1
// Rust 编译为 Wasm + WASI
2
use std::fs::File;
3
use std::io::{Read, Write};
4

5
fn main() {
6
    // 读取文件（需要 fs 权限）
7
    let mut file = File::open("/app/data/input.txt").unwrap();
8
    let mut content = String::new();
9
    file.read_to_string(&mut content).unwrap();
10

11
    // 写入文件（需要 fs 权限）
12
    let mut output = File::create("/app/data/output.txt").unwrap();
13
    output.write_all(content.as_bytes()).unwrap();
14
}

1
# WasmEdge 的权限控制
2
wasmedge --env "KEY=VALUE" \
3
  --dir /app/data:/host/data \     # 文件系统权限
4
  --net host \                      # 网络权限
5
  myapp.wasm
6

7
# 只授予必要的权限（最小权限原则）
8
wasmedge --dir /app/data:/host/data:ro \  # 只读
9
  myapp.wasm

1
# 安装 WasmEdge
2
curl -sSf https://raw.githubusercontent.com/WasmEdge/WasmEdge/master/utils/install.sh | bash
3

4
# 编译 Rust 为 Wasm
5
rustup target add wasm32-wasip2
6
cargo build --target wasm32-wasip2
7

8
# 运行 Wasm 模块
9
wasmedge target/wasm32-wasip2/debug/myapp.wasm
10

11
# 运行 HTTP 服务器
12
wasmedge --net host target/wasm32-wasip2/debug/myserver.wasm
13
# 服务器监听在 0.0.0.0:8080

1
# 安装 Docker Wasm 集成
2
docker run --rm --runtime=io.containerd.wasmedge.v1 \
3
  -wasi-dir /app/data \
4
  myapp-wasmimage:latest
5

6
# Wasm 镜像的 Dockerfile
7
FROM scratch
8
COPY --from=builder /app/target/wasm32-wasip2/release/myapp.wasm /app.wasm
9
ENTRYPOINT ["/app.wasm"]

1
# 启动时间对比
2
# Linux 容器
3
time docker run --rm alpine echo hello
4
# real  0m0.350s
5

6
# Wasm 容器
7
time wasmedge myapp.wasm
8
# real  0m0.005s  ← 快 70x
9

10
# 镜像大小对比
11
# Linux 容器: alpine = 7.3MB
12
# Wasm 容器: myapp.wasm = 2MB

1
#!/bin/bash
2
# 构建和运行 Wasm 容器
3

4
# 1. 创建 Rust 项目
5
cargo new --name myapp myapp-wasm
6
cd myapp-wasm
7

8
# 2. 修改 Cargo.toml
9
cat > Cargo.toml << 'EOF'
10
[package]
11
name = "myapp"
12
version = "0.1.0"
13
edition = "2021"
14

15
[lib]
16
crate-type = ["cdylib"]
17

18
[dependencies]
19
wasi = "0.11"
20
EOF
21

22
# 3. 编写代码
23
cat > src/lib.rs << 'EOF'
24
use wasi::http::*;
25

26
#[no_mangle]
27
pub extern "C" fn _start() {
28
    println!("Hello from Wasm container!");
29
}
30
EOF
31

32
# 4. 编译为 Wasm
33
rustup target add wasm32-wasip2
34
cargo build --target wasm32-wasip2 --release
35

36
# 5. 运行
37
wasmedge target/wasm32-wasip2/release/myapp.wasm
38
# Hello from Wasm container!
39

40
# 6. 构建 Docker Wasm 镜像
41
cat > Dockerfile << 'EOF'
42
FROM scratch
43
COPY --chmod=755 target/wasm32-wasip2/release/myapp.wasm /app.wasm
44
ENTRYPOINT ["/app.wasm"]
45
EOF
46

47
docker buildx build --platform wasm32-wasip2 -t myapp-wasm .

1
#!/bin/bash
2
# Wasm vs Linux 容器性能对比
3

4
echo "=== 启动时间 ==="
5
echo -n "Linux 容器: "
6
time (for i in {1..100}; do docker run --rm alpine echo hi > /dev/null; done) 2>&1 | grep real
7

8
echo -n "Wasm 容器: "
9
time (for i in {1..100}; do wasmedge myapp.wasm > /dev/null; done) 2>&1 | grep real
10

11
echo ""
12
echo "=== 镜像大小 ==="
13
echo -n "Linux 容器: "
14
docker images alpine --format "{{.Size}}"
15
echo -n "Wasm 容器: "
16
ls -lh myapp.wasm | awk '{print $5}'

1
# Kubernetes RuntimeClass for Wasm
2
apiVersion: node.k8s.io/v1
3
kind: RuntimeClass
4
metadata:
5
  name: wasmtime
6
handler: wasmtime
7
overhead:
8
  podFixed:
9
    memory: "10Mi"
10
    cpu: "50m"
11
---
12

13
apiVersion: v1
14
kind: Pod
15
metadata:
16
  name: wasm-app
17
spec:
18
  runtimeClassName: wasmtime
19
  containers:
20
  - name: app
21
    image: ghcr.io/example/myapp-wasm:latest
22
    env:
23
    - name: RUST_LOG
24
      value: info