Background

I work as an engineer at a startup called Oryonix, run by Nitin Parab, former head of CTO’s office at Temporal and Nutanix. We work on durability, distributed systems, networking, databases etc. and specifically are betting on WebAssembly as the future. I personally worked on the worker sandbox that executes WASM code.

A little about me: I just graduated from college this June and have been working with Oryonix for a year. I have been learning Rust since the start of my second year (~3 years ago) and have written a lot of systems projects in Rust. In December 2025, I went to SIGGRAPH Asia in Hong Kong to present my paper on creating runtime GPU kernels, which was a project fully written in Rust.

Below, I am going to write high level points of how I would structure my talk.

Server-side WASM with Rust

Secure environments to execute code

• Why is a sandbox necessary?
• How do you execute arbitrary user written code
• Supply-chain attacks
• How WASM makes “syscalls” easy to work with in userspace and gates unpermitted access

Why WASM?

• Sandboxed execution environment
• Portable/Embeddable
• Very low cold start time
• Deterministic resource limits
• Language agnostic

An example of building a host-guest environment in Rust

• Writing a WIT interface, which is like RPC but the client is the guest (sandboxed WASM code) and the server is the host (in this example, the Rust process that executes the WASM code)
• Writing guest code that calls the functions in the WIT interface, and compiling it to WASM
• Executing the WASM code in the host

Where is this used

• Zed IDE
• Database extensions (DuckDB, sqlite)
• Serverless (Cloudflare Workers, Fermyon Spin which is owned by Akamai)