Week 7: The filesystem
Giving a guest a filesystem is easy. Giving two runtimes the same filesystem is where the design is, and where five good designs went to die
12 April 2027
A guest expects inodes, directories, descriptors with private offsets, readdir
cursors, mmap, mode bits, symlinks and atomic rename. You can back that with
an in-memory tree, with IndexedDB, with the Origin Private File System, or with
a filesystem living inside shared WebAssembly memory. Each buys something and
costs something, and OPFS in particular is worker-only and takes an exclusive
lock by default.
Then the semantics bite. A program listing a directory rarely makes the system call itself — it asks its standard library, which fetches a batch of entries into a fixed-size buffer and asks again until the directory runs out. Between those requests the program is free to delete things, and deleting as you enumerate is exactly what a recursive delete does.
One approach rebuilt the listing from scratch on each request and remembered its place as a position in that list. Every deletion shifted the remaining entries up, so the next request resumed past files that were still there.
The same program, compiled twice: forty checks passed on Linux, ten failed in the browser. At the buffer size one common standard library uses, deleting a thousand files left four hundred and ninety-eight of them, with no error. Below about a hundred and thirty files the whole directory arrives in a single batch — there is never a second request, so the bug does not exist. Which is why it survived everybody’s tests.
The week’s real subject is coherence. When a JavaScript runtime and a WASIX runtime must see one filesystem rather than two synchronised copies, the designs that fail are not the bad ones. A mirrored index made directory reads eight thousand times faster and was deleted. An overlay that was correct and shipped was deleted. Barriers that ran thirty iterations with zero conflicts were deleted. All of them produced ghost entries, because the defect was never in the implementation — it was in there being two copies.
Outline#
- what a filesystem owes a guest
- four backings, and what each costs
- readdir cookies, and a deletion that removes half the files
- five designs that worked and were deleted anyway
- telling anyone it changed, when the guest cannot call you
- durability, and the four-gigabyte ceiling
Teaching team
- Corey Weir — Convenor and lecturer