WASM Plugin System for Database Proxy with Sandboxed Host Functions and Hot Reload
Year: 2026
Type: article
Abstract: We present a WebAssembly (WASM) plugin system for a database proxy enabling user-supplied extensibility for authentication, query transformation, caching, routing, and metrics via sandboxed WASM modules. The system uses Wasmtime for WASM execution with a capability-based permission model (12 distinct permissions), configurable resource limits (memory, CPU timeout, filesystem access), hot-reloading of plugins without proxy restart, and a host function API providing database-specific opera-tions (query execution, cache access, schema discovery, metrics recording). While WASM extensibility exists in network proxies (Envoy proxy-wasm, Istio), its application to database proxies with database-specific host functions and a granular capability-based permission model is novel. PostgreSQL and MySQL use native C/C++ extensions that lack sandboxing and crash the server on bugs.
Author: Moya Vaca, Daniel
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7141465705
FWCI:
Cites:
Cited by:
Related to: