►
From YouTube: Create an Extensible Cloud Native Application with WebAssembly - Connor Hicks, Suborbital Software
Description
Don’t miss out! Join us at our next event: KubeCon + CloudNativeCon Europe 2022 in Valencia, Spain from May 17-20. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Create an Extensible Cloud Native Application with WebAssembly - Connor Hicks, Suborbital Software Systems
WebAssembly can be used as a tool to transform your application into an extensible platform. Allowing developers to write code in a variety of languages, and then running that code as part of your application is a very enticing prospect - but it needs to be done in a way that ensures performance and security. In this talk, we'll explore how Wasm can be used to create extensible systems that your users can customize and extend to fit their needs. We'll look at how your services can interact with a Wasm execution environment and run your users' code in a high-performance and secure manner using open source tooling and frameworks. When done correctly, these capabilities can be a huge win for any SaaS product. This talk will ensure that the benefits, drawbacks, challenges, and best practices of Wasm-based extensibility are well known and easy to understand. Developers and low-coders want to make full use of your software, so this talk will cover all the points you need to consider when making your product extensible. Cloud native software is changing, and we want to help the next generation of SaaS applications provide everything that modern developers are asking for.
A
So
what
are
we
trying
to
do?
Well,
the
name
of
the
game
here
is
making
developers
lives
easier.
We
want
to
allow
them
to
take
advantage
of
the
software
and
services
that
they're
already
using
to
a
higher
degree.
We
want
them
to
be
able
to
get
the
most
out
of
them
by
integrating
them
together
by
making
them.
A
You
know
conform
more
closely
to
exactly
what
they're
hoping
to
accomplish
and
we
want
them
to
be
able
to
do
this
in
a
way
that
makes
sense
to
them,
which
you
know
is
code,
so
we're
talking
about
two
slightly
different
problems
here.
The
first
is
extensibility,
which
is
the
idea
of
connecting
multiple
applications
or
multiple
services
together,
and
then
we're
also
talking
about
customizability,
which
is
taking
you
know
the
product
you're
looking
at
and
actually
making
it
work
exactly
the
way
you
want
and
maybe
changing
the
product
to
fit
your
needs
more
closely.
A
So
if
we
first
look
at
extensibility,
we
really
want
to
enable
developers
to
reach
out
and
connect
applications
to
other
things
in
their
toolbox.
That
you
know
need
the
data
that
is
potentially
siloed
within
applications
that
they
use
every
day.
And
to
do
this,
we
want
them
to
be
able
to
connect
to
apis.
We
want
to
be
able
to
connect
to
the
network
and
actually
interact
with
other
services,
and
you
know
funnel
data
from
one
to
the
other.
In
order
to
do
this,
we
need
to
provide
hook.
A
So
we
want
developers
to
be
able
to
shuttle
data
from
product
a
to
product
b
and
product
c
to
actually
accomplish
some
kind
of
business
task
and
make
their
lives
easier,
and
when
we're
talking
about
customizability,
it's
really
about
taking
the
current
product
that
you're
working
on
and
actually
make
it
conform
more
closely
to
the
task
at
hand.
So
maybe
it's
you
know
operating
close
to
the
way
that
you
need
to,
but
you
need
to
change
certain
parameters.
You
need
to
change
certain
behaviors
to
make
it
perfectly
fit
your
company
and
your
workflow.
A
So
some
examples
of
this
is
you
know:
in
data
pipelines,
for
example,
you
can
augment
scrub,
transform
data
as
it's
flowing,
and
you
know
another
example
is
taking
customers
with
various
particular
compliance
needs
or
legal
needs,
or
maybe
time-based.
Events
like
like
sales
in
an
e-commerce
store
and
letting
developers
account
for
these
in
the
very
specific
ways
that
they
need.
A
So
if
a
service
that
you're
using
you
know
produces
some
kind
of
event,
it
can
send
a
request
to
your
server
to
a
server
that
you
run
in
order
to
notify
you
that
something's
happened
provide
some
details
about
that
event
and
allow
you
to
do
some
kind
of
action
with
it,
and
I
want
to
get
into
them
for
for
a
minute
about.
You
know
why
these
are
not
the
ideal
solution
to
this
kind
of
problem.
A
There's
three
main
reasons
that
you
know
we
we
don't
particularly
love
working
with
web
hooks.
The
first
is
performance
by
nature.
A
web
hook
has
to
go
over
the
public
internet,
and
this
incurs
an
inherent
amount
of
latency.
That
you
know
is
acceptable
in
a
lot
of
a
lot
of
situations,
but
there
are
times
where
this
really
affects
performance,
because
you
know
two
servers
could
be
an
entire
ocean
away
from
each
other.
A
They
could
be
many
hundreds
of
milliseconds
away
and
it
can
really
impact
the
amount
of
data
that
you're
able
to
process
using
web
hooks,
and
on
top
of
that,
the
server
receiving
the
request.
You
know
we
we
honestly
don't
know
anything
about
it.
If
we
are
the
service
provider,
we
don't
know
anything
about
the
server
that
is
receiving
this
webhook
request,
and
so
it
could
be
an
ancient
pearl
software
running
on
a
mainframe
in
the
basement
and
it
could
take
ages
to
respond.
A
You
know
we
just
don't
know,
and
so
there's
a
lot
of
variability
when
it
comes
to
that.
The
next
thing
that
we
think
about
with
web
hooks
is
security.
There's
no
real
standardized
way
for
the
sender
of
a
web
hook
and
the
receiver
to
validate
each
other's
identities,
to
ensure
that
nothing
malicious
is
happening
and
so
different.
You
know
web
hook,
service
providers
need
to
basically
build
bespoke
systems
based
on
digital
signatures
or
certificates
that
the
you
know.
A
The
receiver
then
needs
to
deal
with,
and
they
can
often
vary
greatly
between
different
service
providers,
which
is
you
know,
not
great
for
the
receiver
to
have
to
deal
with,
and
there
is
the
inherent
problem
of
sending
potentially
very
sensitive
information
over
the
internet.
We
can't
always
allow
this.
A
There
are
certain
you
know,
industries
that
just
can't
deal
with
sending
sensitive
information
over
the
public
internet,
even
if
it
is
tls
encrypted
and
so
web
hooks
can
often
not
be
an
acceptable
solution
there,
and
the
final
thing
when
we
think
about
web
hooks
is
the
burden
that
it
puts
on
the
end
user
right.
They
can
be
very
you
know
flexible
and
convenient,
but
at
the
end
of
the
day,
the
user
receiving
the
web
hook
still
needs
to
set
up
some
kind
of
infrastructure
in
order
to
receive
these
web
hook
messages.
A
So
that
involves
standing
up
some
kind
of
cloud
infrastructure,
whether
it's
a
you
know,
vm
or
a
lambda,
or
something
like
that,
and
then
they
need
to
write
software
to
receive
that
handle
the
handle
the
events
as
needed
and
that
software
needs
to
be
tested.
It
needs
to
be
maintained.
It
means
you
know
ensure
it
doesn't
go
down
all
these
kinds
of
tasks
that
are
just
inherently
work.
That
needs
to
be
done
when
dealing
with
web
hook
type
integrations.
A
So
there's
another
kind
of
category
of
integrations
that
we
talk
about,
which
is
these
native
integrations,
which
is
you
know,
a
pre-built
type
of
integration
that
a
particular
application
provides,
and
you
know
it's
completely
controlled
by
the
service
provider.
So
it's
something
like
you
know,
connect
to
github
these
kinds
of
integrations
that
you,
you
know,
create
a
secure
connection
between
two
applications,
which
is
which
is
really
great
because
it's
usually
based
on
a
standard
like
oauth,
but
the
the
drawback
to
this
kind
of
integration
is
that
they
are
very
limited
in
the
customization.
A
The
the
service
provider
needs
to
create
user
interface
to
configure
and
tweak
how
the
integration
works
and
there's
only
so
many
options
that
they
can
provide,
and
so
you're
always
going
to
be
limited
in
the
options
there,
and
one
thing
that
this
type
of
integration
will
very
rarely
address
is
the
need
to
actually
send
data
and
integrate
with
on-prem
or
legacy
type
systems.
Where
you
know,
it's
very
unlikely
that
a
service
provider
is
going
to
put
in
the
effort
required
to
you
know,
add
a
bespoke
integration
just
for
one.
A
You
know
application
that
your
company
is
running
on
a
server
the
you
know,
it's
very
unlikely
unless
you
pay
them
a
lot
of
money
that
they're
going
to
do
that
work
for
you.
So
when
you
have
you
know,
when
you
find
yourself
in
this
kind
of
situation,
you
pretty
much
just
have
to
fall
back
to
web
hooks,
which
is
we've
already
kind
of
covered
that
so
there
must
be
a
better
way.
A
That's
kind
of
the
question
that
I
I've
been
asking
myself
and
I
do
believe
that
there
is
a
better
way
and
this
is
to
actually
embed
the
user's
logic
directly
into
the
application
in
question,
so
the
service
provider
that
is
allowing
their
user
to
you
know,
integrate
with
other
products,
can
actually
let
the
developer
or
the
user
fully.
You
know,
add
their
own
extension
and
their
own
logic
into
the
application
itself,
and
I
think
you
know
where
we're
going
with
this
webassembly
is
a
really
good
tool
to
enable
this.
A
So
why
would
we
want
to
embed
the
user
logic
directly?
Well,
it
kind
of
speaks
to
the
exact
problems
that
we
saw
with
web
hooks
earlier,
which
is
performance,
security
and
the
burden
put
on
the
end
user
running
a
webassembly
based
function
directly
inside
of
an
application's.
You
know,
service
is
much
higher
performance
than
sending
a
request
over
the
internet.
You
can
execute
these
functions
directly
within
the
same
compute.
That
is
running
the
actual
application
itself,
and
so
you
don't
have
to
traverse
the
network.
A
You
don't
need
to
deal
with
all
of
the
uncertainty
and
latency
that
the
internet
provides,
and
we
have
a
much
higher
level
of
security
because
pretty
much
the
same
reasons,
we
don't
need
to
send
data
over
a
public
network.
We
can
keep
the
information
completely
within
a
private
trusted
network
and
ensure
that
there
is
no
need
to
validate
identities,
validate
signatures
in
the
first
place,
because
the
infrastructure
is
completely
under
control
of
the
service
provider
and
finally,
it
lowers
the
burden
on
the
end
user.
A
So
why
is
webassembly
a
good
candidate
for
building
these
kinds
of
integrations?
Well,
from
from
all
of
the
conversations
I've
had
with
people
across
the
industry
over
the
last
couple
of
months,
there
are
a
couple
of
things
that
they
get
really
excited
about.
When
we
talk
about
this
kind
of
functionality,
you
know
the
ability
for
developers
to
use
languages
they're
already
familiar
with
to
build.
These
kinds
of
integrations
is
a
big
selling
point.
A
It's
what
they
are
currently
doing
with
webhook
servers
minus
all
the
headaches
of
setting
up
and
monitoring
infrastructure,
so
they
can
use
languages
that
they
already
know
to
make
your
product
work.
The
way
that
they
want
to
and
webassembly
has
a
very
fast
startup
time.
It
is
a
much
more
lightweight
solution
than
a
container
because
there's
just
frankly,
a
lot
less
stuff
inside
a
webassembly
module
compared
to
a
container.
A
So
when
you
are
looking
to
execute
a
webassembly
module,
the
the
startup
time
is
usually
single
digit
milliseconds
in
the
in
the
average
case,
and
it
makes
it
really
easy
to.
You
know
have
a
high
volume
at
a
high
amount
of
throughput,
even
when
you
are
loading
a
function
from
storage
for
for
a
cold
start
and,
lastly,
the
webassembly
security
model
kind
of
goes
beyond
just
like.
Oh,
I
am
executing
a
function
in
my
local
network.
A
We
can
actually
go
beyond
those
security
properties
and
actually
have
a
high
degree
of
control
over
what
the
code
in
that
webassembly
sandbox
is
able
to
do
because
of
the
way
that
web
assembly
is
designed
and
the
way
that
the
webassembly
runtime
interacts
with
the
host
machine
that
is
executing
that
code.
So
we
can
have
a
high
degree
of
control
over
what
the
user's
code
is
allowed
to
do
and
ensure
that
it
is
not
doing
anything
malicious.
A
So,
let's
take
a
quick
look
at
some
examples
here.
This
is
a
function
that
I
imagine
would
run
inside
of
a
sas
application
when
a
new
user
has
joined
the
service
and
you
could
imagine
the
developer
wanting
to
decide
what
happens
when
a
new
customer
joins
their,
you
know
their
account,
they
can
do
things
like
hey.
You
know
this
user's
company
has
more
than
500
people.
A
So
this
is
written
in
assembly
script
and
you
can
see
that
in
you
know
just
a
couple
of
lines.
We
were
able
to
accomplish
what
would
have
taken
a
fair
amount
of
effort
to
stand
up
in
a
traditional
web
hook,
server
way
so
flipping
over
to
the
other
side
and
looking
at
the
host
application
and
what
it
takes
to
actually
execute
one
of
these
functions.
A
You
know
webassembly,
runtimes
and-
and
these
integrations
have
come
a
very
long
way
in
the
last
couple
of
months
and
the
last
few
years.
It's
now
become
quite
easy
to
take
advantage
of
webassembly
load.
These
functions
from
from
storage
and
execute
them.
We
we
can.
What
you
can
see
here
is
basically
a
full
example
of
doing
this.
A
You
can
imagine
storing
webassembly
modules
in
something
like
an
s3
bucket
loading
them
on
demand
as
needed
and
executing
that
with
the
data
that
you,
you
know,
need
the
function
to
handle
and
we're
doing
that
here
in
just
you
know,
maybe
15
lines
of
code.
This
is
using
our
reactor
project,
which
is
a
multi-tenant
web
assembly
runtime
for
go,
but
there
are
many
different
ways
that
you
could
go
about
this.
A
So,
when
you're
executing
user
code,
you
want
to
make
sure
that
you
are
giving
them
the
abilities
that
they
need
in
order
to
accomplish
their
business
tasks
without
unduly
compromising
your
infrastructure
and
your
application.
So
with
reactor
and
with
you
know
the
suborbital
set
of
projects
you
can
declaratively
and
very
simply
control
what
these
functions
can
do.
A
So
we
have
a
fairly
high
degree
of
control
here
and
if
we
were
to
disable
all
of
these
capabilities,
then
the
code
would
have
not
access
to
nothing.
They
would
you
know
that
they
would
be
able
to,
for
example,
process
data
and
maybe
transform
it,
and
this
can
be
useful
in
some
situations
like
a
data
pipeline,
but
for
a
lot
of
the
applications
and
a
lot
of
the
integrations
that
we're
talking
about
here.
A
You
know
I
I
spun
up
instances
in
two
different
regions
of
the
same
cloud
provider
and
I
ran
some
tests
of
sending
webhook
messages
between
them
compared
to
executing
embedded
webassembly
functions
and
the
you
know
the
performance
is
is
quite
profound.
You
can
see
that
when
sending
web
hooks,
you
know
even
among
within
the
same
cloud
provider
two
different
regions,
the
the
latency
is,
is
averaged
out
to
30
milliseconds,
and
so
we,
you
know
over
the
30-second
window
that
we
were
measuring.
A
A
And
it's
it's
important
to
note
that
there's
there's
going
to
be
this
cost
to
the
end
user,
so
that
the
ten
dollars
a
month
that
you
see
there,
that
was
the
cost
that
we,
you
know
we're
paying
for
these
instances
to
do
this
test.
You
can
probably
get
it
cheaper
down
to
maybe
five
dollars
a
month,
but
there's
always
going
to
be
some
kind
of
cost
to
that
end.
User-
and
you
know
this
is
without
thinking
about
the
engineering
time
it
takes
to
set
up
this
infrastructure,
the
monitoring
and
other.
A
A
If
you're,
considering
setting
this
kind
of
thing
up
for
your
users
and
I'll
just
run
through
them
very
quickly,
and
the
first
is
that
you
need
to
be
careful
about
wazi,
which
is
the
webassembly
system
interface
and
the
the
capabilities
provided
by
your
webassembly
runtime,
because
you
want
to
make
sure
you
are
locking
these
functions
down.
Malicious
code
is
definitely
rampant.
A
A
The
next
is
multi-tenancy,
so
we
have
protections
built
into
the
reactor
project
to
ensure
that
when
you
are
running
many
different
functions
together
in
the
same
instance
that
they
are
not
going
to
be
noisy
neighbors
and
they
are
not
going
to
chew
up
more
memory
or
cpu
or
go
on
forever
and
ensure
that
they
are
being
good
citizens
and
that
these
functions
are,
you
know
just
starting
up
doing
what
they
want
and
then
shutting
down,
and
not
being
you
know
bad.
This
is
something
to
keep
in
mind.
A
Most
of
the
webassembly
runtimes
will
give
you
some
controls
to
ensure
that
this
doesn't
happen.
But
it's
something
to
be
aware
of
the
next
is
something
that
you
may
not
consider
right
off
the
bat,
but
not
all
languages
that
can
compile
the
webassembly
have
full
support
for
all
the
different
data
formats
that
you
might
be
interested
in
in
working
with.
So,
for
example,
you
may
not
be
able
to
find
an
xml
library
for
all
the
different
programming
languages.
A
The
the
package
ecosystem
is
another
thing
that
you,
you
might
not
consider
right
off
the
bat.
Not
not
only
will
most
packages
not
work,
but
you
know
most
packages
will
not
work
in
interesting
ways,
so
you
can't
just
pull
any
old
language
library
off
of
the
shelf
from
npm
or
cargo
you.
You
need
to
kind
of
do
your
research
and
know
how
these
various
libraries
are
going
to
interact
with
your
webassembly
runtime
before
you
can
offer
them
to
your
customer,
and
you
probably
can't
just
allow
your
customer
to
take
anything.
A
They
want
off
the
shelf.
You
need
to
have
a
conversation
with
them
and
understand
the
requirements
before
you
go,
and
you
know
allow
that
kind
of
thing.
And
then
the
last
thing
is
you
know.
Cold
starts
do
vary
by
language.
So
if
you
look
at
something
like
swift
that
packages
the
entire
swift
runtime
into
a
webassembly
module,
this
would
take
longer
to
do
ahead
of
time.
Compilation
on
and
so
the
startup
time,
while
still
better
than
a
container,
will
take
significantly
longer
than
something
like
rust.
A
So
you
just
need
to
keep
in
mind
that
not
all
languages
are
completely
equal
in
the
webassembly
world
and
you
should
probably
do
your
own
research
and
look
at
the
performance
numbers
there,
and
all
of
that
is
kind
of
encapsulated
in
communicate
with
your
users,
ensure
that
they
know
the
the
limitations
and
the
capabilities
and
what
these
functions
are
able
to
do.
Set
them
up
for
success,
make
sure
that
they
have
the
right
expectations,
because
there
is
a
lot
you
can
do
with
this
style
of
integration.
A
It
is
a
very
powerful
way
of
building
software,
but
it's
not
a
silver
bullet,
it
doesn't
solve
every
problem
and
they
need
to
be
aware
of
that
going
into
it.
So,
with
all
of
that
said,
I'm
going
to
end
it
here.
Thank
you
so
much
for
having
me
at
the
conference.
I
hope
you'll
come
and
check
out.
Suborbital
and
look
at
the
different
things
we
have
been
working
on
in
regards
to
embedded
functions,
extensibility
in
sas,
and
you
know
application
development
with
webassembly.