|
| 1 | +# WebContainer |
| 2 | + |
| 3 | +This repository serves as a coordination point for the WebContainer working group. Chat with our team live on [Discord](https://discord.gg/stackblitz). See how you can [get involved](#getting-involved) below. |
| 4 | + |
| 5 | +### Browser Support |
| 6 | + |
| 7 | +|<a href="#"></a><br>Chrome|<a href="#"></a><br>Edge|<a href="#"></a><br>Opera|<a href="#"></a><br>Safari|<a href="#"></a><br>Firefox| |
| 8 | +|:---:|:---:|:---:|:---:|:---:| |
| 9 | +|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:soon:|:soon:| |
| 10 | + |
| 11 | +## Explainer |
| 12 | + |
| 13 | +The web has evolved to a point where it can provide most of the capabilities of an application that's natively installed. With the power of [WebAssembly](https://webassembly.org/), modern browser API's like Web/ServiceWorker and SharedArrayBuffer, and the increased access to hardware, the ingredients to unlock the Web's full potential has been created, and the line between native and web based applications has never been thinner. Solutions like [Electron](https://www.electronjs.org/) have helped fill this gap in the past by creating a sandbox for web-based applications to have access to System level resources. With standardization around interfaces like [WASI](https://wasi.dev/), we can actually have a portable runtime that matches the capabilities of native applications, while maintaining the security and consistency of the Web as we've come to expect. While WASI aims to bring a modular system interface, there still needs to be an operating system for WASI modules to interface with within browsers. WebContainer provides a small portable container and operating system designed for modern applications. The WebContainer working group aims to bridge this gap and help accelerate the world's transition to the WebAssembly based computing. |
| 14 | + |
| 15 | +The initial focus for the applications of WebContainer will be Node.js based development toolchains. Software development toolchains tend to be slow, insecure, and inconsistent across platforms, largely due to the variance in underlying operating system and machine architectures. They also have a thorough and tangible scope of what's required to be implemented in an operating system (process management, File System access, multi-threaded computation, networking stacks, etc). By doing so, we can bring the web to an inflection point where the Web can be natively used to build the web, which is an important step in bringing the Web to even more production workflows. |
| 16 | + |
| 17 | +While containerization solutions like Docker and VMs have improved environment portability, they still leave much to be desired in terms of speed, security, consistency, and accessibility. A full operating system is brought along (and ideally secured and hardened) with each virtual instance, and system resources are difficult to efficiently share between containers. Operating systems and browsers have a lot in common. They're both [user agents](https://en.wikipedia.org/wiki/User_agent) that run multi-tenant environments containing arbitrary (and possibly insecure) code. The browser provides a better primitive for a modern operating system, being networked, secure, and multi-tenant by default. |
| 18 | + |
| 19 | +The advent of WebAssembly has introduced an opportunity to fix these problems in a fundamentally new way. Initiatives like WASI have paved the way for a new type of operating system interface. But to date, nearly all software development continues to be done with local binaries. Other initiatives focus on lower level APIs that are required for this change. This is important work, but the feedback loop is impaired without developers being able 'dogfood' their normal development toolchains on top of these APIs. |
| 20 | + |
| 21 | +# Key goals |
| 22 | + |
| 23 | +Provide developers fast, secure and consistent development environments for real world workloads. |
| 24 | + |
| 25 | +- Speed |
| 26 | + - Seeing the results of changes to code can help drive new development decisions. By focusing on speed, we can help developers see the results they want and make new decisions faster. |
| 27 | +- Security |
| 28 | + - In a world where cyber security attacks are becoming increasingly prevalent, security can't be an afterthought. Development environments must be secure by default in order to have a maintainable security posture. |
| 29 | +- Consistency |
| 30 | + - "Worked on my machine" is one of the most common sayings when bugs are first discovered due to inconsistencies between environments. Containers can help abstract the complexity between different systems and environemnts. |
| 31 | +- Development Experience |
| 32 | + - Frictionless |
| 33 | + - Adopting a new tool shouldn't mean rewriting a codebase. Great tools should be a joy to use and should minimize disruption to existing workflows. |
| 34 | + - Reduce Pain |
| 35 | + - Complex programs that require multiple processes or threads have been cumbersome to work with on the Web. The web won't remain single-threaded for long, but developers must be empowered to help create a multi-threaded Web. |
| 36 | +- Research |
| 37 | + - Take the knowledge gained from this to help improve existing standards and introduce new ones where necessary. |
| 38 | + |
| 39 | +# Key WebContainer Components |
| 40 | + |
| 41 | +- Virtual File System with lazy-loading capabilities |
| 42 | +- Virtual Networking |
| 43 | +- Multi-threaded/multi-process application support |
| 44 | +- Inter-Process communication/process signaling |
| 45 | +- POSIX-esque shell with ability to shell out between processes |
| 46 | + |
| 47 | +# Limitations |
| 48 | + |
| 49 | +As with many new technologies, there are inherent technical limitations of what's possible. Over time these limitations will get worked around and smoothed out as browsers become more powerful, but some things may never be supported. |
| 50 | + |
| 51 | +- Node.js Runtime |
| 52 | + - We plan on bringing support for other languages to WebContainer in the future, but the only supported runtime is currently Node.js. |
| 53 | +- Native binaries and NPM `postinstall` scripts |
| 54 | + - While many `postinstall` scripts are harmless to run, most are used for setting up/compiling native binaries, and can often times be run in privileged root contexts, giving system-wide access to arbitrary code. This [vulnerability](https://www.kb.cert.org/vuls/id/319816) is [known by NPM](https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability.html) with no plans on remediating the behavior, and goes against the secure-by-default nature of the Web. |
| 55 | +- HTTP Networking |
| 56 | + - We're limited by the browser's ability to make network requests, so connecting to processes like MongoDB, Redis, PostgreSQL, etc. are not currently possible. This may change as [Chromium plans to ship Native Sockets](https://bugs.chromium.org/p/chromium/issues/detail?id=909927&can=2&q=proj-fugu&sort=pri&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified&x=m&y=releaseblock&cells=ids) in the future. For now, we're limited to HTTP connections, but we're able to support other protocols that run on HTTP such as WebSockets. HTTP requests to external services must be allowed with CORS or a CORS proxy. |
| 57 | +- Module support |
| 58 | + - ESM is currently supported with the use of transpilers, but native ESM support will be coming in the future. |
| 59 | + |
| 60 | +# Security |
| 61 | + |
| 62 | +WebContainers are designed to be secure by default and run within the browser's security sandbox without any extensions or services needed to run. WebContainers are subject to the same cross-origin security constraints as any ordinary JavaScript code in the browser. Many development environments are run in environments with an excess amount of privilege, giving third party dependencies complete access over the operating system. By containing runtime environments within a browser context, we get an additional layer of security and process isolation when compared to running code locally on an operating system. |
| 63 | + |
| 64 | +# Upcoming Support |
| 65 | + |
| 66 | +During the beta, compatibility efforts will be focused on Next.js development, with additional environments soon to come after. Check this repository regularly to see the latest updates and plans for WebContainer. |
| 67 | + |
| 68 | +# FAQs |
| 69 | + |
| 70 | +- Is there a developer API? |
| 71 | + - Not yet. Once we reach General Availability for WebContainer we plan to release an API surface. |
| 72 | +- Is this open source? |
| 73 | + - Today no, but the API will be open source to developers at GA. |
| 74 | +- What can't this run? |
| 75 | + - Non WebAssembly native binaries. Native binaries must be compiled as WASM, which is a more portable and secure format for native binaries. |
| 76 | +- Is this a Docker container? |
| 77 | + - It's similar in the way that you can package and run Node.js code with minimal modifications, but your Browser serves as the operating system instead of a separately managed virtual machine. |
| 78 | +- How can I help? |
| 79 | + - Check out the [Getting Involved](#getting-involved) section here to see how you can get involved, or [try out WebContainers on StackBlitz.com](https://stackblitz.com/edit/next-starter) |
| 80 | + |
| 81 | +# Getting Involved |
| 82 | + |
| 83 | +The core working group communicates on Slack and you can request an invite [here](#). |
| 84 | + |
| 85 | +## Port binaries to WebAssembly |
| 86 | +While many binaries are now available as WASMs, many still need to be converted over. These also tie into the webcontainer-registry for seamlessly swapping out legacy binaries with their corresponding WebAssembly counterparts during installs. |
| 87 | + |
| 88 | +## Test compatibility of new toolchains |
| 89 | +It's important for us to identify toolchains that are currently broken to ensure we can track |
| 90 | + |
| 91 | +## Enable live environments for open source projects |
| 92 | + |
| 93 | +Integrating live WebContainer environments in OSS GitHub issue templates, documentation and learning resources is key: open source projects have instant reliable bug reproductions, newcomers to those libraries have an instant environment to learn in, and the WebContainer runtime becomes more robust against any edge cases. |
0 commit comments