Loading WASM::COSMOS...
“WASI (WebAssembly System Interface) is a standardized set of POSIX-like system calls designed to run Wasm securely on servers, edge runtimes, and local machines (via Wasmtime, Wasmer, Node.js). WASI uses capability-based security: a program has 0 access to files or network unless explicitly granted by the host.”
Running WebAssembly outside the browser with POSIX-style sandboxed filesystem and network access.
(module
;; Import WASI fd_write from host
(import "wasi_snapshot_preview1" "fd_write"
(func $fd_write (param i32 i32 i32 i32) (result i32)))
(memory (export "memory") 1)
;; Stores "Hello WASI\n" at offset 8
(data (i32.const 8) "Hello WASI\n")
(func $main (export "_start")
;; Setup iovec structure at offset 0: [ptr=8, len=11]
(i32.store (i32.const 0) (i32.const 8))
(i32.store (i32.const 4) (i32.const 11))
;; Call fd_write(1 (stdout), iovs_ptr=0, iovs_len=1, nwritten_ptr=20)
(drop (call $fd_write (i32.const 1) (i32.const 0) (i32.const 1) (i32.const 20)))
)
)// Node.js WASI Runner
import { WASI } from 'wasi';
import fs from 'fs';
const wasi = new WASI({ version: 'preview1' });
const wasm = await WebAssembly.compile(fs.readFileSync('hello.wasm'));
const instance = await WebAssembly.instantiate(wasm, wasi.getImportObject());
wasi.start(instance); // Prints "Hello WASI"Wasm module imports WASI syscalls: fd_read, fd_write, clock_time_get
Host runtime (Wasmtime/Node) pre-opens allowed directories (--dir=/tmp)
Module invokes fd_write(1, ...) to write to standard output stdout
Runtime enforces capability boundary: requests outside granted directories are rejected with EACCES
Enables true "write once, run securely anywhere" portability
WASI micro-virtual machines cold-start in sub-millisecond speeds (~100 microseconds), outperforming Docker containers by 1,000x for edge serverless functions.