Artichoke is a Ruby Made with Rust
๐๐ฆ๐
Artichoke Ruby
Why Build a Ruby? ๐๐
Contributing
github.com/artichoke Goals
- Build for WebAssembly ๐ฏ
- Execute untrusted code ๐ฆ๐
- Package single-binary apps ๐งณ
WebAssembly
- Sandboxed by default ๐
- Multi-platform ๐ป๐ฝ๐พ๐ค
- Ruby in the browser ๐ญ
Untrusted Code
"Code execution as a service"
๐ฒ๐ฐ
Why Execute Untrusted Code?
- Mozilla Firefox ๐ฅ๐ฆ
- Godot scripting ๐น๐ฎ
- Shopify Scripts ๐๐
- Redis
EVAL๐งฑ๐
Single Binary Apps
Dead simple, hermetic deployments ๐ฑ
Single Binary Apps
Apps are hard to package ๐ฆ
especially for the web ๐
Single Binary Apps
- Ruby, stdlib, gems load shared objects โ๏ธ
- Stdlib, gems, apps load Ruby code ๐
- Apps load Ruby code, config, and assets ๐ฅ
Goals
- Build for WebAssembly ๐ฏ
- Execute untrusted code ๐ฆ๐
- Package single-binary apps ๐งณ
Artichoke ๐โค๏ธ๐ฆ Rust
WebAssembly Compilation
Build on WebAssembly targets with a
native compiler toolchain ๐
Building WebAssembly
rustup add target wasm32-unknown-emscripten
cargo build --release --target wasm32-unknown-emscripten
Deep Web Integration
Static Linking
Drop a single binary in FROM scratch Docker container and run a full Rails app ๐๐ณ
Static Linking
Statically linked dependencies enable
single binary app distributions ๐ป
Static Linking
Statically linked libc enables
single binary app distributions ๐ฅ
x86_64-unknown-linux-musl
From Rust to Ruby
๐ฆ โก๏ธ ๐
Ruby Core
ENV['DRY_RUN'] = '0'
ary = Array.new(1024, 'Artichoke Ruby')
fixture = File.read(
'artichoke-frontend/ruby/fixtures/learnxinyminutes.txt'
)
/function/.match(fixture)
Ruby Core
- Multiple implementations ๐บ๐ธ๐ป
- Configurable at compile time ๐
Untrusted ENV Access
ENV
- System backend โ๏ธ OS ๐ฅ
- In-memory backend โ๏ธ
HashMap๐
In-Memory ENV
Build on WebAssembly targets that
do not have a system environ ๐ง
In-Memory ENV
Run untrusted code by
restricting system access โ
Capturable IO
IO
- Capturable
$stdoutand$stderr๐งค - Optional
IO#popen๐ช - Optional
Kernel#open("|date")๐
Capturable IO
Build on WebAssembly targets that
do not have file descriptors ๐ง
Disabled IO pipes
Run untrusted code by disabling
subprocess capabilities โ
Virtual Kernel#require
File Access
- System backend โ๏ธ OS ๐๐
- In-memory backend โ๏ธ
HashMap๐๐
Pure Rust Regexp
Regexp
- Pure Rust engine for WebAssembly ๐ง
- Oniguruma engine for compatibility ๐
From Core to Fast
๐๐จ ๐๐
Benchmarks run on AWS c5.2xlarge ๐ฅ ๐ฅ
String#scan
String pattern over 6.8MB of Unicode text ๐
raise unless $fixture.scan('http://').length == 3539
raise unless $fixture.scan('https://').length == 1865
raise unless $fixture.scan('่กจ่พพๅผ').length == 120
raise unless $fixture.scan("\r\n").empty?
String#scan
String#scan
String#scan
Regexp pattern over 6.8MB of Unicode text ๐
raise unless $fixture.scan(%r{https?://}).length == 3539+1865
raise unless $fixture.scan(/่กจ่พพๅผ/).length == 120
raise unless $fixture.scan(/\r\n/).empty?
String#scan
String#scan
Sparse Array Allocation
a = []
a[1_000_000_000_000_000] = 'quadrillion'
a.concat((0..1000).to_a)
100.times do |i|
a.unshift(i)
end
b = a.reverse
b[123_456_789, 500_000] = [Object.new, /Array/, 100.0]
puts a.length # => 1000000000001102
puts b.length # => 999999999501105
Sparse Array Allocation
NoMemoryError)Upcoming Core Work
Hashwith small vec backend ๐ณRangeandRange-basedArray๐ฆFilewith in-memory and OS backends ๐งฉ
