►
Description
Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
Going Containerless with WebAssembly - Kevin Hoffman, Capital One
WebAssembly is the future of distributed computing. This session explains what WebAssembly is, how it works outside the browser, and why people at a cloud conference should take notice. Attendees will learn how, with the use of a few open source projects, building functions and services in WebAssembly can be easier, faster, and more secure than building traditional services. Demonstrations will include building systems that engage in low-level, RPC-style communication between the runtime host and guest module, then advancing to the examination of a host runtime written in Rust that dynamically and securely binds zero-trust WebAssembly functions and services with high-privilege capability plugins like message broker providers, key-value stores, and more (also written in WebAssembly!).
https://sched.co/Zer1
A
So
the
agenda
for
this
video
is
first
thing
I
want
to
do
is
take
a
look
at
some
of
the
problems
with
software
development
today
and
how
webassembly
in
general
or
as
a
technology
and
technology
standard,
might
be
able
to
help
us
and
then
I'll,
introduce
wasc
and
go
over
some
last
key
concepts
and
how
wasc
aims
to
improve
on
our
software
development
experience
today
and
then.
Finally,
we'll
get
to
the
good
stuff,
which
is
the
demos.
A
So
software
development
today
is
full
of
copy
and
pasted
complexity,
and
this
is
where
we
have
a
solution
to
one
problem.
Another
problem
comes
along
and
we
often
tend
to
just
copy
and
paste
the
solution
from
one
problem
to
another
and
like
any
good
sci-fi
movie
about
clones,
when
you
clone
a
clone,
you
lose
fidelity
and
we
lose
that
same
type
of
fidelity.
A
When
we
continually
reuse
solutions,
reuse,
solutions
to
problems
we
get
further
and
further
away
from
the
problem
that
we
were
originally
trying
to
solve,
and
the
amount
of
boilerplate
that
our
code
is
filled
with
is
partly
to
blame
here,
because
it's
such
a
chore
to
rewrite
all
of
this
all
of
the
ceremony
that
our
code
normally
needs.
We
copy
and
paste
it,
and
so
we
copy
and
paste
the
boilerplate
and
business
logic,
because
the
boilerplate
is
usually
difficult
to
separate
from
the
business
logic
and
the
development
that
we
do.
A
A
A
That
means
that
the
same
webassembly
module
will
operate
the
same,
no
matter
where
it's
run
so
long
as
it
has
a
suitable
host.
Runtime
webassembly
is
fast,
it's
a
stack-based
virtual
machine,
and
so
it's
instruction
execution
is
extremely
fast
and,
as
I'll
explain
a
little
bit
later
in
the
video,
we
also
have
the
ability
to
compile
ahead
our
webassembly
instructions
into
native
machine
instructions.
A
Webassembly
is
secure.
By
definition,
the
webassembly
virtual
machine
is
a
sandbox
and
that
sandbox
has
memory
isolation.
The
instruction
set
for
webassembly
does
not
allow
for
executing
instructions
outside
that
module,
and
so
by
default,
this
development
target
is
more
secure
than
most
of
what
we're
doing
these
days.
A
A
A
A
A
A
So
at
the
bottom,
the
core
of
the
west
stack
is
the
webassembly
engine
and
webassembly
engines
tend
to
come
in
two
different
varieties.
We
have
the
jitter
or
the
compilers
or
the
interpreters
and
the
compilers,
as
their
name
implies,
take
the
webassembly
instructions
and
compile
them
into
native
machine
instructions.
For
whichever
machine
read
that
webassembly
module
at
runtime
interpreters,
on
the
other
hand,
don't
convert
the
webassembly
instructions,
they
just
interpret
them
as
they
encounter
them
and.
A
There
are
use
cases
where
you,
you
might
want
a
jitter
and
use
cases
where
you
might
want
an
interpreter.
Interpreters
are
going
to
have
less
startup
time
as
a
penalty,
but
they
might
have
a
higher
latency
on
individual
function.
Calls,
although
the
interpreters
that
we
have
access
to
today
are
still
extremely
fast
above
this
in
the
stack
is
web
assembly
procedure
calls,
and
this
is
a
standard
that
was
created
to
allow.
A
And
so
what
that
means
is
a
lot
of
times
when
we,
when
we
see
webassembly
modules
that
are
generated
through
code
generation
and
javascript
shims,
and
things
like
that.
We'll
see
that
those
modules
rely
on
a
javascript
style
memory,
allocation
pattern
for
the
host
runtime
and
so
that
limits
that
module's
portability.
A
So
as
long
so,
a
language
whether
it's
a
guest
or
a
host
can
conform
to
wapc,
regardless
of
how
memory
is
allocated
in
that
language
and
regardless
of
whether
that
language
even
has
a
garbage.
Collector
wapc
also
serves
as
an
anti-corruption
layer
between
the
webassembly
engine
and
the
higher
levels.
So
you
should
be
able
to
swap
out
the
webassembly
engine
for
purpose-built
stacks,
depending
on
your
use
case,
without
having
to
rewrite
any
of
the
code
that
exists
above
the
wapc
level.
A
So
above
wapc
we
have
a
rust
crate
called
wascap,
and
this
crate
provides
capabilities
based
security,
as
I've
mentioned.
This
is
where
all
of
the
code
exists,
that
embeds
cryptographically
assigned
json
web
tokens
into
webassembly
modules,
reads
them
from
the
modules
and
performs
all
the
different
verification
checks
that
you
need
to
perform
on
those
tokens.
A
So
if
your
needs
aren't
all
that
specific
and
what
you're
doing
is
just
dynamically
hosting
actors
and
capabilities,
then
you
should
be
able
to
use
this
host
binary
as
your
as
the
process
that
you
schedule
in
on
whatever
infrastructure
you're
using.
But
it's
also
fairly
easy
to
create
your
own
custom
binaries
that
allow
you
to
mix
and
match
the
set
of
features
that
are
specific
to
your
needs.
A
A
But
what
if
we
were
to
take
a
look
at
how
we
might
build
services
with
actors
in
with
actors
we
have
loose
coupling
and
actors
are
fully
composable,
so
our
actor
code,
the
core
of
what
we
write,
is,
should
be
90
feature.
It
should
be
pure
business
logic
and
then,
when
we
want
to
use
an
http
client,
our
code
consumes
a
generic
abstraction
over
http
clients
and
the
was
coast.
Runtime
is
responsible
for
dynamically,
satisfying
the
requirements
of
an
http
client
to
our
actor.
A
Our
code
is
unaware
of
which
http
client
were
using
or
how
that
http
client
got
configured.
The
last
coaster
on
time
takes
care
of
all
of
that.
For
us,
the
same
goes
with
the
http
server,
our
relational
database
client
and
our
cache
clients
and
any
other
capability.
We
can
dream
up.
Our
actors
are
isolated,
highly
testable
small
units
of
deployment.
A
So
what
does
the
development
workflow
look
like
when
we're
building
actors
in
musk?
The
first
thing
we
do
is
we
create
an
actor,
and
today
we
can
create
that
actor
in
rust
or
assembly,
scripts
or
zig,
hopefully
soon
we'll
be
able
to
create
one
in
go
once
goes.
Webassembly
integration
gets
a
little
bit
better,
we'll
compile
that
actor
to
a
wasm
file,
and
this
is
our.
A
A
And
now,
let's
take
a
look
at
what
an
actor
looks
like
this
is
using
the
rust
sdk
and
in
just
a
small
amount
of
code,
you
should
be
able
to
tell
even
if
you
can't,
really
read
rust,
that
what
we're
doing
is
handling
two
different
messages,
we're
handling
a
health
request
and
we're
handling
an
http
request
and
a
pattern
that
is
pretty
common
as
part
of
the
actor
model
in
general
is
the
idea
of
being
reactive.
These
actors
can't
do
anything
on
their
own.
A
Sample
is,
what's
not
in
here,
there's
no
code
to
create,
configure
or
instantiate
an
http
endpoint,
there's
no
code
to
configure
restful
capabilities,
there's
no
code
to
create
and
configure
a
key
value
store
endpoint
that
code
there's
no
there's
nothing
tightly
coupled
to
it.
So
what
you
can't
tell
from
this
code
is
how
the
http
server
is
satisfied
and
how
the
key
value
store
is
satisfied.
A
A
A
What
you
don't
see
here
is
the
code
to
start
an
http
server.
You
don't
see
code
that
assigns
a
port
number
and
there's
no
routing
rules.
It's
just
pure
business
logic
where
you,
as
the
actor
developer,
get
to
declare
what
it
is.
Your
code
is
going
to
do
in
response
to
an
http
request,
and
so
what
we
need
to
do
before
we
can
run
this
is
to
compile
it
and.
A
And
if
we
look
at
the
make
file
we'll
see
that
we
have
some
of
that
stuff
already
taken
care
of
for
us.
So
if
you
look
at
the
build
and
release
tasks,
you'll
see
that
I'm
using
the
wascap
cli
to
sign
the
hello.wasm
file
using
a
account.nk
file
for
the
issuer
key
and
the
module.nk
file
for
the
subject
key,
and
so
the
makefile
also
comes
with
the
ability
to
create
keys.
A
A
That's
another
one
of
the
goals
of
the
project
is
to
achieve
a
greater
workload
density
when
we're
deploying
these
things
to
the
cloud,
and
so
I've
got
the
actor
here.
I
have
the
capability
that
I
want
to
load,
which
is
a
linux,
dynamically
linked
library
that
I'm
using
as
a
plugin,
and
then
I
have
the
bindings
for
my
actor,
and
this
is
the
public
key
of
the
actor
and
I'm
binding
it
to
the
wasp
http
server
capability,
with
the
configuration
inside
this
values
tag
and
I'm
assigning
the
port
to
8081.
A
It
will
change
the
public
identity
of
a
module,
and
so,
when
you
are
going
through
the
wesk
samples
and
through
the
github
repository
and
tutorials
you'll
notice
that
there
are
a
number
of
times
where
it
mentions
that
the
actors,
public
key,
will
not
match
what
you
have
on
your
system
and
that's
because
the
private
keys
that
we
have
on
our
system
or
in
github
or
in
our
ci
pipeline
are
not
going
to
be
the
private
keys.
You
have
on
your
machine.
A
A
A
So
let's
try
that
again
and
now
I
realize
this
isn't
as
interesting
as
a
web
ui
or
a
video
game.
But
there
are
some
interesting
things
happening
here.
The
first
thing
we
can
see
is
that
the
westcoast
discovered
capability
at
the
stations
for
an
actor,
and
it
says
it
is
that
it
uses
the
wask
http
server.
A
So
this
is
up
and
running,
and
so
I
should
be
able
to
open
another
terminal
here
and
curl
the
service
running
on
port
8081
and,
as
I
discussed
earlier,
what
was
happening
was
we
were
just
returning,
okay
with
no
body,
so
this
is
exactly
what
I
would
expect
to
get
and
just
to
verify
that.
That's
that's
why
I
got
that
answer.
Let's
stop
the
west
coast
and
try
and
trail
that
again
and
now
I
get
connection
refused
so.