Run WebAssembly workloads with a secure, embeddable, fully controlled Rust runtime. Build, validate, publish, and distribute—from your machine to the cloud.
› wasmd hello.wasm
Hello from WebAssembly!
› wasmd inspect hello.wasm
Module
format core · version 1
Imports
wasi_snapshot_preview1.fd_write
Exports
_start
› wasmd push hello.wasm demo/hello:1.0.0
uploading ████████████ 100%
The runtime is only the beginning. The Registry, package specification, and orchestration model form open infrastructure built for WebAssembly.
A WebAssembly Core 3.0 runtime written in Rust, with validation, interpretation, WASI, an embedding API, resource governance, and portable caching.
An open, self-hosted WebAssembly package registry. Distribute immutable modules and components by name, version, tag, and digest.
An orchestration specification centered directly on Wasm workloads, without making containers or the Kubernetes API part of the runtime boundary.
More than simply running Wasm. Wasmd brings conformance, resource governance, security boundaries, and production diagnostics into one focused runtime.
Parse, validate, instantiate, and execute the standard binary format across modern WebAssembly proposals.
Give untrusted workloads clear, predictable, and cancellable execution boundaries.
Control compilation, linking, stores, instances, and function calls through a compact Rust API.
let engine = Engine::default();
let module = engine.compile(bytes)?;
let instance = engine
.instantiate(&module, &linker, &mut store)?;Spec tests, fuzzing, Miri, ASan, differential testing, and supply-chain audits form a continuous quality loop.
The Wasmd CLI provides one workflow for local development, CI validation, and Registry distribution, while the Rust API embeds naturally into your services.
# Compile a Rust WASI program
rustup target add wasm32-wasip1
rustc --target wasm32-wasip1 -O \
examples/hello.rs -o hello.wasm
# Validate and run
wasmd validate hello.wasm
wasmd hello.wasm
Hello from WebAssembly!use wasmd::{Engine, Linker, Value};
let engine = Engine::default();
let module = engine.compile_text(
"(module (func (export \"answer\")
(result i32) i32.const 42))",
)?;
let mut store = engine.new_store();
let instance = engine.instantiate(
&module, &Linker::new(), &mut store
)?;
instance.invoke(&mut store, "answer", &[])?;# Sign in to a self-hosted Registry
$WASMD_REGISTRY_TOKEN | wasmd login \
http://127.0.0.1:8080 --token-stdin
wasmd namespace create demo \
--description "Demo packages"
wasmd push hello.wasm demo/hello:1.0.0 \
--license Apache-2.0
wasmd pull demo/hello:1.0.0 -o hello.wasm# The Registry is itself a Wasm workload
wasmd serve registry.wasm \
--listen 127.0.0.1:8080 \
--data ./data/wasm \
--inherit-env WASMD_REGISTRY_ADMIN_TOKEN
✓ listening on http://127.0.0.1:8080Modules never inherit host networking, filesystems, environment variables, or arguments automatically. Every capability is explicitly granted by the host and constrained by measurable resource budgets.
Expose only the directories, variables, and host functions a workload actually needs.
Limits for fuel, epochs, memory, tables, value stacks, call depth, and GC.
Wasm, WAT, WAST, caches, linear memory, and WASI paths are all validated.
Wasmd locks a WebAssembly Core 3.0 specification baseline and continuously proves compatibility through reproducible tests.
commit fc209c5ed8afc4dfeb9252024d217da3376c7a6f
Performance data is a same-machine regression baseline on Windows x64 with release thin-LTO. It detects regressions and is not an absolute ranking across hardware or runtimes.
The Registry automatically unpacks uploaded WebAssembly components and analyzes WIT worlds, imports, exports, and dependency graphs—making every package understandable before it runs.
wasi:cli/stdout
wasi:clocks/wall-clock
run() → result
version() → string
Wasmd uses standard WASI as its only host interface. Package, registry, and orchestration specifications evolve in the open while the runtime boundary stays simple and portable.
Standard WASI Preview 1, capability grants, resource limits, and an HTTP service host.
Wasmd 1.0Manifests, components, resources, entry points, locked dependencies, digests, signatures, provenance, and SBOMs.
Open specificationNamespaces, immutable versions, push/pull, resolution, authentication, mirrors, and federation.
Self-hostablePlacement, replicas, health checks, updates, rollbacks, scaling, capability grants, and trust policies.
Community designFrom your first line of code to the production security model, every essential concept is here.
Install the toolchain, then compile and run your first WASI module.
Start building →02Module lifecycle, linking, stores, caching, and execution control.
Explore capabilities →03Capability grants, preopened directories, environment, and resource boundaries.
Understand security →04Deploy a registry, create namespaces, and publish components.
Manage packages →05Locked baselines, test methodology, and reproducible results.
View the report →06Code standards, security reporting, and the community roadmap.
Join the project →A stable scope, explicit limits, and clear responsibility boundaries are essential to infrastructure you can trust.
Arguments and environment, clocks and randomness, file descriptor I/O, path operations, poll_oneoff, sched_yield, and proc_exit. Host arguments, environment, filesystems, and networking are not inherited by default.
The Registry can identify components, reconstruct WIT, and display world imports, exports, and dependency graphs. The Component Model and WASI Preview 2 are not yet part of the Wasmd 1.0 runtime security claim.
Fuel, epoch deadlines, cancellation signals, and quotas for memory, tables, value stacks, call depth, and GC establish hard boundaries. All external input is treated as untrusted.
Versions are immutable and blobs use SHA-256 content-addressed storage. Reads are public; writes require scoped tokens. Admin tokens should contain at least 32 random characters, and only token hashes are stored.
Wasmd currently focuses on the runtime and Wasm-native distribution. A future orchestration specification will cover workloads, replicas, placement, health checks, and updates without using the Kubernetes API as the runtime interface.
Report vulnerabilities privately through the project's security channel and include reproduction details. The maintenance target is an acknowledgment within three business days and an initial assessment within seven, avoiding public disclosure before a fix is available.
The Rust toolchain is all you need. Build the runtime, compile a WASI program, and run it directly.
PS› cargo build --release -p wasmd-cli
Compiling wasmd v1.0.0
Finished release [optimized]
PS› .\target\release\wasmd.exe hello.wasm
Hello from WebAssembly!Wasmd is open source under Apache-2.0. Conformance results, dependency audits, SBOMs, and release processes are transparent too.