search

laverdet / isolated-vm

Secure & isolated JS environments for nodejs
ISC License
2.19k stars 154 forks source link

Prebuild images also for arm64 #502

Closed orgads closed 3 weeks ago

laverdet commented 3 weeks ago

Thanks.

I'm not sure if you saw but I've been working on a from-scratch rewrite of isolated-vm over here https://github.com/laverdet/isolated-vm/tree/experimental

The big feature is that v8 is directly compiled into isolated-vm, so the version of isolated-vm isn't directly tied to the nodejs version anymore. I also had to completely rework the build pipeline since building v8 can be challenging in the Github environment.

There's not really much to show right now but I have some good architectural progress.

orgads commented 3 weeks ago

What's the binary size when you build v8? Aren't there pre-built binary packages of v8 that can be used?

laverdet commented 3 weeks ago

The size isn't terrible. The new isolated-vm binary is 55mb on Linux right now. I don't have the size of other platforms available but should be comparable.

As for pre-built v8 binaries, I think some Linux distributions have v8 packages but the version will not be reliable. The exact version is important. It's not a big deal because I already went through the saga of getting it to build cross-platform on GitHub actions. It's cached between builds as well, though failing for the macOS runner right now.

Regardless we need to compile our own version because I have a critical patch to the v8 sources https://github.com/laverdet/isolated-vm/blob/experimental/patches/00.trickshot.patch. This is important because it lets you run two versions of v8 in the same process simultaneously which is otherwise impossible. In this model isolated-vm will have complete control over the v8 integration, whereas today we have to go through node's abstractions and delegations.

It will also be a pretty significant shift in functionality. I think a lot of users are confused about, for example, setTimeout, XMLHttpRequest, fetch, etc. I'll be providing a means to opt-in to more WinterCG features so it would be more of a "works out of the box" solution instead of "batteries not included".

orgads commented 3 weeks ago

Sounds great! Thanks for working on this.

orgads commented 3 weeks ago

Wait 55Mb compared to current ~400Kb?

laverdet commented 3 weeks ago

Yeah v8 is big. In the grand scheme of things 55mb isn't that much in my opinion. And I also believe that the current approach of using node's v8 will continue to run into problems since v8 is aggressive about sharing resources. Especially with snapshots the current implementation isn't good anymore.

orgads commented 3 weeks ago

This is significantly larger than 99.99% of packages. For our purposes, the current implementation works well, and I’d prefer not to increase my image size by 50 MB.

Maybe consider moving the rewrite to a new package instead of reusing the existing name?