# rustix: safe Rust bindings to POSIX and Linux syscalls, with two selectable backends > rustix wraps POSIX, Unix, Linux, and Winsock syscalls in memory-safe Rust types, using I/O safety types instead of raw file descriptors and Result instead of errno. Version 1.1.5 requires Rust 1.65 and defaults to a linux_raw backend that compiles down to inlined syscalls on supported Linux architectures. **bytecodealliance/rustix** — Safe Rust bindings to POSIX-ish APIs - Repository: https://github.com/bytecodealliance/rustix - Stars: 2,116 · Forks: 305 - Language: Rust - License: NOASSERTION - Published: 2026-10-09 · Updated: 2026-10-09 · Language: en - Canonical page: https://hysenlabs.com/projects/bytecodealliance-rustix ## Unsafe POSIX calls are what rustix replaces for Rust library authors When Rust code needs to open a file, bind a socket, or fork a process, the direct path is through OS syscalls. Without a wrapper, that means raw pointers, integer error codes, and the caller holding the invariants the OS requires. rustix covers this gap by providing memory-safe wrappers to POSIX-like, Unix-like, Linux, and Winsock syscall-like APIs. It replaces raw pointers with Rust references and slices, replaces integer file descriptors with I/O-safety types, and replaces errno with Result values. The project is maintained by the Bytecode Alliance, the industry consortium that backs wasmtime and related runtime infrastructure. Two authors are listed in Cargo.toml: Dan Gohman and Jakub Konka. That origin matters because it sets the audience: systems programmers writing low-level Rust libraries or runtimes, not application developers looking for a batteries-included async I/O layer. rustix is deliberately narrow. It provides no runtime, no thread pool, and no async executor. Crates such as cap-std, memfd, timerfd, and io-streams build on rustix to offer higher-level and more portable APIs, and the README names those explicitly as the next layer up. A project that wants portability and convenience starts with one of those; a project that needs to control exactly which syscalls are made starts here. ## The linux_raw backend avoids libc and compiles to inlined syscalls; libc is the fallback for other platforms rustix offers two selectable backends. The linux_raw backend uses raw Linux system calls and vDSO calls. It is supported on Linux for x86-64, x86, aarch64, riscv64gc, powerpc64le, arm (v5 onwards), mipsel, and mips64el, with stable Rust, nightly Rust, and Rust 1.65. Because it is implemented entirely in Rust without libc, without errno, and without pthread cancellation, the README states that most functions compile down to very efficient code that can often be fully inlined into user code. Memory safety, I/O safety, and pointer provenance are preserved all the way down to the syscalls on this path. The libc backend uses the libc crate, which provides bindings to native libc libraries on Unix-family platforms, plus windows-sys for Winsock on Windows. It is portable to many operating systems that linux_raw does not cover. The linux_raw backend is enabled by default on platforms that support it. To switch to libc, you add use-libc as a cargo feature in Cargo.toml, or set RUSTFLAGS to --cfg=rustix_use_libc at build time. There is no runtime selection: the choice is made at compile time and is fixed for the entire build. ## Adding rustix to a Cargo project and specifying only the modules you need rustix is published on crates.io under the name rustix. Adding it to a Cargo project means inserting a dependency entry in Cargo.toml with the specific feature flags for the API modules your code uses. Since most modules are off by default, you pay compile time only for what you enable. Five modules compile in without any feature flag: rustix::io, rustix::buffer, rustix::fd, rustix::ffi, and rustix::ioctl. Everything else requires naming a feature. The minimum Rust version is 1.65, as set under rust-version in Cargo.toml. That is also the version at which the linux_raw backend operates on stable Rust. The examples/ directory in the repository holds working code files: examples/hello.rs, examples/process.rs, examples/stdio.rs, examples/time.rs, examples/termios.rs, examples/dup2_to_replace_stdio.rs, examples/port.rs, examples/kq.rs, examples/pivot_root.rs, and examples/buffer_errors.rs. Reading those shows how the types look in practice before writing project code. API documentation is published at docs.rs/rustix. ## Optional API modules and Linux-version feature flags control what compiles in The cargo feature table in the README lists these API modules as optional: event, fs, io_uring, mm, mount, net, param, pipe, process, pty, rand, shm, stdio, system, termios, thread, and time. Enabling only what a crate uses is the expected pattern, because every extra module adds to compilation time. Cargo.toml marks the crate as mostly-unused in the hints section, signaling that most users touch a fraction of the API surface and the rest should be skipped by default. Four features target specific Linux kernel versions: linux_4_11, which enables optimizations that assume Linux 4.11 or newer; linux_5_1 and linux_5_11, which assume those respective kernel versions; and linux_latest, which assumes the current Linux release. Enabling any of these on a system running an older kernel than stated is an error, and there is no runtime check to catch it. The feature use-libc-auxv switches auxiliary vector reading from PR_GET_AUXV or /proc/self/auxv to the getauxval function instead. The std and alloc features are on by default. Disabling std activates no_std mode for environments without the standard library, which covers embedded targets and WebAssembly runtimes where a full standard library is unavailable. ## I/O safety types prevent use-after-close bugs that raw integer file descriptors allow A raw integer file descriptor can be closed and then reused by the OS for a different file. Any code still holding the old integer can accidentally operate on the new file. That class of bug is silent and produces data corruption rather than a crash. rustix uses I/O safety types throughout instead of raw pointers, tying ownership of a descriptor to the Rust type system. This design follows the I/O safety initiative that the Rust standard library adopted. The README links to the I/O safety RFC and to documentation on provenance. For library authors writing low-level system code, using rustix means those guarantees propagate upward through whatever is built on top. Flag arguments use the bitflags crate rather than bare integers. A typed bitflag value prevents combining flags that do not belong together and produces a compiler error instead of undefined OS behavior. Path arguments are handled through an Arg trait that accepts any Rust string type, avoiding repeated conversion overhead when callers hold different string representations. ## Only the net module reaches Windows through Winsock; every other module does not The only part of rustix that compiles and runs on Windows is the net module, which uses windows-sys to call Windows Sockets 2. Every other module targets POSIX-like operating systems and does not support Windows at all. That boundary is stated plainly in the README: for higher-level and more portable APIs, the named alternatives are cap-std, memfd, timerfd, and io-streams. This is not a temporary gap. The linux_raw backend is Linux-specific by construction: it calls raw Linux syscalls, and there are no raw Linux syscalls on Windows. The libc backend covers many Unix-family platforms but does not bring the non-net modules to Windows either. A project that needs cross-platform filesystem, process, or terminal operations cannot use most of rustix on Windows. Choosing rustix for network code and a separate crate for everything else is a viable split if your target set includes Windows, but it requires awareness of where the boundary falls. ## Version 1.0.0 shipped in March 2025; the license has three components with an LLVM exception The project reached v1.0.0 on 2025-03-06. Before that, a long pre-1.0 series ran through versions including v0.38.0 on 2023-06-28 and v0.37.20 on 2023-06-11. The current version in Cargo.toml is 1.1.5. The last push was on 2026-09-16, and the repository is not archived. The Cargo.toml license field reads: Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT. The LLVM exception relaxes the patent retaliation clause in Apache-2.0, a practice common in compiler infrastructure components. The repository root holds three license files: LICENSE-APACHE, LICENSE-Apache-2.0_WITH_LLVM-exception, and LICENSE-MIT. GitHub cannot classify the combination into a single standard licence category, so the repository shows it as a custom licence. Read those three files before redistributing or incorporating the code. The CHANGES.md file at the repository root tracks version history. CONTRIBUTING.md and CODE_OF_CONDUCT.md cover contribution guidelines and Bytecode Alliance community standards. A SECURITY.md file is present for reporting vulnerabilities through the appropriate channel. ## Conclusion Systems library authors who want safe Linux syscall wrappers without a libc dependency should look at rustix first. Application programmers on Windows who need filesystem or process operations will find only the net module useful there, since every other module targets POSIX-like platforms. Before adopting, confirm that your Linux kernel version is compatible with any linux_4_11, linux_5_1, or linux_5_11 feature flags you plan to enable, and verify that the Rust 1.65 minimum version matches your toolchain constraint. ## FAQ ### What is rustix? rustix is a Rust crate that provides memory-safe and I/O-safe wrappers to POSIX-like, Unix-like, Linux, and Winsock syscall-like APIs. It uses Rust types instead of raw pointers and Result instead of errno, and is published on crates.io at version 1.1.5. ### How do I add rustix to a Cargo project? Add rustix to the [dependencies] section of Cargo.toml and list the API modules you need as feature flags, for example features = ["fs", "process"]. Most modules are not enabled by default, so only the ones you specify will compile in. ### Does rustix support Windows? Only the net module supports Windows, through the windows-sys crate and Winsock 2. Every other rustix module targets POSIX-like operating systems and does not compile for Windows. ### What is the minimum Rust version for rustix? The Cargo.toml sets rust-version to 1.65. That is also the version at which the linux_raw backend works on stable Rust. ### What is the difference between the linux_raw and libc backends in rustix? The linux_raw backend makes raw Linux syscalls and vDSO calls entirely in Rust, avoiding libc and errno, and is limited to supported Linux architectures. The libc backend uses the libc crate and is portable to many Unix-family platforms and Windows for the net module. ## Sources - [bytecodealliance/rustix on GitHub](https://github.com/bytecodealliance/rustix) - [Issues](https://github.com/bytecodealliance/rustix/issues) - [README](https://github.com/bytecodealliance/rustix/blob/main/README.md) - [Releases](https://github.com/bytecodealliance/rustix/releases) --- Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/bytecodealliance-rustix