wazero

wazero is a WebAssembly runtime written in pure Go, with no CGO. Because it has no C dependency, a Go program that embeds it cross-compiles as trivially as any other Go binary — no C toolchain, no per-platform build setup. That's the main reason to pick it over CGO-based runtimes (wasmtime-go, wasmer-go) for a Go project: the moment you add CGO, GOOS=windows go build from a Mac stops being free. It implements the WebAssembly Core Specification, both the W3C 1.0 and 2.0 revisions.

How it works

Dependencies are the Go standard library plus golang.org/x/sys — nothing else. Modules run through one of two engines:

• Interpreter — walks the bytecode directly. Platform-agnostic, so it runs on every Go target including riscv64. Slower.
• Compiler — ahead-of-time compiles a module to native code at Runtime.CompileModule, then runs that. The default where available, typically 10x or more faster than the interpreter. Limited to amd64 and arm64, since it needs a code generator per architecture.

Both engines pass the Wasm Core spec test suites, and the project is tested on Linux, macOS, Windows, and BSD.

Usage

ctx := context.Background()
r := wazero.NewRuntime(ctx) // Compiler engine by default on amd64/arm64
defer r.Close(ctx)

mod, err := r.Instantiate(ctx, wasmBytes)
if err != nil {
    log.Fatal(err)
}
add := mod.ExportedFunction("add")
results, err := add.Call(ctx, 2, 3)

The Wasm module can only reach host functions and memory you explicitly export to it, which is what makes wazero usable for running untrusted code inside a Go process — one option for sandboxing AI agents and plugin systems.

Limitations

• The Compiler engine is amd64/arm64 only. On anything else (riscv64, s390x, ppc64le) you fall back to the slower Interpreter — call wazero.NewRuntimeConfigInterpreter() explicitly there.
• The Wasm sandbox is a boundary, not a full VM. It constrains memory and imports, but capabilities you do export (filesystem, clock, network shims via WASI) are yours to scope correctly.
• Import path caveat: the canonical module path is still github.com/tetratelabs/wazero even though the repository now lives under the wazero GitHub org (the project originated at Tetrate.io). Code imports the tetratelabs path; the repo URL is the wazero-org one.

Related: anubis-wasm-vendor-binary mentions that wazero, like wasmtime, requires you to flag on WebAssembly Exceptions support via a custom runner harness rather than enabling it by default.

Repo

github.com/wazero/wazero — Go, Apache-2.0, ~6.3k stars. Stable since 1.0 in March 2023, semver with a stable API across the 1.x line, supports the two latest Go releases.