Defense in Depth: High Speed Cloud Native With Soft- and Hardware Protected Functions
summary
A GitHub automation prototype compiles a Probot app into a WebAssembly component, publishes it to GHCR and runs it on tiny VM devices and a 5G handset, proving portability and a 51 MB uncompressed Node-equivalent artifact reduced to a much smaller WASM package. Hyperlight runs microVMs per request and demonstrates ~1 ms median latency with full sandbox reclaiming memory after each invocation, and Waset turns CLI actions into loadable components with policy-controlled permissions to make LLM-driven automations deterministic, Probot→WASM component, Hyperlight microVMs, per-invocation sandbox.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:58Container automation challenges
- 8:55Probot in WebAssembly demo
- 17:28Hyperlight for isolation
- 22:01LLMs and WebAssembly future
- 31:16MCP server WebAssembly demo
- 38:43Debugging WebAssembly automation
- 41:11Summary
related talks
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
08mLightning Talk: Build trusted cloud apps with Wasm: WebAssembly Micro Runtime is ready
48mDon't Trust Anything! Real-world Uses For WebAssembly
29mEnter the Sandbox: JS on Wasm
22mNo better sandbox: Wasm and the future of AI agent runtimes
32mIsolation without Containers
31mWebAssembly Component Model: Enhancing Security, Productivity, and...
34mPlaying Safely in the...