How Apache DataFusion Runs SQL In-Process
Apache DataFusion is an embeddable query engine: SQL goes in, runs as columnar Arrow batches inside your own process, and results come out without a separate service.
Loading…
Topic
Rust
66 posts about Rust. Every summary links to the original.
- 66 posts
- 17 companies
- 2 explainers
See the idea
Rust explainers
Axum at the Trust Boundary: From Request to Protected Response
Axum is a Rust web framework for composing routes, middleware, and extractors. This explainer shows how different login flows become verified identity before a handler responds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
How we sped up transformer inference 100x for 🤗 API customers
Deploying large transformer models in production poses severe latency and scaling hurdles for machine learning engineers. Hugging Face achieved a cumulative 100x inference acceleration on its Accelerated Inference API by pairing library-level algorithmic adjustments with low-level hardware compilation. The initial 10x improvement reduces forward-pass computations, such as restricting attention calculations to the latest token in GPT generation tasks, while utilizing Rust-based tokenizers and caching mechanisms. The subsequent 10x speedup requires custom static graph compilation targeted to selected CPU or GPU hardware profiles, applying unused flow removal, instruction-specific layer fusion, and precision quantization via ONNX Runtime. These coordinated techniques enable real-time prediction latency across varied model sizes and demand profiles without sacrificing task accuracy.
How Shopify Uses WebAssembly Outside of the Browser
Shopify describes using WebAssembly (Wasm) outside the browser to run untrusted Partner code on its own infrastructure, reducing partners’ need to operate scalable web services and avoiding network latency for time-sensitive customizations. Wasm provides a sandboxed, stack-based environment with explicit host imports, protected call stacks, and runtime type checking, while targeting near-native performance and multiple source languages. Shopify wraps Fastly’s open-source Lucet runtime and compiler in a Rust web service called the Wasm Engine, which manages module I/O and storage and applies results during runtime processes such as web requests. In a test executing 100,000 modules per minute for roughly five minutes, Lucet execution hovered around 100 μs and total p99 execution time was about 4 ms. Shopify selected AssemblyScript, with TypeScript-like syntax, for first-class developer support and is extending its tooling, SDKs, monitoring, and language support.
Incoming! 6PN Private Networks
Fly.io introduces 6PN, an IPv6 private network intended to let applications in the same organization communicate without public IP addresses, mTLS, or certificates. Each application instance receives an organization-scoped IPv6 address, while per-application internal DNS zones resolve instances, regions, and sibling apps; enabling it requires private_network = true in fly.toml, though the post says it will soon be on by default. Examples show nginx discovering cache shards, Redis binding to fly-local-6pn, and NATS forming a cross-application cluster through internal names. Behind the feature, addresses encode organization, host, and instance identifiers, while BPF programs enforce network isolation and support WireGuard cryptokey routing; a Rust DNS server serves internal records. The stated goal is simple private connectivity with optional user-managed clustering, service discovery, and certificate infrastructure.
Fly Behind The Scenes: Fresh Logging
Fly replaced its centralized Graylog logging platform after seven servers could not process peak volumes of 20,000–30,000 logs per second, causing drops. Vector, written in Rust, now runs on every server, parses and transforms logs from journald and other applications, and sends them directly to Elasticsearch, removing Graylog as a middleman. The pipeline adopts the Elasticsearch Common Schema (ECS), with Fly-specific fields for app names, allocation IDs, and regions, while Vector configurations are distributed through the existing configuration management system. The migration took about two weeks alongside other work; logs are now available quickly enough to support failed-allocation queries that previously often raced processing, and future sinks may include Papertrail, Honeycomb, or Kafka.
Sandboxing and Workload Isolation
Workload isolation makes it harder for a vulnerability in one service to compromise the rest of a platform, and becomes especially important when hosting other people’s code. The post surveys isolation mechanisms from chroot and privilege separation through namespaced containers, mandatory access control, seccomp-bpf, capabilities, and language runtimes, before considering virtualized approaches. It emphasizes that network exposure is often the most consequential attack surface, while chroot alone leaves access to ptrace, procfs, device nodes, and networking. Firecracker is presented as the selected VMM: a small Rust implementation that limits itself with seccomp-bpf and runs under an external jailer providing chroot, namespaces, and dropped privileges. The closing menu includes nsjail, unprivileged Docker with tighter filtering, gVisor, and Firecracker or Kata; absent hostile code, the author would tune nsjail for return on investment.
How CDNs Generate Certificates
Fly describes how its CDN automatically generates TLS certificates for customer hostnames with Let’s Encrypt and ACME, focusing on why the older tls-sni-01 validation method was unsafe on shared hosting. ACME authenticates an account with an ECDSA/EdDSA key, creates an order, and verifies domain control through challenges; Fly uses tls-alpn-01, which avoids requiring DNS access or port 80. For validation, Fly requests a challenge, creates a self-signed certificate containing Let’s Encrypt’s token, stores it in distributed certificate storage, and signals the CA to connect with a ClientHello selecting acme-tls/1 via ALPN. The Rust proxy recognizes that ALPN case, retrieves the challenge certificate, and serves it to Let’s Encrypt, which completes the challenge and permits certificate issuance. Fly assigns each application a unique routable IPv6 address and requires CNAME resolution to it for ALPN validation; wildcard certificates instead use DNS challenges.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.