WaSC: Hardening WebAssembly Sandboxes via System Interface Decoupling

WebAssembly (WASM) is emerging as an alternative to containers in serverless computing due to its lightweight memory isolation and secure language semantics. However, the WASM System Interface (WASI) does not guarantee isolation from the host kernel. Secure containers reduce exposure to the host kernel API, but they do not match WASM’s memory efficiency or startup latency. In this article, we introduce WaSC, a secure container runtime that hardens WASM system isolation by decoupling the system interface used by sandbox functions into a virtualization-based daemon. WASM functions connect to this daemon transparently; the daemon protects the system interface with machine-level isolation while preserving function-level startup times and memory footprints. Our evaluation shows that WaSC achieves a 99th-percentile startup latency of 15 ms and maintains a memory footprint of ∼10 MB. Compared to Firecracker, a state-of-the-art secure container runtime, WaSC achieves 3× memory density on a single physical machine. We present microbenchmarks and application benchmarks that characterize WaSC’s performance and inform performance tuning for serverless applications ported to WaSC.WaSC incurs a 3.2× slowdown for WASI calls along the virtualization-based daemon path, and SQLite speedtest1 indicates an average 80% increase in runtime.