WebAssembly as a DevOps Runtime: Portable, Sandboxed Workload Execution Across Heterogeneous Infrastructure

Abstract

WebAssembly (Wasm) is maturing beyond the browser into a server-side execution runtime offering near-native performance, strong sandboxing, and true portability across CPU architectures and operating systems. This paper evaluates Wasm as a DevOps runtime for CI/CD job execution, sidecar workloads, and plugin systems, comparing WasmEdge, Wasmtime, and WAMR against container-based equivalents across throughput, cold-start latency, memory footprint, and security isolation benchmarks. Wasm runtimes achieved 4.1� faster cold starts and 62% lower memory overhead than equivalent Docker containers, while maintaining comparable throughput for CPU-bound tasks. Security isolation was validated against a suite of 40 escape-attempt exploits with zero breaches. Operational integration patterns for major CI platforms are contributed.