wasmtime: read config from env variable TOML

Cargo.toml

@@ -51,9 +51,11 @@ hyper = "1.6.0"
 tokio = { version = "1.45.1", default-features = false }
 tokio-util = { version = "0.7", default-features = false }
 cfg-if = "1.0"
+toml = "0.8"
 
 # wasmtime
-wasmtime = { version = "36.0.6", features = ["async"] }
+wasmtime = { version = "36.0.6", features = ["async", "gc"] }
+wasmtime-cli-flags = { version = "36.0.6", features = ["component-model", "gc", "parallel-compilation", "pooling-allocator"] }
 wasmtime-wasi = { version = "36.0.6" }
 wasmtime-wasi-http = { version = "36.0.6" }
 

crates/containerd-shim-wasm/src/containerd/client.rs

@@ -394,6 +394,7 @@ impl Client {
         engine_name: impl AsRef<str> + Debug,
         supported_layer_types: &[&str],
         compiler: Option<&impl Compiler>,
+        envs: &[String],
     ) -> Result<Vec<WasmLayer>> {
         let container = self.get_container(containerd_id).await?;
         let (manifest, image_digest) = self.get_image_manifest_and_digest(&container.image).await?;
@@ -435,7 +436,7 @@ impl Client {
             return Ok(layers);
         };
 
-        let precompile_id = precompile_label(engine_name.as_ref(), compiler.cache_key());
+        let precompile_id = precompile_label(engine_name.as_ref(), compiler.cache_key(envs));
 
         let image_info = self.get_info(&image_digest).await?;
         let mut needs_precompile = !image_info.labels.contains_key(&precompile_id);
@@ -459,7 +460,7 @@ impl Client {
 
         if needs_precompile {
             log::info!("precompiling layers for image: {}", container.image);
-            let compiled_layers = match compiler.compile(&layers).await {
+            let compiled_layers = match compiler.compile(&layers, envs).await {
                 Ok(compiled_layers) => {
                     if compiled_layers.len() != layers.len() {
                         return Err(ShimError::FailedPrecondition(
@@ -695,6 +696,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 NO_COMPILER.as_ref(),
+                &[],
             )
             .await
             .unwrap();
@@ -723,6 +725,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -735,6 +738,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -764,6 +768,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -776,6 +781,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -796,14 +802,15 @@ mod tests {
         let fake_precompiled_bytes = generate_content("precompiled", WASM_LAYER_MEDIA_TYPE);
         let mut engine = FakePrecomipler::new();
         engine.add_precompiled_bits(fake_bytes.bytes.clone(), &fake_precompiled_bytes);
-        let expected_id = precompile_label("fake", engine.cache_key());
+        let expected_id = precompile_label("fake", engine.cache_key(&[]));
 
         let layers = client
             .load_modules(
                 container_name,
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -848,6 +855,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE, "textfile"],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -880,6 +888,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -914,6 +923,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -943,6 +953,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -962,6 +973,7 @@ mod tests {
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -991,14 +1003,15 @@ mod tests {
         engine.add_precompiled_bits(fake_bytes.bytes.clone(), &fake_precompiled_bytes);
         engine.add_precompiled_bits(fake_bytes2.bytes.clone(), &fake_precompiled_bytes2);
 
-        let expected_id = precompile_label("fake", engine.cache_key());
+        let expected_id = precompile_label("fake", engine.cache_key(&[]));
 
         let layers = client
             .load_modules(
                 container_name,
                 "fake",
                 &[WASM_LAYER_MEDIA_TYPE],
                 Some(&engine),
+                &[],
             )
             .await
             .unwrap();
@@ -1097,11 +1110,15 @@ mod tests {
     }
 
     impl Compiler for FakePrecomipler {
-        fn cache_key(&self) -> impl Hash {
+        fn cache_key(&self, _envs: &[String]) -> impl Hash {
             self.precompile_id.clone()
         }
 
-        async fn compile(&self, layers: &[WasmLayer]) -> anyhow::Result<Vec<Option<Vec<u8>>>> {
+        async fn compile(
+            &self,
+            layers: &[WasmLayer],
+            _envs: &[String],
+        ) -> anyhow::Result<Vec<Option<Vec<u8>>>> {
             self.layers_compiled_per_call.store(0, Ordering::SeqCst);
             self.precompile_called.fetch_add(1, Ordering::SeqCst);
             let mut compiled_layers = vec![];

crates/containerd-shim-wasm/src/shim/shim.rs

@@ -55,15 +55,19 @@ pub trait Compiler: Sync {
     ///
     /// This hash will be used in the following way:
     /// "runwasi.io/precompiled/<Shim::name()>/<cache_key>"
-    fn cache_key(&self) -> impl Hash;
+    fn cache_key(&self, _envs: &[String]) -> impl Hash;
 
     /// `compile` passes supported OCI layers to engine for compilation.
     /// This is used to precompile the layers before they are run.
     /// It is called only the first time a module is run and the resulting bytes will be cached in the containerd content store.
     /// The cached, precompiled layers will be reloaded on subsequent runs.
     /// The runtime is expected to return the same number of layers passed in, if the layer cannot be precompiled it should return `None` for that layer.
     /// In some edge cases it is possible that the layers may already be precompiled and None should be returned in this case.
-    async fn compile(&self, _layers: &[WasmLayer]) -> Result<Vec<Option<Vec<u8>>>>;
+    async fn compile(
+        &self,
+        _layers: &[WasmLayer],
+        _envs: &[String],
+    ) -> Result<Vec<Option<Vec<u8>>>>;
 }
 
 /// Like the unstable never type, this type can never be constructed.
@@ -78,11 +82,15 @@ pub enum NoCompiler {}
 pub const NO_COMPILER: Option<NoCompiler> = None;
 
 impl Compiler for NoCompiler {
-    fn cache_key(&self) -> impl Hash {
+    fn cache_key(&self, _envs: &[String]) -> impl Hash {
         unreachable!()
     }
 
-    async fn compile(&self, _layers: &[WasmLayer]) -> anyhow::Result<Vec<Option<Vec<u8>>>> {
+    async fn compile(
+        &self,
+        _layers: &[WasmLayer],
+        _envs: &[String],
+    ) -> anyhow::Result<Vec<Option<Vec<u8>>>> {
         unreachable!()
     }
 }

crates/containerd-shim-wasm/src/sys/unix/container/instance.rs

@@ -29,7 +29,8 @@ pub struct Instance<S: Shim> {
 
 #[async_trait]
 trait OciClient {
-    async fn load_modules(&self, id: &str) -> Result<Vec<WasmLayer>, SandboxError>;
+    async fn load_modules(&self, id: &str, envs: &[String])
+    -> Result<Vec<WasmLayer>, SandboxError>;
 }
 
 struct EngineOciClient<P: Compiler> {
@@ -41,13 +42,18 @@ struct EngineOciClient<P: Compiler> {
 
 #[async_trait]
 impl<P: Compiler> OciClient for EngineOciClient<P> {
-    async fn load_modules(&self, id: &str) -> Result<Vec<WasmLayer>, SandboxError> {
+    async fn load_modules(
+        &self,
+        id: &str,
+        envs: &[String],
+    ) -> Result<Vec<WasmLayer>, SandboxError> {
         self.client
             .load_modules(
                 id,
                 self.name,
                 self.supported_layer_types,
                 self.precompiler.as_ref(),
+                envs,
             )
             .await
     }
@@ -74,9 +80,22 @@ impl<S: Shim> SandboxInstance for Instance<S> {
             })
             .await?;
 
+        // Precompile runs before `RuntimeContext` exists, so read workload env
+        // from the OCI runtime-spec bundle (`<bundle>/config.json`), specifically
+        // the `process.env` field:
+        // https://github.com/opencontainers/runtime-spec/blob/6f7b71c2d216403715f7364ac88dec88d9da989c/config.md#process
+        let source_spec_path = cfg.bundle.join("config.json");
+        let spec = Spec::load(&source_spec_path)?;
+        let envs = spec
+            .process()
+            .as_ref()
+            .and_then(|p| p.env().as_ref())
+            .map(Vec::as_slice)
+            .unwrap_or_default();
+
         // check if container is OCI image with wasm layers and attempt to read the module
         let modules = oci_client
-            .load_modules(&id)
+            .load_modules(&id, envs)
             .await
             .unwrap_or_else(|e| {
                 log::warn!("Error obtaining wasm layers for container {id}.  Will attempt to use files inside container image. Error: {e}");

crates/containerd-shim-wasmtime/Cargo.toml

@@ -11,8 +11,10 @@ log = { workspace = true }
 hyper = { workspace = true }
 tokio = { workspace = true, features = ["signal", "macros"] }
 tokio-util = { workspace = true, features = ["rt"] }
+toml = { workspace = true }
 
 wasmtime = { workspace = true }
+wasmtime-cli-flags = { workspace = true }
 wasmtime-wasi = { workspace = true }
 wasmtime-wasi-http = { workspace = true }