Kyushu: A Self-Hostable WASM Sandbox for JavaScript Workers

Kyushu provides a lightweight, self-hostable alternative to Cloudflare Workers, allowing developers to run JavaScript and TypeScript handlers as isolated WebAssembly (WASM) binaries. By eliminating the dependency on heavy runtimes like Node.js, Bun, or Docker, Kyushu enables the deployment of serverless-style handlers on a VPS or any environment where a single binary can be executed.

Core Functionality and Deployment

Kyushu is distributed as a CLI tool that simplifies the build and execution process. Developers write a handler in JavaScript or TypeScript, which Kyushu compiles into a self-contained WASM binary. This binary is then executed using the kyu command.

Key technical characteristics include:

• Runtime Independence: The system operates without requiring Node.js, Bun, or Docker on the host machine.
• API Compatibility: It utilizes a Cloudflare Workers-style fetch handler API, making the transition for developers familiar with edge computing patterns familiar.
• Isolation: Each handler is executed within a WebAssembly sandbox, ensuring the code is isolated from the host system.
• Self-Hosting: The system is designed for deployment on virtual private servers (VPS) or other lightweight environments.

Use Cases and Technical Trade-offs

Kyushu's architecture is particularly suited for edge functions and plugin systems where minimal overhead and high isolation are required. Users in the community discussion highlighted the potential for easier local testing by compiling code down to a single binary.

While the community expressed interest in the performance characteristics—specifically how startup latency compares to V8 isolates used by Cloudflare Workers—the source material does not provide specific benchmarks. However, the general goal is to a provide a low-overhead alternative to the rest of the web stack.

Community Perspectives on Isolation

Industry practitioners have noted that Kyushu represents a choice in the virtualization and isolation spectrum. As one contributor noted:

"I still believe something like this should succeed and give people choice when it comes to isolation/virtualization (containers, microVMs, Wasm). They are each useful and appropriate for different things."

Other discussions touched upon the browser-side sandbox isolation levels, comparing the possibility of running a worker within a WASM module that in turn runs a JavaScript implementation (such as QuickJS) to execute passed code. This suggests that Kyushu's approach of compiling to WASM for execution via the kyu command provides a a streamlined path to achieving this isolation without the rest of the traditional JavaScript runtime ecosystem.