{"id":97273,"date":"2025-03-26T07:00:00","date_gmt":"2025-03-26T14:00:00","guid":{"rendered":"https:\/\/opensource.microsoft.com\/blog\/?p=97273"},"modified":"2025-08-13T14:56:10","modified_gmt":"2025-08-13T21:56:10","slug":"hyperlight-wasm-fast-secure-and-os-free","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/","title":{"rendered":"Hyperlight Wasm: Fast, secure, and OS-free"},"content":{"rendered":"\n<p>Last fall the Azure Core Upstream team&nbsp;<a href=\"https:\/\/aka.ms\/hyperlight-announcement\" target=\"_blank\" rel=\"noreferrer noopener\">introduced Hyperlight<\/a>: an open-source Rust library you can use to execute small, embedded functions using hypervisor-based protection. Then, we showed how to run <a href=\"https:\/\/aka.ms\/hl-kubecon-demo-post\" target=\"_blank\" rel=\"noreferrer noopener\">Rust functions really, really fast<\/a>, followed by using <a href=\"https:\/\/aka.ms\/hyperlight-javascript\" target=\"_blank\" rel=\"noreferrer noopener\">C to run Javascript<\/a>. In February 2025, the Cloud Native Computing Foundation (CNCF) voted to onboard Hyperlight into their Sandbox program.<\/p>\n\n\n\n<p>We&#8217;re announcing the release of Hyperlight Wasm: a Hyperlight virtual machine (VM) \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. If you\u2019d like to dive straight in, you can visit the <a href=\"https:\/\/github.com\/hyperlight-dev\/hyperlight-wasm\" target=\"_blank\" rel=\"noreferrer noopener\">hyperlight-wasm repo<\/a> on GitHub. In the remainder of this post we&#8217;ll cover the basics of how Hyperlight Wasm works and then walk through how to build a Rust example step-by-step.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-16018d1d wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/github.com\/hyperlight-dev\/hyperlight\" target=\"_blank\" rel=\"noreferrer noopener\">Join the Hyperlight community<\/a><\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"performance-and-compatibility\">Performance and compatibility<\/h2>\n\n\n\n<p>Traditional virtual machines do a lot of work to be able to run programs. Not only do they have to load an entire operating system, they also boot up the virtual devices that the operating system depends on. Hyperlight is fast because it doesn\u2019t do that work; all it exposes to its VM guests is a linear slice of memory and a CPU. No virtual devices. No operating system.<\/p>\n\n\n\n<p>But this speed comes at the cost of&nbsp;<em>compatibility<\/em>. Chances are that your current production application expects a Linux operating system running on the x86-64 architecture (hardware), not a bare linear slice of memory. And compatibility is not just limited to operating systems; it can be discussed at three distinct levels:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Operating system<\/strong>: Linux, macOS, and Windows provide a portable abstraction across different hardware.<\/li>\n\n\n\n<li><strong>System interface layer<\/strong>: System&nbsp;interface standards such as Portable Operating System Interface (POSIX) and the <a href=\"https:\/\/github.com\/WebAssembly\/wasi\" target=\"_blank\" rel=\"noreferrer noopener\">WebAssembly System Interface<\/a> (WASI) provide interoperability across operating systems.<\/li>\n\n\n\n<li><strong>Programming language\/library<\/strong>: Programming languages&#8217; standard libraries and runtimes provide interoperability across system interfaces.<\/li>\n<\/ul>\n\n\n\n<p>Targeting compatibility with an OS at that layer allows one to abstract over the language\/runtime that a customer might want to use, because common OS\u2019s are almost universally supported by languages, libraries, and application programs\u2014but that comes at the cost of requiring that a specific relatively-heavyweight execution environment be provided. On the other hand, very lightweight services can and do abstract over the details of their not-a-full-OS execution environment by changing the standard library of a single language to support their platform, which offers vastly improved performance\u2014at the cost of requiring that a specific language be used to implement programs running in that environment.<\/p>\n\n\n\n<p>WASI and the WebAssembly Component Model provide a middle ground between these contrasting abstractions: by implementing these interfaces, one can allow any lightweight execution environment to run programs written in (nearly) any language. Hyperlight Wasm takes advantage of this to allow you to implement a small set of high-level, performant, abstractions in almost any execution environment and provide a very fast, hardware protected, but nevertheless widely-compatible execution environment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"introducing-the-hyperlight-wasm-guest\">Introducing the Hyperlight Wasm guest<\/h2>\n\n\n\n<p>How compatible? Well, building Hyperlight with a WebAssembly&nbsp;runtime\u2014<a href=\"https:\/\/wasmtime.dev\/\" target=\"_blank\" rel=\"noreferrer noopener\">wasmtime<\/a>\u2014enables any programming language to execute in a protected Hyperlight micro-VM without any prior knowledge of Hyperlight at all. As far as program authors are concerned, they&#8217;re just compiling for the&nbsp;<strong>wasm32-wasip2<\/strong>&nbsp;target. This means they can run their programs locally using runtimes like&nbsp;<a href=\"https:\/\/wasmtime.dev\/\" target=\"_blank\" rel=\"noreferrer noopener\">wasmtime<\/a> or <a href=\"https:\/\/github.com\/bytecodealliance\/jco\" target=\"_blank\" rel=\"noreferrer noopener\">Jco<\/a>. Or run them on a server using for <a href=\"https:\/\/unit.nginx.org\/\" target=\"_blank\" rel=\"noreferrer noopener\">Nginx Unit<\/a>, <a href=\"https:\/\/github.com\/spinframework\/spin\" target=\"_blank\" rel=\"noreferrer noopener\">Spin<\/a>,&nbsp;<a href=\"https:\/\/github.com\/wasmCloud\/wasmCloud\" target=\"_blank\" rel=\"noreferrer noopener\">WasmCloud<\/a>\u2014or now also <a href=\"https:\/\/aka.ms\/hyperlight-wasm\" target=\"_blank\" rel=\"noreferrer noopener\">Hyperlight Wasm<\/a>. If done right, developers don\u2019t need to think about what runtime their code will run on as they\u2019re developing it. That is a degree of developer flexibility that is only possible through standards.<\/p>\n\n\n\n<p>Executing workloads in the Hyperlight Wasm guest isn&#8217;t just possible for compiled languages like C, Go, and Rust, but also for interpreted languages like Python, JavaScript, and C#. The trick here, much like with containers, is to also include a language runtime as part of the image. For example, for JavaScript, the&nbsp;<a href=\"https:\/\/github.com\/bytecodealliance\/StarlingMonkey\" target=\"_blank\" rel=\"noreferrer noopener\">StarlingMonkey JS Runtime<\/a>&nbsp;was designed to natively run in WebAssembly.<\/p>\n\n\n\n<p>Programming languages, runtimes, application platforms, and cloud providers are all starting to offer rich experiences for WebAssembly out of the box. If we do things right, you will never need to think about whether your application is running inside of a Hyperlight Micro-VM in Azure. You may never know your workload is executing in a Hyperlight Micro VM. And that&#8217;s a good thing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"more-layers-of-security-fewer-layers-in-total\">More layers of security, fewer layers in total<\/h2>\n\n\n\n<p>The big magic trick we&#8217;re performing by combining Hyperlight with WebAssembly is that we&#8217;re achieving more security and performance than traditional VMs by doing less work overall. When traditional virtual machine managers (VMMs) create a new virtual machine, they first need to create new virtual devices, then load a kernel, then load an operating system, and only then are they able to start the application. The lower end of this will take about 125 milliseconds.<\/p>\n\n\n<figure class=\"wp-block-image aligncenter size-full is-style-default\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2025\/03\/image-4.webp\" alt=\"Diagram showing that traditional hypervisors have four layers of heavy work for each instance of an application: the VM guest, guest kernel, OS distribution, and the application binaries.\" class=\"wp-image-97292 webp-format\" style=\"box-shadow:var(--wp--preset--shadow--natural)\" srcset=\"\" data-orig-src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2025\/03\/image-4.webp\"><\/figure>\n\n\n\n<p>With Hyperlight and Hyperlight Wasm we end up doing far less than traditional VMs. When the Hyperlight VMM creates a new VM, all it needs do to is create a new slice of memory and load the VM guest, which in turn loads the wasm workload. This takes about 1-2 milliseconds today, and work is happening to bring that number to be less than 1 millisecond in the future.<\/p>\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img decoding=\"async\" src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2025\/03\/image-5.webp\" alt=\"Diagram showing that hyperlight removes three layers of heavy work for each instance of an application compared to the traditional microservices approach.\" class=\"wp-image-97293 webp-format\" style=\"box-shadow:var(--wp--preset--shadow--natural)\" srcset=\"\" data-orig-src=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2025\/03\/image-5.webp\"><\/figure>\n\n\n\n<p>Not only is this architecture good for start times, fast start times also affect the way you can schedule your applications. If starting a workload takes about a millisecond, you can afford not to have any idling instances. If you do choose to have a warm pool ready, the memory footprint is drastically smaller. It also allows you to do more work on cheaper hardware, located closer to users. That&#8217;s the logic behind our upcoming Azure Front DoorEdge Actions service, powered by Hyperlight and soon to be in private preview.<a id=\"_msocom_1\"><\/a><\/p>\n\n\n\n<p>Combining Hyperlight with wasm is not just good for performance either; it is also good for security. Under the covers, the Hyperlight Wasm guest uses the best-in-class wasmtime runtime, compiled into a Hyperlight guest as a Rust no_std module. Wasmtime provides strong isolation boundaries for wasm workloads via a software-defined runtime sandbox. While potential attackers will have a bad time breaking out of wasm&#8217;s sandbox, on the Hyperlight Wasm guest, even if they could manage to, they would be facing the challenge of then also escaping the VM. One layer of sandboxing is good. But having two layers is even better.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"udp-echo-example\">UDP echo example<\/h2>\n\n\n\n<p>Alright, let\u2019s look at how to use Hyperlight Wasm from Rust. For our example, we\u2019ll run a simple User Datagram Protocol (UDP) echo server that uses a portion of the <a href=\"https:\/\/github.com\/WebAssembly\/wasi-sockets\" target=\"_blank\" rel=\"noreferrer noopener\">wasi:sockets<\/a> interface. Luckily for us, we don\u2019t have to write that program ourselves: we can download a pre-compiled wasm program (if you want to compile it yourself, <a href=\"https:\/\/github.com\/hyperlight-dev\/wasm-udp-echo-sample\" target=\"_blank\" rel=\"noreferrer noopener\">the source is available here<\/a>) and run it. Let\u2019s start by doing that first. Assuming you have a working Rust installation, start <a href=\"https:\/\/github.com\/bytecodealliance\/wasm-pkg-tools#installation\" target=\"_blank\" rel=\"noreferrer noopener\">by installing the wkg tool<\/a> to download wasm binaries from GitHub Artifacts, and then use that to get a copy of the wasm binary:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncargo install wkg\nwkg oci pull ghcr.io\/hyperlight-dev\/wasm-udp-echo-sample\/udp-echo-server:latest -o echo.wasm\n<\/pre><\/div>\n\n\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\">\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\">\n<p>Now that we have a Wasm Binary, we can start wiring up the Hyperlight host. Right now that is a little complicated, since we haven\u2019t yet published cargo crates. So let\u2019s start by git cloning our example repo:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ngit clone https:\/\/github.com\/hyperlight-dev\/hyperlight-wasm-sockets-example\nmv echo.wasm hyperlight-wasm-sockets-example\ncd hyperlight-wasm-sockets-example\n<\/pre><\/div><\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-group is-layout-constrained wp-block-group-is-layout-constrained\">\n<p>If you look at the code in the repo, you\u2019ll notice it is structured like a regular Rust project. That\u2019s because it is. It includes several files, most of which are there to implement boilerplate interfaces that the echo sample uses. In the root of the project there is a file called <em>hyperlight.wit<\/em>. This file is a text representation in the WebAssembly Interface Types (WIT) language that specifies the precise interfaces that the host is making available to, and expects to get from, the wasm module. We need to process this file into a binary wasm representation, which will be used when hyperlight-wasm is built:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nwasm-tools component wit hyperlight.wit -w -o hyperlight-world.wasm \nexport HYPERLIGHT_WASM_WORLD=$(readlink -f hyperlight-world.wasm)\n<\/pre><\/div><\/div>\n\n\n\n<p>Now, let\u2019s take a look at the code that uses hyperlight-wasm to run a component. To get bindings that we can use to easily implement imports\/call exports of the wasm module, we can use <code><strong>hyperlight_component_macro::host_bindgen<\/strong><\/code>:<\/p>\n\n\n\n<p><code><strong>\/\/ bindings.rs<br>extern crate alloc;<br>hyperlight_component_macro::host_bindgen!();<\/strong><\/code><\/p>\n\n\n\n<p>This generates a set of traits representing the WebAssembly component model instances imported and exported by the component inside the sandbox. We define a state structure which keeps track of everything we need to implement the imports (but in this sample application, that is not used):&nbsp;<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/\/ state.rs\npub struct MyState {}\nimpl MyState {\n    pub fn new() -> Self { MyState {} \t}\n}\n<\/pre><\/div>\n\n\n<p>We then need to specify that this state representation can be used to implement the interfaces that the component uses:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/\/ main.rs\nuse bindings::*;\nimpl root::component::RootImports for MyState {\n    type Udp = MyState;\n    fn udp(&mut self) -> &mut Self  { self }\n    \/\/ ... one for each imported instance\n}\n<\/pre><\/div>\n\n\n<p>The wasi:sockets udp interface is very simple to implement, since it doesn\u2019t actually have any functions not associated with a resource:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n\/\/ udp.rs \n\nimpl wasi::sockets::Udp< \n\n    ErrorCode, \n\n    IpSocketAddress, \n\n    (), \n\n    MyPollable> \n\nfor MyState {} \n\n<\/pre><\/div>\n\n\n<p>But, since it does export a <code><strong>UdpSocket<\/strong><\/code> resource, we need to implement that resource, specifying the host type that underlies it and how to implement its methods on the host:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nimpl wasi::sockets::udp::UdpSocket<\n    wasi::sockets::network::ErrorCode,\n    MyDatagramStream,\n    wasi::sockets::network::IpSocketAddress,\n    (),\n    MyDatagramStream,\n    MyPollable\n    >\nfor MyState {\n     type T = MySocket;\n    fn start_bind(\n        &mut self,\n        self_: BorrowedResourceGuard<MySocket>,\n        _network: BorrowedResourceGuard<()>,\n        local_address: wasi::sockets::network::IpSocketAddress\n    ) -> Result<(), wasi::sockets::network::ErrorCode> {\n        *(*self_).os.lock().unwrap() = Some(Arc::new(\n            std::net::UdpSocket::bind(local_address)\n                .map_err(|_| wasi::sockets::network::ErrorCode::Unknown)?));\n        Ok(())\n    }\n    fn stream(\n        &mut self,\n        self_: BorrowedResourceGuard<Self::T>,\n        _remote_address: Option<IpSocketAddress>\n    ) -> Result<(MyDatagramStream, MyDatagramStream), ErrorCode> {\n        let sock = (*self_).os.lock().unwrap();\n        let sock = sock.as_ref().unwrap();\n        Ok((MyDatagramStream { socket: sock.clone() },\n            MyDatagramStream { socket: sock.clone() }))\n    }\n\n    fn finish_bind(\n        &mut self,\n        _self: BorrowedResourceGuard<Self::T>\n    ) -> std::result::Result<(), ErrorCode>  {\n        Ok(())\n    }\n\n    fn r#subscribe(\n        &mut self,\n        _self: BorrowedResourceGuard<Self::T>\n    ) -> MyPollable  {\n        MyPollable::AlwaysReady\n    }\n}\n\n<\/pre><\/div>\n\n\n<p>Now that we have that, we&#8217;re ready to run Hyperlight and point it to our Wasm binary. And all that takes is a little bit of boilerplate. In the code below, we\u2019re first creating a new Hyperlight sandbox with enough memory to run a Wasm runtime. Then, we\u2019re registering the bindings we just wrote. And finally, we load our Wasm Component and run it.<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nfn main() {\n    let state = State::new();\n    \/\/ Setup the sandbox with enough resources to run a Wasm runtime\n    let mut sb: hyperlight_wasm::ProtoWasmSandbox =\n        hyperlight_wasm::SandboxBuilder::new()\n            .with_guest_input_buffer_size(5_000_000)\n            .with_guest_heap_size(10_000_000)\n            .with_guest_panic_context_buffer_size(10_000_000)\n            .with_guest_stack_size(10_000_000)\n            .with_guest_function_call_max_execution_time_millis(0)\n            .build()\n            .unwrap();\n\n    \/\/ Register the host functions\n    let rt = crate::bindings::register_host_functions(&mut sb, state);\n\n    \/\/ Load our Wasm Component and run it\n    let sb = sb.load_runtime().unwrap();\n    let sb = sb.load_module(\"echo.wasm\").unwrap();\n    let mut wrapped = bindings::RootSandbox { sb, rt };\n\n    let run_inst = root::component::RootExports::run(&mut wrapped);\n    let _ = run_inst.run();\n}\n\n<\/pre><\/div>\n\n\n<p>Finally, before we can run the sample Wasm binary, we need to Ahead-Of-Time compile it into a format that wasmtime can load without having to generate code at runtime:&nbsp;<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: plain; title: ; notranslate\" title=\"\">\ncargo install --git https:\/\/github.com\/hyperlight-dev\/hyperlight-wasm --branch hyperlight-component-macro hyperlight-wasm-aot \nhyperlight-wasm-aot compile --component echo.wasm echo.bin \n<\/pre><\/div>\n\n\n<p>And now we&#8217;re ready to start the application and run it. You can do that by running\u202fcargo run\u202fin one terminal, which will start a server listening on port 8080:&nbsp;<\/p>\n\n\n\n<p><code><strong>cargo run<\/strong><\/code><\/p>\n\n\n\n<p>And in another terminal, we can now send User Datagram Protocol (UDP) packets. You can do that using the netcat utility as follows (for Windows <a href=\"https:\/\/github.com\/hyperlight-dev\/hyperlight-wasm-sockets-example\" target=\"_blank\" rel=\"noreferrer noopener\">you can find a netcat alternative here<\/a>):&nbsp;<\/p>\n\n\n\n<p><code><strong>nc -u 127.0.0.1&nbsp; 8080<\/strong><\/code><\/p>\n\n\n\n<p>Now you&#8217;re free to type! Whatever you send to the server will be echoed back. And that&#8217;s the basics of Hyperlight&#8217;s Wasm guest.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-s-next\">What\u2019s next?<\/h2>\n\n\n\n<p>So far we&#8217;ve mostly talked about using WASI on Hyperlight for portability between operating systems and VMs. But it doesn&#8217;t just stop there: because the WebAssembly instruction set and the Component Model abstract binary interface (ABI) are not tied to any one machine architecture, wasm applications are also portable between different instruction sets. You can soon expect Hyperlight Wasm to also work on Arm64 processors. Rebuilding your host will just work, without you ever needing to recompile the wasm applications running inside.<\/p>\n\n\n\n<p>You may also have noticed that, while we can support WASI APIs in the guest, the VMM host doesn\u2019t provide its own default implementation of WASI interfaces, so you have to implement them yourselves. While many applications will appreciate that flexibility, including cloud vendors like Microsoft who are using Hyperlight to create products, it does mean that getting started and trying things out can take some time. For that reason, we&#8217;re planning to <a href=\"https:\/\/github.com\/hyperlight-dev\/hyperlight\/issues\" target=\"_blank\" rel=\"noreferrer noopener\">extend Hyperlight-Wasm with default bindings<\/a> for some WASI interfaces soon. That way, if you just want to sandbox an HTTP server or a service that listens on a socket, you don&#8217;t need to do much else to get started.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"get-involved-with-hyperlight\">Get involved with Hyperlight<\/h2>\n\n\n\n<p>Hyperlight has been donated by Microsoft to the CNCF\u2019s Sandbox program. Our goal is to raise the bar for fast, efficient, and secure cloud-native computing. The Hyperlight Wasm guest is our latest addition to the Hyperlight project, making it convenient to write programs that run on Hyperlight.<\/p>\n\n\n\n<p>As an open-source project licensed under the Apache 2.0 license, Hyperlight underscores Microsoft\u2019s commitment to fostering innovation and collaboration within the tech community. We welcome developers, solution architects, and IT professionals to help build and enhance Hyperlight. To get started with Hyperlight, please visit&nbsp;<a href=\"https:\/\/aka.ms\/hyperlight-dev\" target=\"_blank\" rel=\"noreferrer noopener\">the repo at Hyperlight<\/a>&nbsp;and let us know what you think.<\/p>\n\n\n\n<div class=\"wp-block-buttons is-content-justification-center is-layout-flex wp-container-core-buttons-is-layout-16018d1d wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link wp-element-button\" href=\"https:\/\/github.com\/hyperlight-dev\/hyperlight\" target=\"_blank\" rel=\"noreferrer noopener\">Visit the Hyperlight repository on Github.<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>We&#8217;re announcing the release of Hyperlight Wasm: a Hyperlight virtual machine (VM) \u201cmicro-guest.<\/p>\n","protected":false},"author":6194,"featured_media":95466,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"msxcm_post_with_no_image":false,"ep_exclude_from_search":false,"_classifai_error":"","_classifai_text_to_speech_error":"","footnotes":""},"post_tag":[136],"content-type":[346,361,340],"topic":[2241,2244,2245,2251,2252],"programming-languages":[],"coauthors":[2590,2598],"class_list":["post-97273","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-github","content-type-news","content-type-project-updates","content-type-tutorials-and-demos","topic-cloud","topic-devops","topic-infrastructure","topic-it-trends","topic-tools","review-flag-1593580362-584","review-flag-1593580428-734","review-flag-1593580771-946","review-flag-1-1593580432-963","review-flag-2-1593580437-411","review-flag-fall-1593580732-697","review-flag-free-1593619513-693","review-flag-micro-1680215167-604","review-flag-never-1593580314-283","review-flag-new-1593580248-669","review-flag-priva-1593580766-136","review-flag-vm-1593580807-312"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog<\/title>\n<meta name=\"description\" content=\"We&#039;re announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog\" \/>\n<meta property=\"og:description\" content=\"We&#039;re announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Open Source Blog\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-26T14:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-08-13T21:56:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1170\" \/>\n\t<meta property=\"og:image:height\" content=\"640\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Yosh Wuyts, Lucy Menon\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@OpenAtMicrosoft\" \/>\n<meta name=\"twitter:site\" content=\"@OpenAtMicrosoft\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Yosh Wuyts, Lucy Menon\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 min read\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\"},\"author\":[{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/author\/yosh-wuyts\/\",\"@type\":\"Person\",\"@name\":\"Yosh Wuyts\"},{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/author\/lucy-menon\/\",\"@type\":\"Person\",\"@name\":\"Lucy Menon\"}],\"headline\":\"Hyperlight Wasm: Fast, secure, and OS-free\",\"datePublished\":\"2025-03-26T14:00:00+00:00\",\"dateModified\":\"2025-08-13T21:56:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\"},\"wordCount\":2006,\"publisher\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp\",\"keywords\":[\"GitHub\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\",\"url\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\",\"name\":\"Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog\",\"isPartOf\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp\",\"datePublished\":\"2025-03-26T14:00:00+00:00\",\"dateModified\":\"2025-08-13T21:56:10+00:00\",\"description\":\"We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.\",\"breadcrumb\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage\",\"url\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp\",\"contentUrl\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp\",\"width\":1170,\"height\":640},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/opensource.microsoft.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Hyperlight Wasm: Fast, secure, and OS-free\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#website\",\"url\":\"https:\/\/opensource.microsoft.com\/blog\/\",\"name\":\"Microsoft Open Source Blog\",\"description\":\"Open dialogue about openness at Microsoft \u2013 open source, standards, interoperability\",\"publisher\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/opensource.microsoft.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#organization\",\"name\":\"Microsoft Open Source Blog\",\"url\":\"https:\/\/opensource.microsoft.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png\",\"contentUrl\":\"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png\",\"width\":259,\"height\":194,\"caption\":\"Microsoft Open Source Blog\"},\"image\":{\"@id\":\"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/OpenAtMicrosoft\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog","description":"We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/","og_locale":"en_US","og_type":"article","og_title":"Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog","og_description":"We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.","og_url":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/","og_site_name":"Microsoft Open Source Blog","article_published_time":"2025-03-26T14:00:00+00:00","article_modified_time":"2025-08-13T21:56:10+00:00","og_image":[{"width":1170,"height":640,"url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.png","type":"image\/png"}],"author":"Yosh Wuyts, Lucy Menon","twitter_card":"summary_large_image","twitter_creator":"@OpenAtMicrosoft","twitter_site":"@OpenAtMicrosoft","twitter_misc":{"Written by":"Yosh Wuyts, Lucy Menon","Est. reading time":"10 min read"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#article","isPartOf":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/"},"author":[{"@id":"https:\/\/opensource.microsoft.com\/blog\/author\/yosh-wuyts\/","@type":"Person","@name":"Yosh Wuyts"},{"@id":"https:\/\/opensource.microsoft.com\/blog\/author\/lucy-menon\/","@type":"Person","@name":"Lucy Menon"}],"headline":"Hyperlight Wasm: Fast, secure, and OS-free","datePublished":"2025-03-26T14:00:00+00:00","dateModified":"2025-08-13T21:56:10+00:00","mainEntityOfPage":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/"},"wordCount":2006,"publisher":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#organization"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage"},"thumbnailUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp","keywords":["GitHub"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/","url":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/","name":"Hyperlight Wasm: Fast, secure, and OS-free | Microsoft Open Source Blog","isPartOf":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage"},"thumbnailUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp","datePublished":"2025-03-26T14:00:00+00:00","dateModified":"2025-08-13T21:56:10+00:00","description":"We're announcing the release of Hyperlight Wasm: a Hyperlight virtual machine \u201cmicro-guest\u201d that can run wasm component workloads written in many programming languages. Learn more.","breadcrumb":{"@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#primaryimage","url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp","contentUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2024\/06\/CLO19_Ubisoft_Azure_055.webp","width":1170,"height":640},{"@type":"BreadcrumbList","@id":"https:\/\/opensource.microsoft.com\/blog\/2025\/03\/26\/hyperlight-wasm-fast-secure-and-os-free\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/opensource.microsoft.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Hyperlight Wasm: Fast, secure, and OS-free"}]},{"@type":"WebSite","@id":"https:\/\/opensource.microsoft.com\/blog\/#website","url":"https:\/\/opensource.microsoft.com\/blog\/","name":"Microsoft Open Source Blog","description":"Open dialogue about openness at Microsoft \u2013 open source, standards, interoperability","publisher":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/opensource.microsoft.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/opensource.microsoft.com\/blog\/#organization","name":"Microsoft Open Source Blog","url":"https:\/\/opensource.microsoft.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png","contentUrl":"https:\/\/opensource.microsoft.com\/blog\/wp-content\/uploads\/2019\/08\/Microsoft-Logo.png","width":259,"height":194,"caption":"Microsoft Open Source Blog"},"image":{"@id":"https:\/\/opensource.microsoft.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/OpenAtMicrosoft"]}]}},"msxcm_display_generated_audio":false,"msxcm_animated_featured_image":null,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Open Source Blog","distributor_original_site_url":"https:\/\/opensource.microsoft.com\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/97273","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/users\/6194"}],"replies":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/comments?post=97273"}],"version-history":[{"count":53,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/97273\/revisions"}],"predecessor-version":[{"id":98097,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/posts\/97273\/revisions\/98097"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/media\/95466"}],"wp:attachment":[{"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/media?parent=97273"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/post_tag?post=97273"},{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/content-type?post=97273"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/topic?post=97273"},{"taxonomy":"programming-languages","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/programming-languages?post=97273"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/opensource.microsoft.com\/blog\/wp-json\/wp\/v2\/coauthors?post=97273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}