Live data from Hacker News

Show HN: Kyushu – A self-hostable WASM sandbox for JavaScript workers

kyushu.dev

41–44 of 44 posts

Re: Show HN: Kyushu – A self-hostable WASM sandbox for JavaScript workers

#41
post #12

Earlier quoted context omitted.

I think that this is a plugin library for teams that want to offer a platform for the public (or an LLM-AI) to submit code to. If your team writes some code, you don't generally sandbox it from yourself, you just amend your program: you don't need a sandbox. But, if you want to run code that you don't trust, you should run it in a way that prevents it from causing problems if it is actually dangerous (like a virus or…

how is it different from firecracker or other containerization ? what makes it secure enough to make those claims?

Firecracker launches small, but otherwise general purpose virtual machines. Containers, at least the standard implementations that most of us use, use kernel features like namespaces to isolate workloads, but still share a kernel so the sandboxing is not as strong.

Wasm is a virtual machine, just like for example the jvm is, that is designed around only allowing the executed program access to the host runtime via specific apis that are subject to security policies. It does not run arbitrary software, but rather only software built to target specifically wasm.

The software this post is about is just bundling a wasm runtime with other software for convenience.

Re: Show HN: Kyushu – A self-hostable WASM sandbox for JavaScript workers

#42

Great use case for edge functions and plugin systems. How does the startup latency compare to running the same code in a V8 isolate like Cloudflare Workers?

I haven't benchmarked it yet but, guts feeling, would expect it to be (a bit?) slower. Cloudflare has likely spent quite some effort optimizing it and also runs fast machine. Kyushu uses QuickJS which adds a layer that needs to be loaded but, it's pre-initialization in memory which should mitigate the cost.

Re: Show HN: Kyushu – A self-hostable WASM sandbox for JavaScript workers

#43

cool idea of a self-hostable alternative ot CF workers without much overhead, compiling it down to a binary makes local testing way easier.

Thx! I thought about adding a context to the fetch handler, could be handy for local testing. Likewise, local commands (e.g. dev or watch mode) are not yet there. Those would be next on the line if the CLI starts getting used by others than me.

*Update:* I've got a draft PR for `kyu dev` with live reload.

Re: Show HN: Kyushu – A self-hostable WASM sandbox for JavaScript workers

#44

Earlier quoted context omitted.

Thx! I thought about adding a context to the fetch handler, could be handy for local testing. Likewise, local commands (e.g. dev or watch mode) are not yet there. Those would be next on the line if the CLI starts getting used by others than me.

*Update:* I've got a draft PR for `kyu dev` with live reload.

*Update*: Done. `kyu dev` is implemented and released :)
Post reply on HN