WebAssembly on Kubernetes: The Next Evolution Beyond Containers

// Rust code
fn main() {
    println!("Hello from Wasm!");
}

# Compile to Wasm
cargo build --target wasm32-wasi --release
# Output: target/wasm32-wasi/release/hello.wasm (few hundred KB)

# Run with wasmtime, granting file access
wasmtime --dir=/data hello.wasm

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: wasmtime
handler: wasmtime  # Matches containerd config
scheduling:
  nodeSelector:
    kubernetes.io/wasm: "true"

apiVersion: v1
kind: Pod
metadata:
  name: wasm-pod
spec:
  runtimeClassName: wasmtime  # Use Wasm runtime
  containers:
    - name: hello
      image: ghcr.io/example/hello-wasm:latest
      command: ["/hello.wasm"]

# containerd config.toml
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.wasmtime]
  runtime_type = "io.containerd.wasmtime.v1"

[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.wasmedge]
  runtime_type = "io.containerd.wasmedge.v1"

# Install kwasm operator
helm install kwasm-operator kwasm/kwasm-operator \
  --namespace kwasm \
  --create-namespace

# Label nodes to install Wasm shims
kubectl label node worker-1 kwasm.sh/kwasm-node=true

# On each node
# Download and install shim
curl -LO https://github.com/containerd/runwasi/releases/download/v0.3.0/containerd-shim-wasmtime-v1-linux-amd64.tar.gz
tar xzf containerd-shim-wasmtime-v1-linux-amd64.tar.gz
mv containerd-shim-wasmtime-v1 /usr/local/bin/

# Update containerd config
cat >> /etc/containerd/config.toml << EOF
[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.wasmtime]
  runtime_type = "io.containerd.wasmtime.v1"
EOF

# Restart containerd
systemctl restart containerd

use spin_sdk::http::{Request, Response};
use spin_sdk::http_component;

#[http_component]
fn handle_request(req: Request) -> Response {
    Response::builder()
        .status(200)
        .body(Some("Hello from Spin!".into()))
        .build()
}

# Build and run locally
spin build
spin up
# HTTP server on port 3000

# Install cert-manager (required)
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

# Install SpinKube (runtime class, shim, operator)
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.2.0/spin-operator.crds.yaml
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.2.0/spin-operator.runtime-class.yaml
kubectl apply -f https://github.com/spinkube/spin-operator/releases/download/v0.2.0/spin-operator.shim-executor.yaml
helm install spin-operator oci://ghcr.io/spinkube/charts/spin-operator \
  --namespace spin-operator --create-namespace

apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: hello-spin
spec:
  image: ghcr.io/spinkube/spin-operator/hello-world:latest
  replicas: 2
  executor: containerd-shim-spin

kubectl apply -f spinapp.yaml

# Service is automatically created
kubectl get svc hello-spin

apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: autoscaled-app
spec:
  image: ghcr.io/example/my-app:latest
  enableAutoscaling: true
  resources:
    limits:
      cpu: 100m
      memory: 128Mi

spec:
  variables:
    - name: API_KEY
      valueFrom:
        secretKeyRef:
          name: my-secret
          key: api-key

// src/lib.rs
use spin_sdk::http::{Request, Response};
use spin_sdk::http_component;

#[http_component]
fn handle(req: Request) -> anyhow::Result<Response> {
    let path = req.uri().path();
    Ok(Response::builder()
        .status(200)
        .header("content-type", "application/json")
        .body(format!(r#"{{"path": "{}"}}"#, path))
        .build())
}

# spin.toml
spin_manifest_version = 2

[application]
name = "my-app"
version = "0.1.0"

[[trigger.http]]
route = "/..."
component = "my-app"

[component.my-app]
source = "target/wasm32-wasi/release/my_app.wasm"
[component.my-app.build]
command = "cargo build --target wasm32-wasi --release"

package main

import (
    "fmt"
    "net/http"
    
    spinhttp "github.com/fermyon/spin/sdk/go/v2/http"
)

func main() {
    spinhttp.Handle(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("Content-Type", "application/json")
        fmt.Fprintf(w, `{"message": "Hello from Go!"}`)
    })
}

tinygo build -target=wasi -o main.wasm main.go

// src/index.js
export async function handler(request, context) {
    return {
        status: 200,
        headers: { "content-type": "application/json" },
        body: JSON.stringify({ message: "Hello from JS!" })
    };
}

from spin_sdk.http import simple

class IncomingHandler(simple.IncomingHandler):
    def handle_request(self, request):
        return simple.Response(
            200,
            {"content-type": "application/json"},
            b'{"message": "Hello from Python!"}'
        )

apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: inference
spec:
  image: ghcr.io/example/llm-inference:latest
  resources:
    limits:
      memory: 512Mi  # Small model fits in Wasm

# Install Spin
curl -fsSL https://developer.fermyon.com/downloads/install.sh | bash

# Create new app
spin new -t http-rust hello-wasm
cd hello-wasm

# Build and run locally
spin build
spin up
# Visit http://localhost:3000

# Build and push OCI image
spin registry push ghcr.io/myuser/hello-wasm:latest

# Deploy
cat <<EOF | kubectl apply -f -
apiVersion: core.spinoperator.dev/v1alpha1
kind: SpinApp
metadata:
  name: hello-wasm
spec:
  image: ghcr.io/myuser/hello-wasm:latest
  replicas: 1
  executor: containerd-shim-spin
EOF