bytecodealliance/lucetArchived
Lucet
Lucet es un runtime de WebAssembly y compilador de sandboxing que traduce bytecode de WebAssembly a código máquina nativo. Sirve como un entorno de ejecución seguro y generador de código nativo diseñado para ejecutar código no confiable mientras previene el acceso no autorizado a los recursos del sistema host.
El proyecto se centra en el sandboxing de alto rendimiento mediante el uso de compilación ahead-of-time para lograr velocidades de ejecución cercanas a las nativas. Implementa aislamiento de fallos basado en software y una interfaz de llamadas al host para gestionar la comunicación segura y el intercambio de datos entre el módulo aislado y la aplicación host externa.
El sistema proporciona capacidades para la generación de código máquina nativo, mapeo de memoria lineal y ejecución basada en sandbox para garantizar un fuerte aislamiento de memoria.
Features
- Code Execution Sandboxes - Provides a secure, isolated execution environment to run untrusted WebAssembly code without compromising host system resources.
- WebAssembly AOT Compilers - Compiles WebAssembly bytecode into native machine code prior to execution for near-native performance.
- Sandboxing Compilers - Translates WebAssembly bytecode into native machine code specifically for execution within a secure, isolated sandbox.
- WebAssembly Sandboxing - Executes untrusted WebAssembly code in a secure environment to protect host memory and system resources.
- WebAssembly Execution Modes - Provides a runtime that compiles and executes WebAssembly modules within a secure sandbox.
- High-Performance Sandboxing - Achieves near-native execution speeds for isolated code by utilizing ahead-of-time compilation.
- Machine Code Generation - Generates architecture-specific native machine code from WebAssembly bytecode to eliminate interpreter overhead.
- Machine Code Generators - Converts portable WebAssembly instructions into optimized machine code specific to the host hardware.
- Ahead-of-Time Wasm Execution - Implements ahead-of-time compilation of WebAssembly bytecode into native machine code for high-performance execution.
- WebAssembly Runtimes - Acts as a high-performance execution environment for compiled WebAssembly modules with strong memory isolation.
- Secure Execution Environments - Provides a sandboxed system designed to run untrusted code while preventing unauthorized host resource access.
- Software-Based Fault Isolations - Implements software-based fault isolation to restrict memory access via guard pages and bounds checking.
- Host-Call Interfaces - Provides a host-call interface to manage secure communication and data exchange between sandboxed modules and the host.
- Isolated Code Execution - Ensures secure code execution by running programs in an isolated environment to prevent host system access.
- Linear Memory Sharing - Utilizes linear memory mapping to provide fast indexing and memory isolation for WebAssembly modules.
