https://www.tetrate.io/blog/wasm-outside-the-browser/

Tetrate
GET DEMO

  * Tetrate

  * Products
      + 
          o Tetrate Service BridgeTetrate Service Bridge
            Application connectivity platform
          o Tetrate CloudTetrate Cloud
            Fully managed Tetrate Service Bridge
          o Tetrate Istio SubscriptionTetrate Istio Subscription
            Enterprise-grade Istio
  * Blog
  * Resources
      + 
          o Tetrate AcademyTetrate Academy
            Learn Istio Fundamentals | Certified Administrator
          o Tetrate LibraryTetrate Library
            Whitepapers, podcasts, guides and more
          o Zero Trust SecurityZero Trust Architecture
            End-to-end application security
          o Free eBook: SkyWalkingFree eBook: SkyWalking
            Your guide to observability at scale
  * Company
      + 
          o About UsAbout Us
            The Tetrate chronicles
          o PartnersPartners
            Tetrate partner network
          o EventsEvents
            Webinars, conferences, and meetups
          o CareersCareers
            We are hiring!
          o Open SourceOpen Source
            Our contributions and projects
          o PressPress
            Media coverage and announcements
          o Contact UsContact Us
            Get in touch and let's talk
  * English

[rev_slider alias="slider-5-blog"][/rev_slider]
blog
Envoy proxy & GetEnvoy

Why WebAssembly is innovative even outside the browser

July 16, 2021
WebAssembly (Wasm)

WebAssembly (Wasm) has many applications in the cloud-native world
today - WASI, edge cloud computing, Proxy-Wasm, and cloud-native
runtime for serverless functions, to name a few. The question is, why
has WebAssembly become so popular?

To answer this, let's begin by looking at the basic properties of
WebAssembly.

WebAssembly is a safe, portable, and low-level binary instruction
format. To elaborate on a few of the key properties of WebAssembly,
it's:

  * Safe: It can safely run untrusted codes in a sandbox environment.
  * Open: This means that it is embeddable. It has a customizable
    interface with external environments. For example, in WASI,
    WebAssembly can run on abstracted operating system platforms.
    Another example is Proxy-Wasm: the Wasm module communicates with
    external proxy applications to manipulate or handle traffic such
    as HTTP, UDP, or TCP traffic.
  * Portable: It is usable across environments and is
    architecture-independent.
  * Polyglot: It can be compiled from many programming languages.

It's also fast.

Many language are some combination of open, portable, safe, and
polyglot. WebAssembly is taking off right now because it's all of
those.

There are clearly other existing solutions to achieve goals similar
to what WebAssembly does, but as we will see, each of these solutions
has certain limitations:

  * NaCI is Google's software fault isolation (SFI) solution. It is
    safe, embeddable, and polyglot. It can run untrusted codes with
    the application of SFI techniques. However, since NaCl is based
    on native binary, it is not a portable solution.
  * eBPF is a safe, embeddable, and portable program primarily used
    for kernels. However, due to its strict limitations, it is hardly
    polyglot.
  * Lua is a powerful embeddable scripting language, but it's not
    polyglot either.
  * Native Library Formats are embeddable. However, they are not safe
    or portable.
  * Java is a versatile language that runs anywhere. The downside is
    that isolated entities are not Java's first-class citizens.

Accordingly, none of these alternative solutions demonstrates all the
properties embodied in WebAssembly. On the other hand, WebAssembly is
as portable as Java, as safe as NaCl or Seccomp, as embeddable as
Lua, and as polyglot as Native Library. Compared to existing
solutions on the market, WebAssembly is an excellent new solution
with a well-rounded design that aims to meet multiple goals
simultaneously. While other existing solutions are lacking in some
respect, WebAssembly emerges as a successful solution to achieve what
the others cannot. To sum up, WebAssembly's unique strengths help it
stand out among the crowd in the cloud-native world.

Strengthening application extensibility and security with WebAssembly

Like Executable and Linkable Format (ELF), the object format of the
executable file in Linux, WebAssembly is an object format. As Linux
defines what APIs an executable file can use, the external Wasm
embedded interface defines the functions and symbols imported/
exported by a Wasm module. This gives rise to various interface types
for WebAssembly.

Embedding WebAssembly in applications is important for the following
reasons. First, WebAssembly provides secure extensibility mechanisms
for applications. Second, application and Wasm modules communicate
through bi-directional ABI and API. Lastly, WebAssembly allows users
to install extensions securely, portably, and in any language.

Two prime examples of a Wasm embedded interface are: WebAssembly for
Proxies (Proxy-Wasm), and the WASI executable interface. 

How Envoy's extensibility evolves with Proxy-Wasm

For the purpose of this article, let's focus on the secure extension
mechanism of Proxy-Wasm. Powered by WebAssembly, Proxy-Wasm is an
extensibility interface for proxy servers. Envoy serves as the
reference implementation. Proxy-Wasm provides a secure and portable
way to manipulate proxy traffic.

Before WebAssembly, Envoy offered the static C++ library as its
extension mechanism. No isolation was provided, and C++ was the only
language that was supported. Therefore, updating an extension used to
always require a rebuild.

Ever since its adoption of WebAssembly, Envoy's extension has been
able to run securely in an isolated environment. This approach has
the distinct advantage of being language-independent, and there is
full support for dynamic loading extensions.

WebAssembly brings secure extensibility mechanisms to cloud-native
applications. Envoy and Istio provide a secure extensibility
mechanism for application meshes powered by Proxy-Wasm. With
WebAssembly, you can write your Envoy extensions, such as custom
authorization and authentication, as well as logging.

Recap

WebAssembly's unmatched strength of being embeddable, safe, polyglot,
and portable all at the same time have led to the development of
various Wasm interfaces. As we have seen, a secure extensibility
mechanism is typically found in these interfaces. The extensibility
mechanism for proxies, Proxy-Wasm, is an excellent example that
allows users to extend their application meshes securely. With its
unique set of advantages, WebAssembly is sure to continue to bring
about new secure extensibility mechanisms to the cloud-native
landscape.

This article is based on a sponsored keynote by Takaya Saeki, Tetrate
Engineer, for Cloud Native Wasm Day EU 2021.

Resources

  * Wasm Modules and Envoy Extensibility Explained - Part 1
  * How to get started with Envoy extensions: Wasm and GetEnvoy
  * What can WebAssembly do for your Application Security and
    Extensibility
  * CNCF Cloud Native Wasm Day EU 2021 playlist
  * Istio Weekly Episode 7 on Developing Envoy Wasm Extensions (July
    22, 2021)

 

Authors

  * Wing Wong [947]
  * Takaya Saeki [d36]

Search
[                    ] SEARCH 
Subscribe to our blog
Categories

  * Announcements 5
  * Apache SkyWalking 16
  * API Gateway 1
  * AWS 8
  * Careers 19
  * Case studies 9
  * CVE Fixes 4
  * Design 1
  * Envoy proxy & GetEnvoy 33
  * Events 23
  * Funding 1
  * GetIstio 1
  * Istio 55
  * NGAC 1
  * Observability 13
  * Open Source 47
  * Remote Learning 1
  * Security 20
  * Service Mesh 42
  * Tetrate 68
  * Tetrate Service Bridge 6
  * Wasm 2
  * Zero Trust 1

You May Also Like

[photo-1534078362425-387ae9668c17]
Envoy proxy & GetEnvoy, Tetrate

Get started with Envoy in 5 minutes

By Peter Jausovec , July 26, 2021
Envoy release 1.19
Envoy proxy & GetEnvoy

What's new in Envoy 1.19 release

By Peter Jausovec , July 15, 2021
Wasm Extensions
Envoy proxy & GetEnvoy, Istio, Tetrate

Wasm extensions and Envoy extensibility explained - Part 1

By Peter Jausovec , July 13, 2021
Bridge
Tetrate, Tetrate Service Bridge

Intro to Tetrate Service Bridge

By Zachary Butcher , May 24, 2021
Tetrate Service Bridge
Announcements, Service Mesh, Tetrate, Tetrate Service Bridge

Tetrate Service Bridge is generally available

By Nurul Arif Setiawan , April 7, 2021
Apache SkyWalking, Envoy proxy & GetEnvoy, Open Source

Observe Service Mesh in VMs with SkyWalking and Envoy Access Log
Service

By Zhenxu Ke , February 23, 2021
Envoy release 1.19
Envoy proxy & GetEnvoy

What's new in Envoy 1.17 Release: v2 xDS API is deprecated

By Jimmy Song , January 18, 2021
Envoy proxy - Postgres filter
Envoy proxy & GetEnvoy, Open Source, Tetrate

Envoy 101: File-based dynamic configurations

By Tia Louden , December 2, 2020
Sailboat
Istio, Open Source

What's new in Istio 1.8: DNS proxy helps expand mesh to VMs and
multicluster

By Tevah Platt , November 19, 2020
Tetrate: Celebrating Envoy
Envoy proxy & GetEnvoy, Events, Tetrate

EnvoyCon 2020

By Tevah Platt , October 15, 2020
Processor Image
Envoy proxy & GetEnvoy, Tetrate

What's new in the Envoy 1.16 Release: Support for ARM64, and more!

By Tia Louden , October 13, 2020
GetEnvoy Istio
Envoy proxy & GetEnvoy

How to get started with Envoy extensions: Wasm and GetEnvoy

By Tetrate , October 2, 2020
Service Mesh Istio
Envoy proxy & GetEnvoy, Istio, Open Source, Security

Istio and Envoy Security Advisories

By Tetrate , September 30, 2020
Istio AMA tetrate
Envoy proxy & GetEnvoy, Istio, Open Source

Istio Service Mesh: 10 Takeaways from Tetrate's 09/2020 AMA session

By Tetrate , September 25, 2020
[magnifier-glass-magnifying-glass-magnifying-preview]
Envoy proxy & GetEnvoy, Open Source, Service Mesh

How the Envoy proxy handles a user request

By Eileen AJ Connelly , September 1, 2020
Envoy Proxy
Envoy proxy & GetEnvoy

Envoy 101: Configuring Envoy as a Gateway

By Tia Louden , September 1, 2020
#kubecon
Envoy proxy & GetEnvoy, Events, Istio, Open Source

Takeaways from KubeCon EU 2020

By Tevah Platt , August 21, 2020
Nginx ingress proxies
Observability, Tetrate

Observability 101: What you see is what you get

By Tia Louden , August 19, 2020
Boats moored in a marina
Istio, Service Mesh, Tetrate

VM to container communications 101

By Tia Louden , July 17, 2020
Envoy proxy - Postgres filter
Envoy proxy & GetEnvoy

Envoy proxy 1.15 release

By Yaroslav Skopets , July 8, 2020
Envoy's Postgres filter - Network observability
Envoy proxy & GetEnvoy, Observability, Open Source

How to use Envoy's Postgres filter for network observability

By Christoph Pakulski , July 1, 2020
[banners-black-07]
CVE Fixes, Envoy proxy & GetEnvoy, Security

Envoy and Istio security releases - June 2020

By Tevah Platt , June 9, 2020
CVE Fixes, Envoy proxy & GetEnvoy, Istio, Open Source, Security

Upgrade: Istio and Envoy CVE security fixes

By Tetrate , March 4, 2020
Envoy proxy & GetEnvoy, Istio, Open Source

Podcast: How complex is Istio? Learn from its co-founders

By Tetrate , December 23, 2019
KubeCon and CloudNativeCon
Case studies, Envoy proxy & GetEnvoy, Events, Istio, Open Source,
Tetrate

Tetrate highlights from KubeCon San Diego: Istio, Envoy, and a
brownfield to greenfield use case

By Tevah Platt , November 4, 2019
[AdobeStock_346435201-scaled]
Envoy proxy & GetEnvoy, Tetrate

gRPC Transcoding With Istio

By Tetrate , October 25, 2019
Tetrate Engineer and Envoy Senior Maintainer Lizan Zhou
Envoy proxy & GetEnvoy, Events, Security

The basics of Envoy and Envoy extensibility

By Lizan Zhou , June 7, 2019
Configuring Envoy Envoy 101: Configuring Envoy as a Gateway
Envoy proxy & GetEnvoy, Events, Istio, Service Mesh, Tetrate

Envoy extensibility and service mesh; Video highlights from KubeCon
Barcelona 2019

By Tetrate , June 4, 2019
[Larry]
Events, Open Source, Service Mesh

A History of Networking and What's Next for Service Mesh: Larry
Peterson at Service Mesh Day 2019

By Tetrate , May 18, 2019
Matt Klein - Envoy Proxy
Envoy proxy & GetEnvoy, Events, Open Source, Tetrate

Envoy Proxy: Matt Klein on the standard data plane and where it's
going

By Tetrate , May 14, 2019
Sailboat
Envoy proxy & GetEnvoy, Istio, Service Mesh

The 5 traits of successful service mesh adopters

By Tetrate , May 14, 2019
Service Mesh - Managing Service-to-Service
AWS, Envoy proxy & GetEnvoy, Istio, Open Source, Service Mesh,
Tetrate

451's take on service mesh: The 'Swiss Army Knife' of modern software

By Tetrate , April 11, 2019
[whitehex-01]
CVE Fixes, Envoy proxy & GetEnvoy, Security

Envoy CVE security fixes for GetEnvoy

By Tetrate , April 5, 2019
AWS, Tetrate

BusinessWire - Tetrate works with Amazon Web Services to bring
enterprise-grade Envoy to AWS App Mesh users

By Tetrate , March 27, 2019
AWS, Service Mesh, Tetrate

SDxCentral - Amazon's Werner Vogels: Dance like nobody's watching.
Encrypt like everyone is

By Tetrate , March 27, 2019
Tetrate

The New Stack - Cloud Providers vs. Open Source, the Open Source
Leadership Summit

By Tetrate , March 19, 2019
Tetrate

CRN - Cloud startups reel in funding

By Tetrate , March 18, 2019
Tetrate

Crunchbase News - Other interesting rounds from last week

By Tetrate , March 18, 2019
Tetrate

Container Journal - Tetrate launches Istio service mesh offering

By Tetrate , March 15, 2019
Tetrate

Linux Journal - Tetrate launched

By Tetrate , March 14, 2019
Tetrate

BusinessWire - Key contributors of Envoy and Istio projects launch
Tetrate with $12.5M in funding to create enterprise-grade service
mesh

By Tetrate , March 13, 2019
Tetrate

ComputerWorldUK - Tetrate emerges from stealth to bring service mesh
to the enterprise

By Tetrate , March 13, 2019
Tetrate

DevClass - Oldtimers Dell and Intel show service mesh newbie Tetrate
round the enterprise

By Tetrate , March 13, 2019
Tetrate

Digirupt.io - Service mesh model gunning for disruption of networking
market

By Tetrate , March 13, 2019
Tetrate

FinSMEs - Tetrate raises $12.5M in funding

By Tetrate , March 13, 2019
[mesh-bg-blue-orange-1]
Tetrate

We are launching!

By Tetrate , March 13, 2019
Tetrate - Service Mesh Company
 
 
 
 
Products

  * Tetrate Service Bridge
  * Tetrate Cloud
  * Tetrate Istio Subscription

Resources

  * Tetrate Academy
  * Tetrate Library
  * Zero Trust Architecture
  * Free eBook: SkyWalking
  * Blog

Company

  * About Us
  * Partners
  * Events
  * Careers
  * Open Source
  * Press
  * Contact Us

Copyright (c) Tetrate 2021. All rights reserved. Terms and Conditions
and Privacy