Pony — Capabilities-Secure Actor-Model Language for High-Performance Systems

Introduction

Pony is a compiled, actor-model programming language designed for writing concurrent software that is provably free of data races. Its reference capability system enforces safe sharing of data at compile time, eliminating an entire class of concurrency bugs without sacrificing performance.

What Pony Does

• Guarantees data-race freedom through compile-time reference capabilities
• Uses an actor-model concurrency system with zero-copy message passing
• Compiles to native code via LLVM for high-performance execution
• Provides a per-actor garbage collector with no stop-the-world pauses
• Supports structural and nominal typing with generics and union types

Architecture Overview

Pony compiles source code to LLVM IR, producing optimized native binaries. The runtime schedules actors across a fixed pool of OS threads using a work-stealing scheduler. Each actor has its own heap and garbage collector, so GC pauses affect only one actor at a time. The reference capability system (iso, val, ref, box, tag, trn) is checked entirely at compile time.

Self-Hosting & Configuration

• Install via system packages for Ubuntu/Debian, Homebrew on macOS, or build from source
• Compile projects with ponyc pointing at the source directory
• Manage dependencies with corral, the Pony package manager
• No configuration files required; all options are compiler flags
• Link C libraries using Pony's FFI mechanism

Key Features

• Compile-time data-race freedom without locks or mutexes
• Six reference capabilities (iso, val, ref, box, tag, trn) for fine-grained aliasing control
• Zero-copy message passing between actors when types allow
• Per-actor garbage collection with no global pauses
• LLVM backend producing competitive native performance

Comparison with Similar Tools

• Erlang — Erlang copies data between processes; Pony can zero-copy when capabilities allow, with stronger compile-time safety
• Rust — Rust uses ownership and borrowing; Pony uses reference capabilities with a focus on actor concurrency
• Go — Go's goroutines share memory and can race; Pony prevents races at the type level
• Akka (Scala) — Akka actors run on the JVM with GC pauses; Pony has per-actor GC and compiles to native code
• Swift — Swift adds actor isolation in later versions; Pony was designed around actors from the start

FAQ

Q: What are reference capabilities? A: They are annotations (iso, val, ref, etc.) on types that tell the compiler how data can be shared or aliased, ensuring data-race freedom without runtime checks.

Q: Is Pony production-ready? A: Pony is used in production at Wallaroo Labs for stream processing. The language is stable but has a smaller community than mainstream languages.

Q: Does Pony have a garbage collector? A: Yes, but each actor has its own GC. There is no global stop-the-world pause, so latency remains predictable.

Q: Can Pony call C libraries? A: Yes. Pony has a built-in FFI for calling C functions, though FFI code is outside the safety guarantees of the type system.

Sources

• https://github.com/ponylang/ponyc
• https://www.ponylang.io/discover/