boxlang-runtime-wasm-container — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited boxlang-runtime-wasm-container (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MatchBox can compile BoxLang source to WebAssembly (WASM) for server-side execution. WASM containers run without a JVM and are sandboxed by design, making them ideal for edge deployments, FaaS, and microservices in minimal OCI containers.
This skill covers server-side WASM (Wasmtime, WasmEdge, OCI containers). For browser/Node.js WASM, see the wasm-in-the-browser skill.# Compile to .wasm
matchbox --target wasm my_service.bxs
# Output: my_service.wasm# Install Wasmtime
curl https://wasmtime.dev/install.sh -sSf | bash
# Run the WASM module
wasmtime my_service.wasm
# With filesystem access (needed for file I/O)
wasmtime --dir=. my_service.wasm
# With network access (experimental WASI sockets)
wasmtime --wasi-modules=experimental-wasi-sockets my_service.wasm
# Pass CLI arguments
wasmtime my_service.wasm -- --input=data.json --debug# Install WasmEdge
curl -sSf https://raw.githubusercontent.com/WasmEdge/WasmEdge/master/utils/install.sh | bash
# Run
wasmedge my_service.wasm
# With WASI filesystem
wasmedge --dir=. my_service.wasmBuild a Docker image containing only the WASM binary — results in an extremely small image:
# Multi-stage: compile with MatchBox, package as WASM container
FROM ghcr.io/ortus-boxlang/matchbox:latest AS builder
WORKDIR /build
COPY my_service.bxs .
RUN matchbox --target wasm my_service.bxs
# Final image: scratch + WASM binary only
FROM scratch
COPY --from=builder /build/my_service.wasm /app.wasm
ENTRYPOINT ["/app.wasm"]Run with a WASM-capable container runtime (e.g., containerd + WasmEdge shim):
docker run --runtime=io.containerd.wasmedge.v1 myimage:latestWASM modules are sandboxed by default. Grant capabilities explicitly:
| Wasmtime Flag | Capability |
|---|---|
--dir=. | Filesystem access (current dir) |
--dir=/data | Filesystem access (specific dir) |
--env KEY=VALUE | Environment variables |
--wasi-modules=experimental-wasi-sockets | Network socket access |
# Full capability example
wasmtime \
--dir=/var/data \
--env DATABASE_URL=... \
--wasi-modules=experimental-wasi-sockets \
my_service.wasmMatchBox WASM output targets WASI and can run on edge platforms:
fastly compute build --source my_service.wasm
fastly compute deploy# Use Cloudflare's WASM worker with WASI support
wrangler deploy --compatibility-flags=nodejs_compat| Scenario | Why WASM |
|---|---|
| Serverless/FaaS | Near-zero cold start, no JVM |
| Edge computing | Runs close to users, sandboxed |
| Microservices | FROM scratch images < 1MB |
| Multi-tenant SaaS | Strong WASM sandboxing per tenant |
| Plugin systems | Load and unload WASM modules at runtime |
--target wasm | --target native | |
|---|---|---|
| Portable | ✅ Any WASM runtime | ❌ Single platform |
| Sandboxed | ✅ WASI sandbox | ❌ Full OS access |
| Cold start | < 10ms | < 5ms |
| File/network | Explicit grants | Full OS |
| Edge platforms | ✅ Fastly, CF Workers | ❌ |
| Docker image | FROM scratch + runtime shim | FROM scratch only |
matchbox --target wasm service.bxs to produce the .wasm filewasmtime --dir=. service.wasm before deploying--dir, --env, sockets)FROM scratch OCI images for minimal container footprint~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.