[RFC] Add WebAssembly (Proxy-WASM) Dynamic Filter Subsystem (pingora-wasm)

[Aditya-9-6]

Summary

My propose introducing an opt-in WebAssembly filter runtime crate (pingora-wasm) to enable dynamic, hot-loadable proxy extensions for Pingora without needing to recompile or restart proxy binaries.

Motivation

Proxies in modern cloud-native environments (e.g., Envoy) rely heavily on WebAssembly (Proxy-WASM) for dynamic security, auth, and header-mutation plugins. Providing native Wasm host support in Pingora will:

1. Allow developers to write proxy filters in Rust, Go, C++, or Zig and deploy them on the fly.
2. Maintain Pingora's high-performance characteristics using a sandboxed wasmtime JIT engine.
3. Bring enterprise-grade dynamic plugin extensibility to the Pingora ecosystem.

Proposed Architecture

• Crate: pingora-wasm (workspace module under pingora/)
• Runtime Engine: wasmtime (JIT-compiled Wasm engine)
• Interface: Binds Pingora's ProxyHttp lifecycle callbacks (request_filter, response_filter) to Wasm guest modules via standard Proxy-WASM ABI host functions.

Prototype Status

I have built an initial prototype crate (pingora-wasm) compiled and verified against Pingora's current workspace.

I would love to gather feedback from Cloudflare maintainers regarding:

1. Preferred module location (pingora-wasm crate vs optional feature flag under pingora-proxy).
2. Any specific ABI or runtime constraints preferred by the team.

Looking forward to your thoughts and guidance before opening the Pull Request!

[Aditya-9-6]

I have initialized a working prototype branch for pingora-wasm in our fork here: https://github.com/Aditya-9-6/aditya-dahale-pingora/tree/feature/pingora-wasm — looking forward to your feedback!

[ethanhann]

I volunteer to help with this if the Pingora maintainers are interested in it.

[Aditya-9-6]

I submitted PR !

[ethanhann]

Cool. I'm interested in this because I built a WASM middleware extensibility layer for my Pingora-based proxy that plugs into an HttpProxy implementation. It works well and is performant, but it would probably be better if the core machinery were built into Pingora.

Here are some links if you're interested in what I put together...

https://snakeway.dev/docs/internals/wasm-devices
https://snakeway.dev/docs/extension/authoring-wasm-devices
https://github.com/snakewayhq/snakeway/tree/main/crates/snakeway-wit/wit
https://github.com/snakewayhq/snakeway/tree/main/crates/snakeway-engine/src/execution/device/wasm

Also, this is a self self-contained implementation example: https://github.com/snakewayhq/snakeway/blob/main/crates/snakeway-wasm-test-device/src/lib.rs