Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WebAssembly: Adding Python support to WASM language runtimes

wasmlabs.dev

Post reply on HN
Print view View original

31–40 of 88 posts

Re: WebAssembly: Adding Python support to WASM language runtimes

#31

Post by robertlagrant »

angelmm wrote: post #19
robertlagrant wrote: post #12

The non-Docker version seems to require an external site-packages, unless I missed it. Is it possible to produce a single wasm binary with all dependencies compiled in?

Hey! Dev here :) For external libraries, it requires you to mount the libraries with WASI when running the python.wasm module. Another option we're exploring is to use wasi-vfs[1] to include some common modules in our pre-built binaries. For example, Ruby does require some extra libraries for common workloads (like JSON parsing). This is still on the exploration phase, but we may do something with it. [1] https://git…

Very cool. We ship some Python as a Debian dependency and so this could become a really interesting way to package everything up.

Re: WebAssembly: Adding Python support to WASM language runtimes

#32

Post by ridruejo »

dom96 wrote: post #11

There seems to be so many different variants of the same thing out there. What makes this unique? For example I know Pyodide exists and also runs CPython under WASM.

This one is designed to run on the server side and interface with the OS via WASI, so it can read/write files etc

Re: WebAssembly: Adding Python support to WASM language runtimes

#33

Post by angelmm »

ElectricalUnion wrote: post #23
angelmm wrote: post #13

Earlier quoted context omitted.

You get an extra layer of isolation, even at your development environment level. I remember a NodeJs CVE that was caused by a poisoned dependency. It was affecting people when downloading it from npm. There’s still a gap here to cover, but the benefits may be worth :)

I don't see how this would in any way prevent you from being affected by a equivalent poisoned pypi dependency; after all your secrets/credentials are inside the sandbox anyways or your code can't work.

With Wasm + WASI, you need to explicitly mount files and environment variables. Inside the Wasm VM, the Python interpreter, source code and dependencies only have access to a very reduced surface. Although you're right that if you mount credentials inside, they will be accessible too.

The incident I was talking about was the event-stream[1] vulnerability. The attacker introduced code that looked for the data of a crypto wallet. This data was stored in the user's home.

By default, interpreters may get access to the same resources that the user running the process. In Wasm, the resources are granted manually.

[1] https://blog.npmjs.org/post/180565383195/details-about-the-e...

Re: WebAssembly: Adding Python support to WASM language runtimes

#35

Post by ridruejo »

seddonm1 wrote: post #21
robertlagrant wrote: post #12

The non-Docker version seems to require an external site-packages, unless I missed it. Is it possible to produce a single wasm binary with all dependencies compiled in?

I have been following and playing with this repository: https://github.com/singlestore-labs/python-wasi/ It builds a single Python WASM module with all dependencies included (they use VFS) and a Dockerfile to make the process easy (and actually worked first go). It does produce large files though: wasi-python3.11.wasm 110MB

Yes! Single store is a great team. We are currently using some of their work for this Python release, like libz

Re: WebAssembly: Adding Python support to WASM language runtimes

#36

Post by irrational »

simonw wrote: post #3

This looks very promising! The thing I most want to solve right now is this: I want to write a regular Python application that can safely execute untrusted Python code in a WASM sandbox as part of its execution. I want to do this so I can let end users customize my web applications in weird and interesting ways by pasting their own Python code into a textarea - think features like "run this Python code to transform m…

Why do this on the client? Why not pass it to the server and run it on Python there?

Re: WebAssembly: Adding Python support to WASM language runtimes

#37

Post by ridruejo »

amelius wrote: post #30
AshleysBrain wrote: post #27

How does this handle garbage collection? AFAIK the WebAssembly GC proposal is still in development. Does it implement GC in WASM code?

Perhaps it just uses Python's built-in garbage collector that just increases/decreases the data segment size as needed by calling sbrk()?

Correct, it is just CPython compiled to Wasm (similar to compiling to x86 or arm)

Re: WebAssembly: Adding Python support to WASM language runtimes

#38

Post by miohtama »

m00dy wrote: post #6
brrrrrm wrote: post #5

the issue right now with Python support in WASM (at least for machine learning, the main driver of the language) is that Python is largely a wrapper language and none the utilities that make it so powerful (numpy, PyTorch, JAX) work particularly well in wasm, since it's so limited performance-wise (no FMA, no GPU support). I'm excited for pairing wasm with WebGPU, which will likely unblock these projects from buildin…

I have integrated pyodide + webgpu recently. (you can do matmul using webgpu's compute pipeline). The real problem is that browser tabs have 4gb max memory size. So, training neural networks on this stack is almost impossible. ( I don't even want to mention pyTorch's dependency hell).

WebAssembly Memory64 is coming

https://webassembly.org/roadmap/

Re: WebAssembly: Adding Python support to WASM language runtimes

#39

Post by simonw »

irrational wrote: post #36
simonw wrote: post #3

This looks very promising! The thing I most want to solve right now is this: I want to write a regular Python application that can safely execute untrusted Python code in a WASM sandbox as part of its execution. I want to do this so I can let end users customize my web applications in weird and interesting ways by pasting their own Python code into a textarea - think features like "run this Python code to transform m…

Why do this on the client? Why not pass it to the server and run it on Python there?

That's what I'm talking about: I want to run Python code on my server, but since it's from an untrusted source I want to make sure that it's in a sandbox with strict limits on what it can do, how much CPU it can use and how much RAM it has available to it - so malicious code can't be used to crash my server or steal data it shouldn't have access to.

Re: WebAssembly: Adding Python support to WASM language runtimes

#40

Post by simonw »

phickey wrote: post #28
simonw wrote: post #3

This looks very promising! The thing I most want to solve right now is this: I want to write a regular Python application that can safely execute untrusted Python code in a WASM sandbox as part of its execution. I want to do this so I can let end users customize my web applications in weird and interesting ways by pasting their own Python code into a textarea - think features like "run this Python code to transform m…

Wasmtime's `wasmtime-py` embedding in python has support for Wasm Components: https://github.com/bytecodealliance/wasmtime-py#components (disclosure, I helped create it) The remaining piece of the puzzle would be to create a wit-bindgen guest generator https://github.com/bytecodealliance/wit-bindgen#guests for this build of the python interpreter. You could then seamlessly call back and forth between the host and gue…

If you could provide example code for how to do this - how to run a snippet of untrusted Python code using wasmtime-py with a CPU and RAM limit - I would shout it from the rooftops. I think a LOT of people would benefit from clear examples of how to actually achieve this.
Post reply on HN