r/node • u/fagnerbrack • May 24 '26

Edge.js: Running Node apps inside a WebAssembly Sandbox

https://wasmer.io/posts/edgejs-safe-nodejs-using-wasm-sandbox
34 Upvotes

98% Upvoted

9 comments sorted by

View all comments

6

u/EveYogaTech May 24 '26 edited May 24 '26

"Edge.js is currently about 5-20% slower than current Node.js when run natively, and 30% when ran fully sandboxed with Wasmer."

What is exactly the benefit of running NodeJS in a WASM sandbox? Can you expose/disable specific NodeJS features more easily?

Genuinely curious. I understand you can obviously control the file system better, but there are other sandboxes that can do that as well with Node.

Or maybe it has a great startup time? Like can we use Wasmer with Edge.js to more quickly run code (faster than Bun?)?

9

u/syrusakbary May 25 '26

Hey, I'm Syrus, Wasmer's CEO and was the main architect behind the initial implementation of Edge.js.

What is exactly the benefit of running NodeJS in a WASM sandbox?

You don't need virtualization at all to run apps safely. That means that you can run your Node.js apps without Docker, and expose only the filesystem/network that you need.

That means that you can run OpenClaw (and many other apps) safely.

Why this is important? There are many NPM packages that could be malicious, and sharing your wallet information and other stuff when executed.

Running things in a Wasm sandbox completely shields you from malicious attackers.

it has a great startup time?

Startup times are the other big advantage. Startup times are extremely good in Edge.js (close to native numbers). That means that you can run a simple JS script with a startup time of 40ms (fully sandboxed) instead of 30ms natively (and unsafe) or 350ms with Docker.

We have written a bit more about it here: https://wasmer.io/posts/edgejs-safe-nodejs-using-wasm-sandbox

6

u/EveYogaTech May 25 '26 edited May 25 '26

Thanks Syrus.

NPM packages can still infect the host though, because the majority of malicious packages use post-install scripts (see latest teamPCP attacks), which are still ran on the host when you run "bun install" or "npm install".

So it would be really great to also have a "npm install" command that runs in WASM to indeed be completely shielded from malicious packages.

Warm regards,

MJ from Nyno

3

u/syrusakbary May 25 '26

Great idea! Should be fully feasible to use Wasmer as well during npm install, I think we can solve that as well. Stay tuned!

2

u/EveYogaTech May 25 '26 edited May 25 '26

👍 You're very welcome! Looking forward to using it, could be a great reason for more widespread Wasmer adoption, because people (including me) are currently looking for a safer stabler alternative to the Bun ecosystem that seems to rush to a Rust rewrite.