Defense in Depth: High Speed Cloud Native With Soft- and H... Ralph Squillace & Ben De St Paer-Gotch

### Overview Presented by Ben De St Paer-Gotch (GitHub) and Ralph Squillace (Azure Core Upstream), this presentation explores how WebAssembly (Wasm) components and microVM technologies like CNCF Hyperlight can revolutionize developer automation and security. Addressing the limitations of traditional container packaging for lightweight, ephemeral workloads, the speakers demonstrate practical methods to isolate, distribute, and execute automation tasks with millisecond-level cold starts. They also examine how compiling modular Wasm tools enables deterministic execution and fine-grained policy enforcement for AI agents and Model Context Protocol (MCP) servers.

### Key Topics - **Limitations of Container Sandboxing for Small Automations**: Containers were designed for long-running processes rather than isolated, per-request function invocations. They introduce container and VM boundary overhead, multi-arch build friction, image bloat, and cold starts measured in seconds. - **WebAssembly Components & Per-Request Ephemerality**: WebAssembly operates as an open standard (W3C) offering strong mathematical software isolation, cross-platform portability, and instantaneous memory reclamation per invocation without persistent state bleed. - **Porting Node.js Frameworks (Probot) to Wasm**: Compiling existing JavaScript/Node tooling (such as GitHub app framework Probot) into Wasm components using tools like `componentize-js`, packaging them into OCI registries (such as GHCR via `wackage`), and running them on constrained edge hardware. - **Hardware-Enforced Defense in Depth via Hyperlight**: The CNCF Hyperlight project embeds microVM technology directly beneath functions/Wasm runtimes, delivering sub-millisecond to 2-millisecond boot times without OS or distro overhead. - **Deterministic Tooling for AI and LLMs with Waset**: Taming non-deterministic LLMs and AI coding assistants by providing dynamic, sandboxed, policy-enforced Wasm components as structured tools for MCP servers.

### Technical Details - **Probot to Wasm Pipeline**: A standard Probot application targeting GitHub webhooks was bundled and compiled into a WebAssembly component using `componentize-js`. Despite bundling an embedded JavaScript engine, application code, and Node compatibility shims, the resulting uncompressed, debuggable component was only 51 MB—far smaller than a full Node container image. The component was distributed via GitHub Container Registry (GHCR) as an OCI artifact using `wackage` and executed across differing architectures (including an edge Particle.io device with 5G connectivity) using `wasmtime` and SMEI tunneling. - **Hyperlight MicroVM Benchmarks**: Running Hyperlight microVMs demonstrated cold execution per request and pooled warm executions (using a pool of 50 microVMs sized at ≤8 MB each with dedicated vCPUs). Across Windows/WSL networking, execution latencies measured roughly 1 to 2 milliseconds per request, dropping into sub-millisecond execution on bare metal. - **Waset MCP Tool Foundry**: Using Microsoft's open-source `waset` project, tools for LLM agents are defined as immutable, standalone Wasm components rather than unrestricted local bash scripts or full CLI installations. An LLM (GitHub Copilot) was guided by an extensive, expert-authored specification to autonomously author, build, and troubleshoot a GitHub issues triage tool in Wasm. The runtime environment dynamically loads the component and requires explicit user consent/policy checks before granting access to network and system resources.

### Takeaways - WebAssembly components provide a secure, ephemeral execution model where state is destroyed after each request, avoiding cross-call contamination. - Pairing Wasm software sandboxing with Hyperlight microVMs provides hardware-level defense in depth at microsecond to millisecond latency. - Rather than exposing broad command-line permissions to LLMs, developers can build 'foundries' that supply deterministic, scoped, and policy-governed Wasm tools for AI agent workflows.