPERATIONS.md for the full model, and SECURITY.md for reporting vulnerabilities.

Roadmap

• Wasmtime 47 sandbox with deterministic execution bounds (epoch + fuel)
• AOT compilation + LRU cache with single-flight loading
• HTTP gateway with hot-reload, graceful shutdown, backpressure
• API-key auth, per-key rate limiting (local + Redis)
• Freestanding C function support (no libc) with multi-iovec fix vendored
• wasm-smith robustness fuzzing, Kubernetes manifests, CI
• WASI preview 2 / components support (tracking wasmtime)
• Function versioning + canary deploys
• Tenant accounting / per-key quotas across namespaces

Contributing

See CONTRIBUTING.md — build, test, and PR workflow in one page. All contributors are expected to follow our Code of Conduct.

License

MIT — see LICENSE.