Runtime flags

This page is for operators who run the function-wasm runtime from a Crossplane package and set its flags through a DeploymentRuntimeConfig. It lists each flag with its environment variable and default, one line each. The linked pages have the detail.

The binary has two subcommands, serve and validate. serve is the default, so function --insecure --module-dir=. and a DeploymentRuntimeConfig’s args don’t name it. validate takes the flags marked “yes” in the validate column below, with the same defaults and environment variables, so it checks a Composition against what a runtime started with those flags would admit.

Limits and sources

These flags set the ceilings that a step’s limits can’t exceed (Input reference) and where path sources come from.

Concurrency

By default nothing is bounded: concurrency is the caller’s, set by Crossplane’s reconcile workers.

A component reserves nothing up front. The runtime charges each memory or table growth, the initial memory included, to the --max-total-run-memory pool as the guest claims it, and a run waits under its deadline while the pool is full. A growth the pool can’t serve before the deadline fails inside the guest as a failed memory.grow, counted in function_wasm_module_memory_denials_total. See Sizing for what these bounds cost.

Caches

Compiled modules are cached in memory, and fetched modules and compiled artifacts on disk. See Cache storage for the directory.

Signing

These flags set which module signatures the runtime accepts. Signatures explains each mode and how they combine.

Policy and egress

See Operator grant policy for writing and mounting the policy and HTTP egress for the egress budgets.

Health and metrics

Both endpoints are plain HTTP, because the function port speaks mTLS. Readiness and warm-up covers wiring probes.

The SDK’s flags --insecure, --debug, --tls-certs-dir, --address and --max-recv-message-size apply too.

Logging

--debug turns on the runtime’s own debug lines in a human-readable format: guest log records sent at debug level, the credentials withheld from a module and trap details. Everything else logs at info, so a compile under --debug doesn’t print the compiler’s per-pass lines. A set RUST_LOG replaces the flag’s filter in full.

Cache storage

The caches live under /tmp/function-wasm-cache, which isn’t configurable. Mount an emptyDir there if the pod’s root filesystem is read-only, or a volume to keep the fetched modules and manifests across pod restarts:

spec:
  deploymentTemplate:
    spec:
      template:
        spec:
          containers:
          - name: package-runtime
            volumeMounts:
            - name: cache
              mountPath: /tmp/function-wasm-cache
          volumes:
          - name: cache
            persistentVolumeClaim:
              claimName: function-wasm-cache

A volume keeps the fetched modules and the manifests, which the runtime verifies against their digest on every read. It doesn’t keep the compiled code. Each process signs the artifacts it writes under a key drawn at startup and refuses every other (trust model). A restarted pod compiles its modules again. Pods must not share a volume, because each would refuse and overwrite the other’s artifacts. Give each pod its own volume, with the runtime as its only writer. The runtime removes the compiled directories of other Wasmtime versions after a day without writes.

Opening the sandbox

Mount the Cedar --sandbox-policy-file through the same DeploymentRuntimeConfig, and put a tmpfs behind TMPDIR to bound the private /tmp:

spec:
  deploymentTemplate:
    spec:
      template:
        spec:
          containers:
          - name: package-runtime
            args:
            - --sandbox-policy-file=/etc/function-wasm/policy.cedar
            env:
            - name: TMPDIR
              value: /scratch
            volumeMounts:
            - {name: policy, mountPath: /etc/function-wasm, readOnly: true}
            - {name: scratch, mountPath: /scratch}
          volumes:
          - name: policy
            configMap: {name: function-wasm-policy}
          - name: scratch
            emptyDir: {medium: Memory, sizeLimit: 64Mi}

A fuller example with every operator-authorable option is examples/deployment-runtime-config-cedar.yaml.