How Switching Higress Wasm Runtime from V8 to WAMR Boosts Plugin Performance

Higress replaced its Wasm runtime V8 with the WebAssembly Micro Runtime (WAMR) and enabled AOT compilation, achieving roughly 50% average latency reduction for most plugins and up to 100% for complex plugins.

Why Wasm Plugins are Important

Engineering reliability: Plugins are compiled from statically typed languages, allowing compile‑time checks and preventing runtime crashes.

Sandbox security: Each plugin runs in an isolated VM with its own memory, protecting the gateway from buffer overflows and remote code execution.

Hot updates: Using Envoy’s xDS mechanism, both the binary and configuration of a plugin can be reloaded without breaking existing connections.

Higress Extensions to the Wasm Model

Domain/route‑level activation for fine‑grained control.

Redis host functions enabling rate‑limiting, session state, etc.

VM self‑healing: runtime catches null‑pointer, out‑of‑bounds and memory‑leak errors, restarts the module and reports stack traces.

Limitations of V8 for Server‑Side Wasm

V8 was designed for browsers and tightly couples Wasm execution with JavaScript handling. This results in high project complexity, limited community collaboration for Envoy, and an optimization focus on JIT rather than AOT, which hampers server‑side performance.

Advantages of WAMR

WAMR is an open‑source runtime from the Bytecode Alliance, written in C, with a footprint as low as 100 KB. It supports interpreter, JIT and AOT modes, offers strong platform portability, and is maintained by contributors from Intel, Xiaomi, Amazon, Sony, Siemens and others.

Benchmark Overview

Tests were run with k6 on two Higress workers on an Intel Xeon Platinum 8369B. Average added latency per request (ms) for each plugin is:

bot-detect: V8 1.25 → WAMR 0.64 (95% improvement)

hmac-auth: V8 4.44 → WAMR 3.25 (36% improvement)

jwt-auth: V8 11.98 → WAMR 7.46 (60% improvement)

jwt-logout (proprietary): V8 14.08 → WAMR 8.44 (66% improvement)

key-auth: V8 1.66 → WAMR 1.16 (43% improvement)

oauth: V8 10.15 → WAMR 4.75 (113% improvement)

All open‑source plugins are located at

https://github.com/alibaba/higress/tree/main/plugins/wasm-cpp/extensions

.

Building AOT Plugins

wamrc --invoke-c-api-import -o plugin.aot plugin.wasm

To keep compatibility with JIT mode, merge the AOT file back into the Wasm binary:

python3 wasm-micro-runtime/test-tools/append-aot-to-wasm/append_aot_to_wasm.py \
    --aot plugin.aot --wasm plugin.wasm -o plugin.aot.wasm

Running a Performance Test (example: oauth plugin)

k6 run --vus 300 ./script.js --duration 60s

A minimal k6 script imports http and sends a GET request with an Authorization header. The corresponding Envoy filter configuration uses envoy.wasm.runtime.wamr and points to the compiled oauth.aot.wasm file.

Reasons for Performance Gains

Deep AOT optimization: WAMR translates Wasm opcodes to an intermediate representation, applies custom optimizations, and emits native machine code.

Highly optimized FFI reduces type conversion and memory copying between host (C/C++) and guest (Wasm).

Platform‑aware hardware acceleration (e.g., the "segue" algorithm on x86) speeds up linear memory access.

Future Directions

CPU flame‑graph generation for Wasm plugins.

Full stack‑trace reporting with addr2line support for crashes.

Per‑plugin CPU and memory metrics.

Complete TypeScript support for Wasm plugin development.

Project repositories:

Higress: https://github.com/alibaba/higress WAMR:

https://github.com/bytecodealliance/wasm-micro-runtime