Kraton Engine / source code

Constraint is the runtime's primary feature.

Kraton Engine is the local execution layer: Rust and Wasmtime run WebAssembly Components behind policy boundaries that are explicit, narrow, and observable.

Run a local host Implementation status

Architecture at a glance

A request moves through gates, not assumptions.

The runtime separates serving, verification, policy, execution, and accounting so a fast call never has to become an implicit grant of authority.

HTTP / gRPC
    │
    ▼
[ Gateway ] ──► [ verified cache ] ──► [ policy + EnginePair ] ──► [ encrypted receipt ledger ]
                        │                         │                         │
                 bundle + AOT              fuel / epoch tier         Merkle checkpoint
                 metadata + signature       deny-all WASI             host Ed25519

Gateway

HTTP and gRPC share admission control, bounded queues, and overload signals.

Verified cache

The host reads the signed bundle, metadata, and AOT compatibility markers before it becomes ready.

Policy + EnginePair

One path accounts with fuel; an epoch tier measures thread CPU time. Capability linking stays narrow.

Receipt ledger

Encrypted RocksDB records facts, then Merkle checkpoints are signed by the host identity.

Operating envelope

Technical facts with their conditions attached.

Engine: Rust + Wasmtime 46
Component model: WASI Preview 2 / WIT
Default memory ceiling: 128 MiB per invocation

Default wall-clock budget: 30 seconds
Pool context start: ~2.5–8 µs
Measured composed fixture: ~8.3 µs / 3,844 fuel

Operator detail

Large pools consume virtual-memory maps.

Each reserved memory slot holds mappings for its guard pages and copy-on-write image. At startup the host estimates the Linux VMA requirement; a large pool can exceed the default vm.max_map_count of 65,530.

When the host warns about its VMA budget

This is an operating-system setting for a suitably sized pool, not a requirement for every local demo. The engine surfaces the condition instead of silently betting on host memory.

Local host

Run the boundary you can inspect.

The checked-in development configuration starts the Engine from source. Use the demos to exercise its contracts once the local host is running.

From the Engine source root

Explore a concrete use case

What the host enforces

Useful power, with a perimeter.

Deny by default

A component begins without host filesystem, raw network, environment, clock, or random access. Every useful authority is a separately declared policy decision.

Measure facts, not fees

Fuel, thread CPU time, and input/output bytes become consumption facts. Price policy belongs outside the runtime, not inside the execution path.

Async without an escape hatch

HTTP-capable components suspend an async fiber rather than occupying an OS thread. A signed allowlist and DNS-pinned connection close the SSRF escape route.