Extism — Universal WebAssembly Plugin Framework

Introduction

Extism is a framework for building plugin systems powered by WebAssembly. It lets developers write plugins in languages like Rust, Go, C, JavaScript, or Python, compile them to Wasm, and load them into host applications written in any of 15+ supported languages. The Wasm sandbox provides security isolation without the complexity of containers or processes.

What Extism Does

• Provides SDKs for embedding Wasm plugins in 15+ host languages (Go, Rust, Python, Node.js, Ruby, Java, C#, etc.)
• Offers Plugin Development Kits (PDKs) for writing plugins in Rust, Go, C, JavaScript, Haskell, and more
• Manages plugin lifecycle: loading, calling functions, passing data, and cleanup
• Enforces memory safety and sandboxing through the Wasm security model
• Supports host functions so plugins can call back into the host application

Architecture Overview

Extism consists of two sides: Host SDKs and Plugin PDKs. The Host SDK embeds a Wasm runtime (based on Wasmtime) and provides a high-level API for loading and calling plugin functions. The PDK provides language-specific helpers for plugin authors to read inputs, write outputs, and access host functions. Data passes between host and plugin through a shared memory protocol. Plugins run in isolated Wasm sandboxes with no filesystem or network access unless explicitly granted by the host.

Self-Hosting & Configuration

• Install the Extism SDK for your host language via its package manager
• Use the CLI or PDK to scaffold and build plugins in your preferred language
• Load compiled Wasm plugins at runtime from the filesystem or over HTTP
• Configure plugin memory limits and allowed host functions per plugin
• No runtime server required; everything runs in-process

Key Features

• Write-once plugins run in any host language without recompilation
• Security by default: Wasm sandboxing prevents plugins from accessing host resources
• High-level SDKs abstract away low-level Wasm memory management
• Host function system enables controlled plugin-to-host communication
• Active ecosystem with official SDKs for Go, Rust, Python, Node.js, Ruby, Java, PHP, and more

Comparison with Similar Tools

• wazero/Wasmtime — raw Wasm runtimes vs. higher-level plugin framework with cross-language SDKs
• Spin (Fermyon) — serverless platform vs. embeddable plugin system for any application
• Lua/Luau — scripting language embedding vs. any-language plugin system via Wasm
• gRPC plugins (HashiCorp) — process-based plugins over RPC vs. in-process Wasm sandboxed plugins

FAQ

Q: Which languages can I write plugins in? A: Officially supported PDKs exist for Rust, Go, C, JavaScript, Python, Haskell, AssemblyScript, and Zig. Any language that compiles to Wasm can work.

Q: How does data pass between host and plugin? A: Extism uses a shared memory protocol. The host writes input to plugin memory before calling a function, and the plugin writes output to the same memory space.

Q: What is the performance overhead? A: Wasm execution is near-native speed. The overhead comes primarily from data serialization and the Wasm sandbox boundary, which is minimal for most use cases.

Q: Can plugins access the network or filesystem? A: Not by default. The host must explicitly provide access through host functions, maintaining the security-by-default design.

Sources

• https://github.com/extism/extism
• https://extism.org/