WebAssembly on the Edge: Sandboxing AND Performance

Moving apps to the Edge can complicate performance due to security constraints. Learn how WebAssembly bridges the gap, enabling both speed and security. We'll share insights from Exograph app migrations, focusing on Wasi advancements and the new component model. #EdgeComputing #WebAssembly

1. A ScyllaDB Community
WebAssembly on the Edge:
Sandboxing AND Performance
Brian Sletten
Bosatsu Consulting, Inc.

Ramnivas Laddad
Exograph, Inc.

2. Brian Sletten (he/him)

President, Bosatsu Consulting, Inc
■Author of O'Reilly book "WebAssembly : The Definitive Guide"
■Author of "Resource-Oriented Architecture Patterns for Webs of
Data"
■Teaches and speaks internationally about REST, Semantic Web,
WebAssembly, Data Science, Machine Learning, GPU Computing,
Security, Visualization, Architecture
■International Pop Recording Artist

3. Ramnivas Laddad (he/him)

Co-founder, Exograph, Inc
■Former Spring Framework and Cloud Foundry
committer
■Author of “AspectJ in Action”
■Speaker at many professional conferences
■Indian Classical Music aficionado

4. WebAssembly

5. https://hacks.mozilla.org/2018/10/webassemblys-post-mvp-future

6. Edge Computing

7. https://tinyurl.com/edge-landscape

8. Exograph

9. Express the domain model
and have the server ready! ??????
context AuthContext {
@jwt("sub") id: Int
@jwt role: String
}

@postgres
module ConcertData {
type Concert {
@pk id: Int = autoIncrement()
title: String
venue: Venue
}

@access(AuthContext.role == "ADMIN")
type Venue {
@pk id: Int = autoIncrement()
name: String
concerts: Set<Concert>
published: Boolean
}
}

10. Exograph
Builder
exo_ir
Exograph
Runtime
context AuthContext {
@jwt("sub") id: Int
@jwt role: String
}

@postgres
module ConcertData {
type Concert {
@pk id: Int = autoIncrement()
title: String
venue: Venue
}

@access(AuthContext.role == "ADMIN")
type Venue {
@pk id: Int = autoIncrement()
name: String
concerts: Set<Concert>
published: Boolean
}
}

{
concerts {
id
title
}
}

{
"data": {
"concerts": [
{
"id": 1,
"title": “The Beatles"
},
{
"id": 2,
"title": "The Rolling Stones"
}
]
}
}

11. Exograph Deployment Targets

12. Demo

13. Moving to the Edge

14. Experience post Rust code: Computation
■Serializing intermediate representation to/from its model
■Parsing and validating GraphQL queries
■Mapping GraphQL queries to SQL
■Validating JWT tokens

15. Experience post Rust code: System Interface
#[cfg(not(target_family = "wasm"))]
use std::time::Instant;
#[cfg(target_family = "wasm")]
use web_time::Instant;

16. Connecting to Postgres
let socket = Socket::builder()
.secure_transport(SecureTransport::StartTls)
.connect(host, port)?;

wasm_bindgen_futures::spawn_local(async move {
if let Err(error) = pg_connection.await {
// report
}
});
let (pg_client, pg_connection) = config
.connect_raw(socket, PassthroughTls)
.await?;

17. Contributing back to the ecosystem
■rust-postgres
●A new API to make it work with external pooling
■oidc-jwt-validator
●Async runtime adjustment
●std::time replacement
■tree-sitter-c2rust
■worker-rs
■deadpool-postgres

18. Challenges

19. Latency in Module Loading

20. Exograph
Builder
exo_ir
Exograph
Runtime
context AuthContext {
@jwt("sub") id: Int
@jwt role: String
}

@postgres
module ConcertData {
type Concert {
@pk id: Int = autoIncrement()
title: String
venue: Venue
}
@access(AuthContext.role == "ADMIN")
type Venue {
@pk id: Int = autoIncrement()
name: String
concerts: Set<Concert>
published: Boolean
}
}

{
concerts {
id
title
}
}

{
"data": {
"concerts": [
{
"id": 1,
"title": “The Beatles"
},
{
"id": 2,
"title": "The Rolling Stones"
}
]
}
}

21. Exograph
Builder
exo_ir
Exograph
Runtime
context AuthContext {
@jwt("sub") id: Int
@jwt role: String
}

@postgres
module ConcertData {
type Concert {
@pk id: Int = autoIncrement()
title: String
venue: Venue
}
@access(AuthContext.role == "ADMIN")
type Venue {
@pk id: Int = autoIncrement()
name: String
concerts: Set<Concert>
published: Boolean
}
}

{
concerts {
id
title
}
}

{
"data": {
"concerts": [
{
"id": 1,
"title": “The Beatles"
},
{
"id": 2,
"title": "The Rolling Stones"
}
]
}
}

22. Lowering Module Size: Do less work
■Simplify resolver logic
●Supported pre-defined queries (persisted/trusted queries)
●Map instead of compute
■Look up the query
■Find the query plan
■Validate variables
■Execute!
■Guide users in defining queries that can be mapped

23. Lowering Module Size: Tools
■wasm-opt, wasm-gc to optimize the size and DCE
■https://wasmphobia.surma.technology/ to analyze size contributions

24. Connection Latency: Application-level pooling
Exograph
Runtime
Pool
Exograph
Runtime
Pool
Error: Cannot perform I/O on behalf of a different request. I/O objects
(such as streams, request/response bodies, and others) created in the
context of one request handler cannot be accessed from a different
request's handler. This is a limitation of Cloudflare Workers which allows
us to improve overall performance. (I/O type: WritableStreamSink)

25. Connection Latency: Edge-provided pooling
Exograph
Runtime
Exograph
Runtime
Hyper
drive
No pooling: ~345ms
With Hyperdrive: ~60ms

26. Wasi

27. https://wasi.dev

28. https://wasi.dev/interfaces

29. Thank you! Let’s connect.
Brian Sletten
[email protected]
https://bosatsu.net
@[email protected]
Ramnivas Laddad
[email protected]
https://exograph.dev
@ramnivas