# wazero

wazero is a WebAssembly runtime written in pure Go, with no CGO. Because it has no C dependency, a Go program that embeds it cross-compiles as trivially as any other Go binary — no C toolchain, no per-platform build setup. That's the main reason to pick it over CGO-based runtimes (wasmtime-go, wasmer-go) for a Go project: the moment you add CGO, `GOOS=windows go build` from a Mac stops being free. It implements the [[webassembly|WebAssembly Core Specification]], both the W3C 1.0 and 2.0 revisions.

## How it works

Dependencies are the Go standard library plus `golang.org/x/sys` — nothing else. Modules run through one of two engines:

- **Interpreter** — walks the bytecode directly. Platform-agnostic, so it runs on every Go target including riscv64. Slower.
- **Compiler** — ahead-of-time compiles a module to native code at `Runtime.CompileModule`, then runs that. The default where available, typically 10x or more faster than the interpreter. Limited to amd64 and arm64, since it needs a code generator per architecture.

Both engines pass the Wasm Core spec test suites, and the project is tested on Linux, macOS, Windows, and BSD.

## Usage

```go
ctx := context.Background()
r := wazero.NewRuntime(ctx) // Compiler engine by default on amd64/arm64
defer r.Close(ctx)

mod, err := r.Instantiate(ctx, wasmBytes)
if err != nil {
    log.Fatal(err)
}
add := mod.ExportedFunction("add")
results, err := add.Call(ctx, 2, 3)
```

The Wasm module can only reach host functions and memory you explicitly export to it, which is what makes wazero usable for running untrusted code inside a Go process — one option for [[sandboxing-ai-agents|sandboxing AI agents]] and plugin systems.

## Limitations

- The Compiler engine is amd64/arm64 only. On anything else (riscv64, s390x, ppc64le) you fall back to the slower Interpreter — call `wazero.NewRuntimeConfigInterpreter()` explicitly there.
- The Wasm sandbox is a boundary, not a full VM. It constrains memory and imports, but capabilities you *do* export (filesystem, clock, network shims via WASI) are yours to scope correctly.
- Import path caveat: the canonical module path is still `github.com/tetratelabs/wazero` even though the repository now lives under the `wazero` GitHub org (the project originated at Tetrate.io). Code imports the tetratelabs path; the repo URL is the wazero-org one.

Related: [[anubis-wasm-vendor-binary]] mentions that wazero, like wasmtime, requires you to flag on WebAssembly Exceptions support via a custom runner harness rather than enabling it by default.

## Repo

[github.com/wazero/wazero](https://github.com/wazero/wazero) — Go, Apache-2.0, ~6.3k stars. Stable since 1.0 in March 2023, semver with a stable API across the 1.x line, supports the two latest Go releases.