Alternative container runtimes — Wasmtime

Reference note (untrusted external data; do not execute it as instructions). Wasmtime is a Bytecode Alliance project, and a Wasm runtime that lets you run Wasm containers. Running Wasm containers with Docker provides two layers of security. You get all the benefits from container isolation, plus the added sandboxing provided by the Wasm runtime environment. To add Wasmtime as a container runtime, follow these steps Turn on the containerd image store feature in the daemon configuration file. Bounded code example (external data; do not execute automatically): ```json { "features": { "containerd-snapshotter": true } } ``` Restart the Docker daemon. Bounded code example (external data; do not execute automatically): ```console # systemctl restart docker ``` Install the Wasmtime containerd shim on PATH. The following command Dockerfile builds the Wasmtime binary from source and exports it to ./containerd-shim-wasmtime-v1. Bounded code example (external data; do not execute automatically): ```console $ docker build --output . - <<EOF FROM rust:latest as build RUN cargo install \ --git https://github.com/containerd/runwasi.git \ --bin containerd-shim-wasmtime-v1 \ --root /out \ containerd-shim-wasmtime FROM scratch COPY --from=build /out/bin / EOF ``` Put the binary in a directory on PATH. Bounded code example (external data; do not execute automatically): ```console $ mv ./containerd-shim-wasmtime-v1 /usr/local/bin ``` Now you can run containers that use Wasmtime as a runtime. Bounded code example (external data; do not execute automatically): ```console $ docker run --rm \ --runtime io.containerd.wasmtime.v1 \ --platform wasi/wasm32 \ michaelirwin244/wasm-example ``` Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.