{"id":79794,"date":"2020-04-07T07:00:25","date_gmt":"2020-04-07T14:00:25","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/opensource\/?p=79794"},"modified":"2025-06-27T03:34:41","modified_gmt":"2025-06-27T10:34:41","slug":"announcing-krustlet-kubernetes-rust-kubelet-webassembly-wasm","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2020\/04\/07\/announcing-krustlet-kubernetes-rust-kubelet-webassembly-wasm\/","title":{"rendered":"WebAssembly meets Kubernetes with Krustlet"},"content":{"rendered":"\n

Linux container<\/span> technology has<\/span> changed the face of computing, but especially distributed computing in <\/span>publicly rentable <\/span>servers commonly said t<\/span>o <\/span>be \u201cthe public cloud\u201d (like Microsoft Azure). With <\/span>containers <\/span>came <\/span>tooling \u2013 like <\/span>Docker<\/span><\/a> \u2013 and systems that orchestrate potentially millions of them \u2013 with <\/span>Kubernetes<\/span><\/a> becoming the most widely used<\/span>. Together, <\/span>they have enabled millions of developers and organizations to deliver software more rapidly, widely, and productively than ever before. <\/span> <\/span><\/p>\n\n\n\n

Even so, there <\/span>are limitations to containers and Kubernetes, so tightly bound as they are in their <\/span>boom<\/span>ing ecosystem. <\/span>A couple areas stand out: <\/span>the work required to lock container runtimes down <\/span>and specialized environments<\/span> either<\/span> requiring <\/span>more <\/span>speed or having <\/span>sharply <\/span>constrained resources.<\/span> <\/span> <\/span><\/p>\n\n\n\n

Yesterday, we released v0.1.0 of<\/span> <\/span>Krustlet<\/span><\/a>,<\/span> a project which explores <\/span>using <\/span>WebAssembl<\/span>y modul<\/span>es<\/span><\/a> in Kubernetes <\/span>to <\/span>address <\/span>some<\/span> of these scenarios<\/span>. <\/span>With <\/span>Krustlet<\/span> you can <\/span>test-drive <\/span>WebAssemblies<\/span><\/a> <\/span>(also called <\/span>WASM) in Kubernetes alongside your containers<\/span>, <\/span>offering <\/span>the possibility of <\/span>new <\/span>security and runtime <\/span>capabilities<\/span>.<\/span> <\/span>If you\u2019re<\/span> already hooked and want to experiment<\/span> with Kubernetes and <\/span>WASM<\/span>, you can <\/span>dive right in with the project<\/span>, or read<\/span> the<\/span> <\/span>introduction to Krustlet<\/span> <\/span>by Matt Fisher<\/span><\/a>.<\/span> <\/span><\/p>\n\n\n\n

Secure runtimes and constrained environments are hard<\/h2>\n\n\n\n

The container <\/span>community, i<\/span>ncluding Microsoft, <\/span>has worked extremely hard <\/span>for years on security issues<\/span> and has made amazing progress<\/span>. Container runtimes have restricted<\/span> <\/span>the ability of containers to <\/span>use sensitive <\/span>kernel <\/span>calls<\/span> <\/span>and <\/span>the Kubernetes ecosystem has <\/span>enough new <\/span>tools \u2013 meshes, access policy engines, thin hypervisors \u2013 that with work, <\/span>a<\/span> <\/span>substantial <\/span>degree of confidence in <\/span>security<\/span>–<\/span>sensitive environments can be achieved. If you\u2019re <\/span>good<\/span>. <\/span> <\/span><\/p>\n\n\n\n

Despite this tremendous work, there remain environments for which Kubernetes and containers are not yet well suited. <\/span>For example, c<\/span>ontainers<\/span> should <\/span>be small, <\/span>but often aren\u2019t. E<\/span>nvironments <\/span>with constrained <\/span>resources \u2013 <\/span>memory and disk space, primarily \u2013 <\/span>cannot<\/span> <\/span>use <\/span>large containers <\/span>and the runtimes they need<\/span>. <\/span>Even if they <\/span>could<\/span>, <\/span>some <\/span>organizations remain unready to deploy a <\/span>runtime when the default configuration must be dramatically tightened down to provide confidence.<\/span> <\/span> <\/span><\/p>\n\n\n\n

What i<\/span>f we had another <\/span>sandboxed process type<\/span><\/i>, one that was <\/span>by default completely sandboxed<\/span> and for which the runtimes could be both extremely fast \u2013 faster than launching containers \u2013 <\/span>and also<\/span> much smaller<\/span>? C<\/span>ould <\/span>it be<\/span> possible for Kubernetes to run those? <\/span> <\/span><\/p>\n\n\n\n

The answer is <\/span>yes, it is possible.<\/span><\/i> <\/span><\/i> <\/span><\/p>\n\n\n\n

One way to do the above is to use a very small hypervisor; in fact, there are several that have been built, among them <\/span>gVisor<\/span><\/a>. Start-up time is reduced, and security aspects are addressed as well<\/span>, so this approach is a promising area for the current workloads in Kubernetes. Even so, there <\/span>is <\/span>another sandboxed process type that has a vibrant ecosystem<\/span>, a secure-by-default runtime model, and is very fast and very small. <\/span>WebAssembly.<\/span> <\/span><\/p>\n\n\n\n

WASM and WASI enter the picture<\/strong><\/h4>\n\n\n\n

Get ready for a lot of acronyms. <\/span>WebAssembly<\/span> \u2013 commonly called <\/span>WASM<\/span><\/a> \u2013  is a compact bytecode format optimized for fast download and maximum execution speed and has been an <\/span>open web standard<\/span><\/a> for <\/span>a few years<\/span>. Up until now, it has been used mainly in browsers for fully sandboxed, but highly performant, computing. For one <\/span>recent <\/span>example, Microsoft\u2019s <\/span>Blazor Framework<\/span><\/a> can use WASM to enable very performant and complex visualizations, among other things.<\/span><\/p>\n\n\n\n

One of the hindrances of using <\/span>WebAssembly<\/span> outside browser environments has been the lack of a single compile target. But l<\/span>ast year <\/span>Mozilla<\/span><\/a> announced the <\/span>WebAssembly System Interface<\/span><\/a> effort, or <\/span>WASI<\/span><\/a>, to provide a system interface so that compilers can target the interface and not the <\/span>underlying operating system \u2013 and that <\/span>could <\/span>make <\/span>WebAssembly<\/span> a developer target at scale. <\/span>If you want to know a lot more about WASI, <\/span>Lin Clark\u2019s original announcement<\/span><\/a> is a great explainer.<\/span><\/p>\n\n\n\n

If you\u2019re unclear about the potential of WASI to bring WASM to the masses, perhaps <\/span>Docker founder <\/span>Solomon Hykes can convince you:<\/span> <\/span><\/p>\n\n\n\n

\"Solomon<\/a><\/figure>\n\n\n\n

<\/p>\n\n\n\n

Importantly, at a very high level WASM has two main features that the Kubernetes ecosystem might be able to use to its advantage:<\/p>\n\n\n\n