hyperlight-wasm

What Hyperlight Wasm provides

Hyperlight Wasm is a component that lets Wasm modules run inside a lightweight, virtual machine backed sandbox. Its purpose is to let applications safely run untrusted or third party Wasm code inside a virtual machine with very low latency and overhead. It is built on top of Hyperlight, a related Microsoft backed project. At the moment it supports running applications using the Windows Hypervisor Platform on Windows, KVM on Linux, or the /dev/mshv device from the rust vmm mshv project. The repository makes clear that this is experimental code. Its developers do not consider it production grade, and it is not supported software. The repo ships hyperlight wasm along with a couple of sample Wasm modules and an example host application that can be used to test or try it out. For usage instructions the README points to a RustDev.md file. The design goal is to combine the isolation of a virtual machine with the small footprint that Wasm workloads need, so a host process can load guest code without trusting it with direct access to the machine. This makes it interesting for plugin systems and edge functions where untrusted code must run close to the host. The example host application that ships with the repo lets you try a guest module locally, which is the fastest way to see the virtual machine boundary working before writing your own host.

Building and prerequisites

Building Hyperlight Wasm requires a specific Rust toolchain. The README instructs you to use Rust version 1.94, installed and selected with rustup, before running the Just command runner. On Windows you need Rust, Just installed through cargo at version 1.5.0 or newer, pwsh, git, the GitHub CLI, wasm tools, and cargo component, and you must enable the Windows Hypervisor Platform feature with a PowerShell command. On Linux, the Ubuntu and KVM path needs build essential, Rust installed through rustup, Just via cargo, the GitHub CLI, wasm tools, and cargo component, plus a check that KVM is enabled using cpu checker and the kvm ok command. You also add your user to the kvm group. After the toolchain is ready, the build steps are just build to compile the Rust Wasm library, build wasm examples and build rust wasm examples to prepare the example modules, and just test followed by a cargo run of the helloworld example. These steps keep the setup close to a normal Rust workflow while pinning the exact tool versions the project expects. The README warns against installing Just through a system package manager because it may pull an older incompatible version. After the toolchain is ready, the just test command runs the Rust Wasm library tests and cargo run launches the helloworld example so you can confirm the sandbox executes a guest.

Component model support

Hyperlight Wasm has experimental support for running WebAssembly Component Model components rather than only core wasm modules. In this mode you set the WIT_WORLD environment variable to point to a binary encoding of a component type, for example the output of running wasm tools against a WIT file, which makes the resulting library include a guest binary specialized to load components of that type. You then use the host_bindgen macro to generate bindings from the same component type in the host. If a WIT file contains multiple worlds, you can select one with the WIT_WORLD_NAME variable, otherwise the last world in the file is used. The README shows a small WIT example with an http world and a queue world and the cargo build command that targets http world. For deeper debugging, the macro can write the expanded guest and host Rust to files under /tmp when a debug variable is set. The project adopts the Microsoft Open Source Code of Conduct, and license and security status are tracked through FOSSA badges in the README. As experimental software, it is best treated as a sandboxing building block for developers exploring safe Wasm execution. The component model path is the more forward looking option as the ecosystem standardizes around WIT based interfaces.

Editorial conclusion

Hyperlight Wasm is released under the Apache 2.0 license and, at the time of writing, the repository recorded 723 stars and was last updated on 2026-08-24.