Mewz: Lightweight Execution Environment for WebAssembly with High Isolation and Portability using Unikernels

TL;DR

This paper introduces Mewz, a lightweight, portable execution environment combining WebAssembly and unikernels to enhance isolation and performance for cloud workloads.

Contribution

It proposes a novel system that converts WebAssembly binaries into unikernel images, improving portability and reducing overhead compared to traditional VMs and containers.

Findings

Performance improved by 30% over existing Wasm runtimes.

Enables cross-platform deployment of applications as unikernels.

Provides high isolation suitable for cloud environments.

Abstract

Cloud computing requires isolation and portability for workloads. Cloud vendors must isolate each user's resources from others to prevent them from attacking other users or the whole system. Users may want to move their applications to different environments, for instance other cloud, on-premise servers, or edge devices. Virtual machines (VMs) and containers are widely used to achieve these requirements. However, there are two problems with combined use of VMs and containers. First, container images depend on host operating systems and CPU architectures. Users need to manage different container images for each platform to run the same codes on different OSes and ISAs. Second, performance is degraded by the overheads of both VMs and containers. Previous researches have solved each of these problems separately, but no solution solves both problems simultaneously. Therefore, execution environments of applications on cloud are required to be more lightweight and portable while ensuring isolation is required. We propose a new system that combines WebAssembly (Wasm) and unikernels. Wasm is a portable binary format, so it can be run on any host operating systems and architectures. Unikernels are kernels statically linked with applications, which reduces the overhead of guest kernel. In this approach, users deploy applications as a Wasm binary and it runs as a unikernel on cloud. To realize this system, we propose a mechanism to convert a Wasm binary into a unikernel image with the Wasm AoT-compiled to native code. We developed a unikernel with Wasm System Interface (WASI) API and an Ahead-of-Time (AoT) compiler that converts Wasm to native code. We evaluated the performance of the system by running a simple HTTP server compiled into Wasm and native code. The performance was improved by 30\% compared to running it with an existing Wasm runtime on Linux on a virtual machine.