Community Calls

October 28, 2026

Agenda

• v2.11.0 shipped (Oct 20) The release blog post and the docs version bump are live.
  • Highlights:
    • Guest memory and socket egress are now enforced by default (breaking).
    • hostPath volumes are now gated.
    • Plugins can override WASI builtin interfaces.
    • You can now attach native host control to a running host.
    • New pool sizing and a max-process-memory limit.
    • OCI pulls now share clients and coalesce duplicate pulls.
    • Added k6 benchmarking.
• Welcome to first-time contributor @angyaljanos, who validated connection quotas (#5661).
• 🔐 NATS authentication and credentials (since 2.11)
  • The host can authenticate to NATS separately for each connection, with tokens and passwords read from files (#5733, #5742).
  • Operator: new NATS client auth flags, a connection name and inbox prefixes (#5735).
  • Credential rotation (#5755):
    • wasmcloud:nats re-reads credentials on every connect.
    • New JWT-as-token mode, for auth callout on servers without trusted operators.
    • Embedders can reuse the host's NATS auth on their own connections.
    • Operator liveness now fails if NATS keeps refusing the credential after a grace period.
  • A host ID can be assigned before connecting (#5734).
  • The host can shut down even while a NATS secret read is stalled (#5741).
  • For embedders: NatsConnectionOptions and NatsAuth are now #[non_exhaustive].
• 📨 wasmcloud:nats@0.1.3: JetStream and KV (#5751)
  • Read the last message on a subject, read with timestamps, and see stream creation and stored times.
  • Purge by subject (optionally keeping some messages) and delete by sequence. Both sit behind a new stream-delete-allow grant, which denies by default.
  • KV create-with-ttl (expiring leases) and delete-by-revision (conditional release).
• ⚡ Performance and density
  • Fixed the v2.11 service-bench regression (about 9%) (#5737). It was caused by a scheduling change in wasmtime 48.0.6. p3 HTTP response bodies now go straight to hyper instead of being relayed frame by frame.
  • Better pool sizing (#5745):
    • New --max-memories and --total-core-instances flags.
    • Pool totals now follow the memory count, so the core-instance limit no longer runs out at a quarter of the memories reserved.
    • Messaging admission now reserves real pool resources. Before, a stock host admitted only 133 in-flight messages against a pool sized for 1000 instances.
  • A host density benchmark (scale_density) now runs in CI (#5708, #5739). Its results are published on arewefastyet.
  • On cgroup v1 hosts with no memory limit, the detected limit came out at about 8 EiB. It is now capped at RAM plus swap (#5710).
• 🛠️ Fixes and hardening
  • Values above the semaphore capacity are refused instead of crashing the host. This covers the NATS max-in-flight and subscription-capacity settings and the ingress and start limits (#5718).
  • Plugin-served WASI overrides that aren't supported are refused when the plugin registers (#5721).
  • Community: wasmcloud:postgres refuses a parameter whose type doesn't match, from Srinivas Chippagiri (#5732).
  • Community: corrected the reclaim_min_instances docs (it disables reclaim), from Shreya Deshannavar (#5569, #5731).
  • OpenTelemetry HTTP span names now match each other (#5579).
  • Dependency security fixes: zstd-sys (RUSTSEC-2026-0410) and ctutils. wasi-gfx 0.3.1 now comes from crates.io instead of a git patch.
• 🏛️ Project health, security and governance
  • THREAT_MODEL.md covers trust boundaries, security goals, the settings that weaken them, and what counts as a vulnerability.
  • New Security Insights file.
  • The OSPS Baseline scan now runs on main (#5761).
  • cargo-deny license checks in CI (#5722). Four CNCF license-exception requests are open (cncf/foundation#1580–1583).
  • New bug reporting guide and issue template (#5760). ADOPTERS.md is restored (#5759).
  • Org cleanup: archive notices were added to about 20 legacy repos, including weld, wadm-operator, wasmcloud-js, provider-sdk-go and wasmcloud-test.
  • Meeting pages for Oct 14 and Oct 21 are now on wasmcloud.com.
• In flight and open for discussion
  • Feature request: DaemonSet-style placement, which runs a workload on every host in a host group (#5730). Community input wanted.
  • Workload start throughput (from Aditya Salunkhe and Liam Randall):
  • Finer memory pool controls: #5763, plus a configurable linear-memory reservation and guard (#5738).
  • Community: the NATS blobstore should treat deleted objects as absent (#5726).
  • Workload annotations exposed to component plugins (#5750, draft).
  • Security self-assessment (#5762, draft).
  • wasmcloud:postgres follow-up for string and byte parameters (#5747).
  • Creating Host Component Plugins that can source secrets

wasmCloud 2.11: Wasm Runtime Autoscaling at 42,000 Workloads per Core, and TypeScript via Perry

The October 21, 2026 wasmCloud community call came the day after the wasmCloud 2.11 release, which turns its policy enforcement points to deny by default. Victor Adossi showed that a single pinned CPU core and a 512 MiB memory budget now hold 4,000 warm or 42,000 scale-to-zero HTTP components. These numbers are the kind of evidence that wasm runtime autoscaling depends on. He then demonstrated JCO running TypeScript compiled to a kilobyte-sized WebAssembly component by Perry, with no JavaScript engine inside.

Deny-by-Default Hosts, a Rust WebAssembly Toolchain Trap, and a RISC-V Sandbox

On the October 14, 2026 wasmCloud community call, Bailey Hayes warned that the next host release turns its newest policy controls (guest memory, socket egress, and hostPath volumes) to deny by default. She also explained a Rust WebAssembly guest-toolchain bug that makes some WASI P3 components trap on Wasmtime 48. Aditya Salunkhe then proposed a host component plugin that gives every workload its own RISC-V Linux sandbox, and the call turned into a discussion of why open standards win.

wasmCloud Q4 Roadmap: Python SDK, Wasm vs. Containers, AI Policy

The October 7, 2026 wasmCloud community call was the Q4 planning session. Bailey Hayes named three big rocks for the quarter: a Python SDK, workload identity, and an expanded k6 suite that benchmarks WebAssembly on Kubernetes against the same app in containers and microVMs. The second half became a long discussion with Aditya Salunkhe, Yordis Prieto, and Frank Schaffa about AI-assisted contributions. It ended with a fourth rock: a permissive, written AI policy and agent stack for the project.

wasmCloud Q4 Roadmap: Python, Workload Identity, Wasm Components

The September 30, 2026 wasmCloud community call was the last of Q3 and a preview of the Q4 roadmap before next week's collaborative planning session. Bailey Hayes walked through the draft in discussion #5619. It has four themes: the wasm component model ecosystem (a Python SDK is the likely next language), performance (a customizable precompiled-component cache, exploded components that deduplicate language runtimes, and k6 load tests), integration (S3 for WASI Blobstore and declarative storage grants), and workload identity with credential brokering, which she called the quarter's biggest rock. Jeremy Fleitz showed a k6 load-test harness that has already found a local-routing bug.