← All projects

Multi-Process Wasmtime

Single-process Wasmtime compared with Multi-Process Wasmtime, which separates guest and host execution and marshals guest-memory arguments through temporary buffers.
Descriptor-based data transfer across the guest–host process boundary. In the single-process model (top), host functions can directly access guest linear memory. In the multi-process design (bottom), parameter descriptors identify pointer/length pairs and specify how data moves between guest memory and host-side temporary buffers. WasmOut describes guest-to-host transfers, such as a string passed for printing; WasmIn describes host-to-guest transfers, such as a response copied into a guest-provided buffer. Both directions are named from the guest’s perspective.

In Wasmtime’s single-process model, WebAssembly guests and the host functions they invoke share an address space. Although guests execute inside the runtime’s sandbox, a sandbox escape can expose other data within that process. This project explores an additional isolation boundary: separating guest execution from host-function execution across OS processes.

The challenge is preserving the interaction between guests and host functions. A guest may pass a pointer and length identifying a buffer in its linear memory, which a host function can access directly in the single-process model. Once execution is separated, simply forwarding those arguments is insufficient: the pointer is an offset into guest memory, not a usable address in the host process. WebAssembly’s numeric function signatures also do not explain which arguments represent pointers, how they relate to lengths, or whether the host should read or write the associated data.

The approach is to associate host functions with parameter descriptors that make these memory relationships explicit. Each buffer descriptor pairs a pointer argument with its length argument and specifies the direction of data transfer. As illustrated above, WasmOut describes data flowing out of the guest—for example, a string passed to the host for printing. WasmIn describes data flowing into the guest—for example, a response written into a guest-provided buffer. The directions are defined from the guest’s perspective, allowing the same numeric interface to describe both kinds of interaction.

The Rust research prototype integrates these descriptors into Wasmtime’s module and runtime machinery. For guest-provided data, the runtime uses the descriptor to copy the required bytes from linear memory and send them together with the call arguments. The host function then accesses temporary buffers rather than the guest’s live memory. Sending the input data eagerly allows the host to receive what it needs with the call, instead of receiving only numeric arguments and then requesting the underlying bytes separately.