Breaking Limits - Highly-Isolated and Low-Overhead Wasm Container

Explore a groundbreaking conference talk that introduces Mewz, a revolutionary WebAssembly runtime designed to overcome the isolation challenges of traditional Wasm containers in multi-tenant cloud environments. Learn how this innovative solution addresses the critical security limitations of WebAssembly by running each Wasm module within a dedicated virtual machine paired with a lightweight, specialized unikernel. Discover the architectural design principles behind Mewz that enable it to deliver superior isolation compared to conventional Wasm runtimes while maintaining low overhead performance. Understand the technical challenges of achieving sufficient isolation for public cloud deployments where multiple tenants share infrastructure, and examine how the unique execution model of running single Wasm modules in dedicated VMs with unikernels provides a more secure alternative to kernel-sharing approaches. Gain insights into the open-source implementation of this CNCF landscape-listed project and engage in forward-looking discussions about the future of cloud-native workloads powered by WebAssembly technology.