Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
Loading…
Topic
Rust
65 posts about Rust. Every summary links to the original.
- 65 posts
- 17 companies
- 1 explainer
See the idea
Rust explainers
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
The Exit Interview: JP Phillips
JP Phillips leaves after four years at Fly.io, saying the company’s increasing focus on Managed Postgres and LLMs does not match the direction he hoped to see: a move toward cloud provision and larger established customers. He says his original goal—building Fly Machines to replace HashiCorp Nomad—has been accomplished, with the platform now capable of supporting the next iteration of products. His central engineering contribution was the Fly Machines API and flyd, an independently running orchestrator whose finite-state-machine invocations use deterministic, durable execution and log each step in BoltDB. He also discusses corrosion2, a Rust service that uses SWIM gossip and a CRDT-structured SQLite database to distribute near-real-time machine state. Phillips criticizes GraphQL, Elixir, inconsistent communication and shifting priorities, while defending BoltDB and praising Rust’s productivity.
Our problems
The post lays out problems Cursor is working on in AI-assisted coding, from selecting relevant context in large codebases to making edits and finding bugs. It proposes collecting 500k tokens from editor sources and using a custom, fast reranker to reduce that context to 8k tokens, while reporting 1.4 billion vectors and 150,000 codebases indexed as of October 12, 2023. Other planned capabilities include a constrained few-step agent that searches, writes, and runs code with feedback, passive and active bug finding, and larger edits presented in real time. Future ideas include time-warp predictions, code understanding in model weights, reader and pseudo-code modes, and automatic stack-trace fixes. The list is explicitly not a final roadmap because new ideas and priorities change, and the post also invites interested people to join the company.
Creating a Flexible Order Routing System with Shopify Functions
Shopify’s smart order routing replaces a one-size-fits-all approach to choosing which inventory location fulfills an order with configurable routing rules. Rules can rank eligible locations by proximity to the destination, staying within the destination market, or merchant-defined location priorities, and merchants can arrange them in an order in the admin. Each rule is a Shopify Function written in Rust, receives data shaped through a GraphQL query, and returns location rankings; a reducer resolves ties by applying later rules to locations tied at rank 0. The rebuilt process uses the pipeline pattern to separate input preparation, rule execution, reduction, and final location selection, improving readability and debugging compared with the earlier tightly coupled implementation. This first stage dogfooded Shopify Functions on its own merchant stores, with a later stage planned to let developers add more complex rules.
Supabase Edge Runtime: Self-hosted Deno Functions
Supabase has open-sourced Edge Runtime, an MIT-licensed Rust web server built on Deno Runtime 1.32+ for self-hosting Deno Edge Functions. It serves TypeScript, JavaScript, and WASM functions, and existing Supabase Edge Functions can run without code changes; the release also adds npm modules and Node built-in APIs. The Supabase CLI uses it to serve all local functions with JWT verification, import maps, custom environment variables, hot reload, and defaults of 150 MB memory and 60 seconds execution time. Its architecture combines hyper, a Main Worker in a V8 isolate, and restricted User Workers that handle requests with controllable resource limits, while exposing APIs intended to improve development and deployment parity. A Fly.io demonstration shows deployment, with Digital Ocean and AWS also cited as provider options; the project is in beta with bugs and performance quirks still expected.
Bringing Javascript to WebAssembly for Shopify Functions
Shopify is introducing a Local Developer Preview that lets developers run JavaScript Shopify Functions locally, alongside Rust, while production deployment remains unavailable. Shopify Functions execute as WASI modules that read JSON from stdin and write JSON to stdout, with a 256KB size limit and a five-millisecond runtime limit; the post notes that the timing constraint varies by machine load. Javy addresses JavaScript’s WebAssembly runtime challenge by bundling the QuickJS interpreter into a Wasm binary, using Rust wrappers and Wizer to snapshot compiled QuickJS bytecode. Initial tests found Javy-created modules about three times slower than equivalent Rust modules, but both are likely to stay under five milliseconds for realistic use cases; Shopify is also pursuing SpiderMonkey in Wasm and researching JIT support for future performance.
Ruby 3.2’s YJIT is Production-Ready
Ruby 3.2 makes YJIT, Shopify’s just-in-time compiler for CRuby, substantially more suitable for production after its experimental Ruby 3.1 release. The project was ported from C99 to Rust for stronger safety guarantees and better abstractions, while memory work reduced overhead to approximately one third of the Ruby 3.1 level through metadata optimization, machine-code garbage collection, and lazy page allocation. YJIT 3.2 speeds railsbench by about 38% over the Ruby 3.2 interpreter, or 57% over the Ruby 3.1.3 interpreter, and adds native ARM64 support for Apple M1/M2, AWS Graviton, and Raspberry Pi. Shopify has deployed it across its Storefront Renderer infrastructure, measuring real-world speedups of 5% to 10%, while identifying memory footprint and method-call optimization as continuing priorities.
Launch Week 6 Hackathon Winners
Supabase announced the winners of its sixth hackathon, held during Launch Week 6 after ending 2022 with many feature releases. Projects were judged across categories including Best Overall, Most Fun/Interesting, Best Flutter, Best Storage, and Best Edge Functions, with Deno participating in judging the edge category. Depulso, a CLI and web app for static site deployments with per-deployment .depulso.site subdomains and SSL, won Best Overall, while Supa SQL App was runner-up for converting human language into SQL queries. Other winners included HTTP Sense, a reverse proxy and network monitoring tool; supaquiz, a realtime multiplayer trivia game; Lookout, a metadata-based image discovery app; and Vista, a video transcoder that adds customizable subtitles from audio. Winners received keyboards or swag, and a Discord event was scheduled for January 5 at 7:00 AM PST.
Year in Review 2022: Tenderlove's Ruby and Rails Reflections and Predictions
Aaron Patterson’s 2022 review surveys developments in Ruby and Rails, pairing runtime performance work with tools intended to improve developer productivity. YJIT’s compiler was rewritten in Rust, enabling ARM and Apple Silicon support while producing faster machine code; Variable Width Allocation adjusts object slot sizes to keep instance variables embedded and improve data locality. Ruby 3.2’s Object Shapes use property order as a class-independent inline-cache key, while Ruby LSP adds editor services and Error Highlight adds column-level diagnostics that now appear on Rails error pages. Patterson predicts—more accurately, hopes—that languages, frameworks, and development environments will become more interconnected, providing better suggestions, context, and assistance so developers can spend less time coding and more time solving problems.
pg_graphql v1.0
pg_graphql 1.0 marks the general availability of a PostgreSQL extension that lets databases be queried with GraphQL and formalizes a SemVer-based guarantee against backward-incompatible changes. It was designed for Supabase Free Plan servers with 1 GB of memory, where alternatives such as Hasura and Graphile consumed more memory than the platform could sacrifice. The implementation began with a C parser and SQL transpiler exposed through PostgREST RPC, then moved from SQL to Rust after nested SQL functions, copied state, and JSONB AST processing slowed schema introspection; v0.5.0 completed the rewrite. On Free Plan hardware, version 1.0 adds less than 300 microseconds per request, reaches about 1,060 SQL queries per second per connection, and the full Auth and HTTP stack handles about 645 requests per second, while larger instances exceed 10,000 requests per second.
Supabase Wrappers, a Postgres FDW framework written in Rust
Supabase Wrappers is an Alpha framework for building PostgreSQL Foreign Data Wrappers that connect databases with external systems, including third-party APIs, through SQL. It initially supports Firebase and Stripe, while wrappers for ClickHouse, BigQuery, and Airtable are under development. The framework extends pgx, a Rust Postgres extension framework, with async support for RESTful API-based wrappers and limited push-down support currently provided as a proof of concept. The post presents Wrappers as a basis for QETL, allowing teams to query, extract, transform, and load remote data through Postgres, either on demand or into local tables, while joining it with operational data. It is released outside official platform support, with potential breaking changes.
Shopify Embraces Rust for Systems Programming
Shopify has adopted Rust as its official systems programming language while retaining Ruby for server-side business logic, and has joined the Rust Foundation. The change addresses growing systems-programming needs including high-performance network servers, Ruby native extensions, and WebAssembly, where Shopify seeks speed, productivity, safety, and community-driven open source. Shopify cites Rust’s predictable native-code performance, fine-grained memory control, compile-time safety, support for concurrency, and interoperability with C and Ruby through tools and crates such as bindgen, rb-sys, and magnus. The company says Rust performed strongly in its safety evaluation and that its initial projects exposed more errors at compile time, while acknowledging that performance still depends on design and measurement and that internal education, tooling, and community participation remain unfinished work.
The Supabase Content Storm
The post announces Supabase’s Content Storm, a community campaign created to promote Launch Week 6 through a coordinated release of external content. Supabase invited well-known YouTubers, community members, makers, the SupaSquad, and others building with Supabase to publish related material on the same day, while giving participants an opportunity to build personal brands or promote products and startups. More than 30 creators took part, producing videos, livestreams, tutorials, project write-ups, and a Twitter thread covering topics such as authentication, migrations, Edge Functions, Storage, GraphQL, Flutter, Rust, and TypeScript integrations. The content was published on Tuesday, December 6, and the post provides a complete list of works and authors while directing readers to bookmark the collection, give feedback, and follow contributors.
One more thing
During Launch Week, Supabase announces six product updates spanning database security, authentication, dashboard administration, and developer tooling. Supabase Vault is a Postgres extension for managing secrets and encryption inside the database, built as a thin usability layer over pgsodium and released to gather user feedback rather than for immediate Supabase Platform availability. Auth UI moves from the @supabase/ui library into @supabase/auth-ui-react, with customizable themes, CSS and inline styles, and overridable labels for multilingual support; the initial release supports React. The update also adds granular Dashboard roles, pg_jsonschema for JSON Schema validation on json and jsonb, pg_graphql v0.4.0 with json/jsonb, the in filter, and larger-schema introspection, plus early-access signups for Supabase Auth MFA.
Logbook - 2022-06-23
Fly.io's June 23, 2022 logbook records a broad set of platform, dashboard, and flyctl updates. It announces YUL (Montreal, QC, Canada), adds Laravel and Laravel Octane detection to fly launch, and improves plain Docker build output when NO_COLOR=1 is set. Backend work optimizes API queries, reduces repeated app-image loads, moves app-discard cleanup into a retryable job, and adds SQL comments to help investigate database data-lock issues. The release also documents diagnostics, makes compliance documents public to prospective customers, and improves fly-proxy’s Rust coverage and PROXYPROTO v2 TLV support. Fixes address fly.toml environment variables, organization deletion, password-reset redirects, app secrets listing, metrics after fly apps move, dashboard errors, malformed SSL TLVs, and overzealous email risk checks.
How to make Rust leak memory (also: how to make it stop)
fly-proxy, a Rust-based proxy, leaked memory because its obsolete custom HoneycombLayer retained child spans under a long-lived parent span. The post follows a request from browser input through DNS, TCP, TLS, HTTP/2, and asynchronous Rust components including an aya-built eBPF program, tokio, hyper, and tracing, before explaining how the leak surfaced. In the custom layer, every closed child span was added to its parent’s collection, so each request consumed a small amount of memory while a high-level async task remained alive. Removing that legacy code fixed the primary problem: memory usage barely exceeded 50MB during a load test, while remaining growth came from queues and latency data retained for processing rather than the identified leak.
Our Experience Porting the YJIT Ruby Compiler to Rust
Shopify’s YJIT team moved the CRuby JIT compiler from C99 to Rust after finding that C’s limited complexity-management tools made the growing project difficult to maintain. The port had to preserve a non-trivial interface with CRuby, including parsing bytecode and manipulating Ruby’s primitive types, while compiling the Rust project into a static library linked through CRuby’s makefile. The team translated functions and structs largely one by one, retaining the original architecture while using Rust features such as pattern matching, macros, Cargo features, and borrow checking. Completed in three months, the port was judged more maintainable and pleasant to work with, although the team identified challenges around C interoperability, unsafe code, tooling, ecosystem maturity, and limited use of idiomatic Rust.
How we reduced our CI YAML files from 1800 lines to 50 lines
Grab's Cauldron Machine Learning Platform team managed continuous delivery across multiple pipelines by using nested GitLab CI configurations, but soon encountered platform limitations such as the 100-include ceiling and bloated 1,800-line YAML files. To address these constraints, the team implemented GitLab Dynamic Child Pipelines to programmatically create execution stages on the fly. They built a command-line utility in Rust that runs git diff against the base branch, extracts pipeline and stage metadata using configurable stop patterns, and applies a template to produce a dynamic CI definition. On the master branch, the tool fetches the diff artifact from the source branch through the GitLab API to execute identical generation logic. This architectural shift reduced the root CI file from 1,800 lines down to a constant 50 lines, allowing configuration size to remain stable regardless of repository growth.
Docker without Docker
Fly.io explains how it accepts OCI container images while avoiding Docker at runtime, choosing Firecracker micro-VMs because Docker’s isolation is not strong enough for its high-density multitenant environment. It describes OCI images as ordered tarball layers, showing how registry authentication, manifests, architecture selection, blob downloads, and configuration data are enough to reconstruct a container filesystem and entrypoint. On the platform side, flyctl uses Docker’s client library to push images, while a custom Go repository server adds token-based authorization, repository rewriting, and handling for cross-repository blob mounts and registry state. Servers use containerd as a cache over an LVM2 thin pool, leases and copy-on-write snapshots to provision VM filesystems quickly, and a Rust init configures mounts, networking, DNS, SSH, and the entrypoint before Firecracker runs the workload.
The Tokio Upgrade from 0.2 to 1.x
Fly.io’s Rust-based load balancer handles almost all of its traffic and stands on Tokio and Hyper, motivating an upgrade from Tokio 0.2 to 1.0. The team waited to upgrade until related crates including hyper, reqwest, async-compression, tokio-io-timeout, tokio-tungstenite, and sentry were ready; after a few weeks, most of the ecosystem had upgraded. The migration foregoes Tokio’s Stream implementations pending stabilization in the standard library, relaxes mutable-access requirements, changes AsyncRead and AsyncWrite polling to return Result<()>, and requires more explicit pinning for !Unpin futures. Because runtime::Handle lacked block_on, the team worked around the restriction with Arc; standard TcpListener values also required set_nonblocking(true) before TcpListener::from_std. Other changes included renamed APIs and revised Hyper WebSocket upgrades, and the author says the major upgrade was not hard.
How we sped up transformer inference 100x for 🤗 API customers
Deploying large transformer models in production poses severe latency and scaling hurdles for machine learning engineers. Hugging Face achieved a cumulative 100x inference acceleration on its Accelerated Inference API by pairing library-level algorithmic adjustments with low-level hardware compilation. The initial 10x improvement reduces forward-pass computations, such as restricting attention calculations to the latest token in GPT generation tasks, while utilizing Rust-based tokenizers and caching mechanisms. The subsequent 10x speedup requires custom static graph compilation targeted to selected CPU or GPU hardware profiles, applying unused flow removal, instruction-specific layer fusion, and precision quantization via ONNX Runtime. These coordinated techniques enable real-time prediction latency across varied model sizes and demand profiles without sacrificing task accuracy.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.