Run wasm32-wasip1 command-line apps in the browser

Not every tool needs an emulated CPU. NanoVM's wasm runner executes wasm32-wasip1 command-line programs directly on the browser's own WebAssembly engine, while they read and write the same in-memory filesystem as the RISC-V VM. Compile a Rust or C tool for WASI, register its bytes, and call it like any other command.

Why a separate wasm runner

The RISC-V VM is the fidelity path: it runs unmodified Linux ELF binaries instruction by instruction. That is exactly right for Node.js or BusyBox, but slow for a tool that already compiles to WebAssembly. The wasm runner skips the emulation: the module is compiled once by the browser (and cached by content hash), then each invocation runs in its own Web Worker with a WASI preview 1 shim backed by the kernel's VFS.

Image processing with Photon

photon is a small Rust CLI over the Photon image library, built for wasm32-wasip1. Its usage is photon <in> <out> [--filter grayscale|invert|blur|brighten|sepia|threshold] [--strength N]. The sample image is seeded into /work, the output PNG is read back from the VFS and shown under the output.

photon in.jpg out.png --filter grayscale

photon: grayscale 360x240 -> out.png (360x240 PNG)

photon in.jpg blurred.png --filter blur
photon blurred.png edges.png --filter threshold

photon: blur 360x240 -> blurred.png (360x240 PNG)
photon: threshold 360x240 -> edges.png (360x240 PNG)

Searching code with ripgrep

rg here is a real ripgrep front-end built on ripgrep's own ignore, regex and globset crates, compiled to wasm32-wasip1 (single-threaded walk, std-only I/O). It honours .gitignore, so the file under target/ is skipped. Supported flags include --files, -i/-S/-w/-F/-v, -n, -l, -c, -o, -A/-B/-C, -g/--glob, --hidden, --no-ignore and --json; PCRE2 (-P), multiline and --type are not built in.

rg -n TODO proj
rg --files proj

proj/src/main.rs:2:    // TODO: parse arguments
proj/src/lib.rs:2:    a + b // TODO: overflow?
proj/src/main.rs
proj/src/lib.rs
proj/notes.md

rg -c TODO -g '*.rs' proj
rg -l --no-ignore TODO proj

proj/src/main.rs:1
proj/src/lib.rs:1
proj/src/main.rs
proj/src/lib.rs
proj/target/debug/build.log

The SDK calls behind it

Two calls do the work. registerWasmApp(name, bytes) pins a command name to the wasm-app tier; execWasmApp(argv, { cwd, timeoutMs }) runs it with the VM's capabilities and returns { exitCode, stdout, stderr }. Binary output goes through files: the app writes into cwd, you read the bytes back with nano.fs.readFile.

const bytes = new Uint8Array(await (await fetch("/nano/rg.wasm")).arrayBuffer());
await nano.registerWasmApp("rg", bytes);

nano.fs.writeFile("/work/api/todo.txt", "write docs\nship it\nwrite tests\n");
const r = await nano.execWasmApp(["rg", "-n", "^write"], { cwd: "/work/api" });

print("exit:", r.exitCode);
print(r.stdout.trim());

exit: 0
todo.txt:1:write docs
todo.txt:3:write tests

const bytes = new Uint8Array(await (await fetch("/nano/photon.wasm")).arrayBuffer());
await nano.registerWasmApp("photon", bytes);
nano.fs.writeFile("/work/t/in.jpg", new Uint8Array(await (await fetch("/demo-files/photon/sample.jpg")).arrayBuffer()));

const r = await nano.execWasmApp(["photon", "in.jpg", "out.png", "--filter", "blur"], { cwd: "/work/t", timeoutMs: 1 });
print("exit code:", r.exitCode);

exit code: 124

Shipping your own WASI tool

• Build for wasm32-wasip1 (for Rust: cargo build --release --target wasm32-wasip1). Single-threaded builds are the tested path.
• Treat the working directory as the root: the runner preopens cwd as /, so relative paths and . resolve inside it.
• Use stdout/stderr for text and files for binary data — stdout is decoded as UTF-8.
• Publish it to the catalog as kind: "wasm-app" and nano.installApp(name) registers it automatically after verifying the signature.

FAQ