---
title: "How Shopify Uses WebAssembly Outside of the Browser"
description: "Shopify describes using WebAssembly (Wasm) outside the browser to run untrusted Partner code on its own infrastructure, reducing partners’ need to operate scalable web services and avoiding network latency for time-sensitive customizations. Wasm provides a sandboxed, stack-based environment with explicit host imports, protected call stacks, and runtime type checking, while targeting near-native performance and multiple source languages. Shopify wraps Fastly’s open-source Lucet runtime and compiler in a Rust web service called the Wasm Engine, which manages module I/O and storage and applies results during runtime processes such as web requests. In a test executing 100,000 modules per minute for roughly five minutes, Lucet execution hovered around 100 μs and total p99 execution time was about 4 ms. Shopify selected AssemblyScript, with TypeScript-like syntax, for first-class developer support and is extending its tooling, SDKs, monitoring, and language support."
---

# How Shopify Uses WebAssembly Outside of the Browser

[Shopify](https://yomu.fyi/company/shopify) · 2023-10-18 · Dec 18, 2020

**Type:** Explainer

## Summary

Shopify describes using WebAssembly (Wasm) outside the browser to run untrusted Partner code on its own infrastructure, reducing partners’ need to operate scalable web services and avoiding network latency for time-sensitive customizations. Wasm provides a sandboxed, stack-based environment with explicit host imports, protected call stacks, and runtime type checking, while targeting near-native performance and multiple source languages. Shopify wraps Fastly’s open-source Lucet runtime and compiler in a Rust web service called the Wasm Engine, which manages module I/O and storage and applies results during runtime processes such as web requests. In a test executing 100,000 modules per minute for roughly five minutes, Lucet execution hovered around 100 μs and total p99 execution time was about 4 ms. Shopify selected AssemblyScript, with TypeScript-like syntax, for first-class developer support and is extending its tooling, SDKs, monitoring, and language support.

## Context

Shopify’s independently hosted App model requires Partners to operate web services at Shopify’s scale, while network latency makes Apps unsuitable for time-sensitive use cases. The company wanted Partners to focus on domain-specific solutions while Shopify executed their untrusted code on its own infrastructure.

## Approach / What changed

Shopify uses WebAssembly as the code format, validates and compiles modules with Lucet, and runs them through a Rust web service called the Wasm Engine. It selected AssemblyScript for first-class language support and added Shopify CLI integrations, SDKs, monitoring, and failure alerts.

## Takeaways

- WebAssembly’s sandboxed stack-based environment communicates with the host through explicit imports, with protected call stacks and runtime type checking helping contain buggy or untrusted code.
- Shopify’s performance test ran 100,000 modules per minute for approximately five minutes; Lucet execution was around 100 μs, while total p99 execution time was about 4 ms including I/O and engine-specific work.
- Shopify chose AssemblyScript because Ruby and JavaScript could not be compiled directly to Wasm for this use case without the performance or runtime constraints it wanted to avoid.

**Tags:** [AssemblyScript](https://yomu.fyi/topic/assemblyscript), [Performance](https://yomu.fyi/topic/performance), [Rust](https://yomu.fyi/topic/rust), [Security](https://yomu.fyi/topic/security), [WebAssembly](https://yomu.fyi/topic/webassembly)

- Source: [Shopify](https://shopify.engineering/shopify-webassembly)
- Source URL: https://shopify.engineering/shopify-webassembly
- Ingested by Yomu: 2026-08-31T01:10:40.860Z

[Read original post](https://shopify.engineering/shopify-webassembly)