wasmCloud is an open source Cloud Native Computing Foundation (CNCF) project that enables teams to build, manage, and scale polyglot apps across any cloud, K8s, or edge.
"description": "wasmCloud is an open source Cloud Native Computing Foundation (CNCF) project that enables teams to build, manage, and scale polyglot apps across any cloud, K8s, or edge.",
wasmCloud is a cloud native platform for running WebAssembly workloads across any cloud, Kubernetes, datacenter, or edge.
Using wasmCloud, you can run microservices, functions, and agents as ultra-dense, deny-by-default bytecode sandboxes that are far more secure and efficient than traditional containers — without changing your operational model. Workloads are WebAssembly components measured in kilobytes to low megabytes, starting in milliseconds, and portable across any conformant WASI runtime.
Containers default to allow-by-default: a container has broad access to the network, system calls, and environment variables unless something is explicitly blocked. Locking one down requires knowing everything it might try to do, then enforcing those restrictions from the outside.
WebAssembly components default to deny-by-default: a component can do nothing (no file I/O, network access, or system calls) unless a capability is explicitly granted. Capabilities are declared as language-agnostic interfaces in the component itself, so the security surface is small, visible, auditable, and enforced by the runtime rather than bolted on afterward.
wasmCloud runs WebAssembly components and manages their capabilities. You decide exactly which interfaces each component can access. Everything else is denied.
Wasm Shell (wash) — the CLI for scaffolding, building, and publishing WebAssembly components, and for running a local development host.
[crates/wash-runtime]!(./crates/wash-runtime/)
wash-runtime — the embeddable Rust runtime that powers wash dev, the cluster host, and custom embedded hosts. Wraps Wasmtime with a plugin-based capability model.
[runtime-operator/]!(./runtime-operator/)
Runtime Operator — Kubernetes operator that reconciles wasmCloud CRDs (Host, Workload, WorkloadDeployment, WorkloadReplicaSet, Artifact) and schedules workloads onto host pods via NATS.
[runtime-gateway/]!(./runtime-gateway/)
Runtime Gateway — HTTP gateway that proxies traffic to host pods. Deprecated as of 2.0.3; routing is now handled by the operator via EndpointSlices on standard Kubernetes Services. The chart still installs the gateway by default for backwards compatibility (set gateway.enabled: false to skip).
Helm chart for installing the operator, host runtime, and (optionally) NATS as a single release.
[proto/]!(./proto/)
Protobuf definitions for control-plane messages exchanged between the operator and hosts over NATS.
[templates/]!(./templates/)
Rust project templates consumed by wash new (http-hello-world, http-handler, http-kv-handler, service-tcp, etc.).
[examples/]!(./examples/)
Reference component projects (blobby, grpc-hello-world, otel-config, qrcode, persistent-storage variants). Built and pushed to ghcr.io/wasmcloud/components/* by CI.
[deploy/]!(./deploy/)
kind and k3s configurations for local clusters.
[wit/]!(./wit/)
Top-level WIT definitions shared across the project (messaging, secrets).
Install the operator (and a bundled NATS) from the OCI Helm chart, applying the recommended overlay that disables the deprecated Runtime Gateway and routes HTTP via standard Kubernetes Services:
The wasmCloud platform has three primary parts, all developed in this repository:
Wasm Shell (wash) CLI — develop and publish components from any language that targets WASI Preview 2 (Rust, Go, TypeScript, Python, and more).
Runtime (wash-runtime) — the embeddable Rust runtime and host API. Use it via wash dev, run it as a cluster host managed by the operator, or build a custom host for embedded and edge scenarios.
Kubernetes Operator (runtime-operator) — runs wasmCloud infrastructure as standard Kubernetes resources. Auto-scaling, observability, GitOps, and RBAC all work through your existing tooling.
The runtime exposes capabilities through three mechanisms:
Built-in via wasmtime-wasi — wasi:filesystem, wasi:clocks, wasi:random, wasi:io, wasi:sockets, wasi:cli.
Ingress (Ingress) — wasi:http (client and server).
This is a Cargo workspace targeting Rust 1.91.0+ (edition 2024) for the Rust crates and Go 1.26.0 for the operator and gateway.
Terminal window
# Build the default workspace members (wash CLI by default)
cargobuild
# Build everything
cargobuild--workspace
The wash-runtime integration tests and benchmarks load precompiled wasm fixtures. You can build the
fixtures with the xtask runner.
[!WARNING]
As the current version of wasm-component-ld that is in use in upstream Rust is
older and does not support certain Component Model features that wasmCloud does,
you may have to install wasm-component-ld:
Terminal window
cargo install wasm-component-ld
(consider also using cargo binstall if you have it installed)
Once you have wasm-component-ld installed (any version greater than 0.5.24),
you can convince cargo to use it by settting the following environment variable
Releases ship every two weeks: each Tuesday at 16:00 UTC on the train’s cycle, the next vX.Y.Z is cut from main automatically. Anything merged before the train leaves ships in that release. See [RELEASE_RUNBOOK.md]!(./RELEASE_RUNBOOK.md) for the full cadence and procedure.
]!(LICENSE)
