Wasm Outside the Browser

Analogy categoryAnalogies

WebAssembly as a Universal Runtime Target

Standalone runtimes like Wasmtime, Wasmer, and WasmEdge execute .wasm modules directly on a server or CLI without any browser present, and because the bytecode is architecture-independent, the exact same compiled module runs unmodified on x86_64, ARM, or RISC-V hosts wherever the runtime is available. This is fundamentally different from a native binary, which has to be recompiled per target architecture and operating system ABI.

🏏

Cricket analogy: A standardized ball meeting ICC specifications performs consistently whether the match is played in Mumbai, Melbourne, or Manchester, unlike locally made balls that behave differently pitch to pitch.

WASI: System Calls for a Sandboxed World

WASI (the WebAssembly System Interface) gives a module capability-based access to files, clocks, and random numbers, meaning a module can only touch the specific directories and permissions the host explicitly preopens for it, unlike a normal POSIX process which inherits the ambient authority of whatever user account runs it. WASI Preview 2 builds on the component model to describe these interfaces with proper typed, versioned contracts instead of Preview 1's flatter, more ad hoc syscall set.

🏏

Cricket analogy: A visiting player is only allowed onto the specific practice nets the host ground has booked for them, not free run of the entire facility, mirroring capability-based access.

rust

// src/main.rs -- compiled with: rustc --target wasm32-wasi main.rs
use std::fs;

fn main() {
    let contents = fs::read_to_string("/data/config.txt")
        .expect("unable to read config");
    println!("Config contents:\n{contents}");
}

// Run with wasmtime, granting access only to ./config on the host,
// mapped into the sandbox as /data:
// $ wasmtime run --dir ./config::/data main.wasm

Serverless and Edge Use Cases

Fastly Compute, Cloudflare Workers, and Fermyon Spin run a Wasm module per incoming request because instantiation is sub-millisecond — there's no OS process fork and no container boot, just spinning up a lightweight sandbox from an already-compiled module — versus the tens to hundreds of milliseconds a container cold start typically costs. That gap is what lets these platforms pack far more tenants per physical machine than container-based serverless while still keeping each request fully isolated.

🏏

Cricket analogy: A net bowler warming up takes seconds to get into position for the next ball, unlike setting up an entirely new bowling machine and recalibrating it from scratch each delivery.

Patterns like wasmCloud and SpinKube compose many small Wasm components that communicate over well-defined WASI interfaces, similar in spirit to a microservices architecture but with a much lighter isolation boundary — components start in microseconds rather than the seconds a containerized microservice typically needs.

Limitations Compared to Native Processes

Standard WASI does not yet give a module direct threads or raw sockets — proposals like wasi-threads and wasi-sockets exist but are still maturing and not universally supported across runtimes — and any native library relying on OS-specific syscalls, threading primitives, or dynamic linking generally needs a WASI-compatible fork or feature flag before it will compile to wasm32-wasi at all. Garbage-collected languages like Python or Java also need a heavier interpreter or VM compiled to Wasm rather than producing lean, direct machine code the way Rust or C does.

🏏

Cricket analogy: A club-level ground without floodlights simply can't host a day-night match yet, no matter how good the pitch is — the missing infrastructure is the limiting factor, like missing wasi-sockets support.

Not every native Rust crate or C library compiles cleanly to wasm32-wasi — anything that shells out to raw syscalls, spawns OS threads, or depends on a platform-specific API may need a WASI-compatible fork, a feature flag, or may simply be unsupported until the relevant WASI proposal stabilizes.

Standalone runtimes (Wasmtime, Wasmer, WasmEdge) run .wasm modules outside the browser on any supported architecture unmodified.
WASI grants capability-based access to files and system resources — modules get only what the host explicitly preopens.
WASI Preview 2 layers the component model on top for typed, versioned interfaces beyond Preview 1's flatter syscall set.
Edge platforms like Fastly Compute and Cloudflare Workers exploit sub-millisecond Wasm instantiation for per-request isolation.
wasmCloud and SpinKube compose small Wasm components over WASI interfaces in a microservices-like pattern with lighter overhead.
Threads and raw sockets are still maturing WASI proposals, so not all native concurrency or networking code ports cleanly.
Garbage-collected languages need a heavier interpreter compiled to Wasm rather than producing lean native-equivalent code.