Skip to content
VowVow Docs

Deploying to serverless

Vow targets short-lived native processes: compile once, run with explicit --grant flags. That overlaps the “why serverless cares about cold start and image size” problem — it is not a drop-in AWS Lambda runtime.

What works today

Section titled “What works today”
  • Single static native binary from vow build (native C compiler at lang/native/)
  • Measured cold start and size — see /BENCHMARKS.md
  • Capability grants as the process boundary instead of baking ambient credentials into the image
  • Optional OS threads (--grant threads) for CPU workers; HTTP via vow-web-server + vpm (blocking accept by default)

Tiny loopback example using the framework: see vow-web-server. Lower-level one-shot serve (tests/lang/tiny_api.vow):

fn main(caps: Caps) -> int {
    let body = json_obj_int("ok", 1);
    return match caps.net {
        Some(cap) => match http_serve_once(cap, 8765, body) {
            Ok(path) => len(path),
            Err(_) => 0 - 1
        },
        None => 0 - 1
    };
}
8765/hello
vow run tests/lang/tiny_api.vow -- --grant net:

http_serve_once binds 127.0.0.1 only. Prefer --grant net::PORT when you want a port allowlist. Empty net: allows any host for client-side net APIs — prefer an explicit host in production-shaped experiments.

What does not work yet

Section titled “What does not work yet”

Practical shape

Section titled “Practical shape”
  1. Build the binary in CI (vow build --release when you mean measured-O3 benches).
  2. Ship the binary + documented --grant set as the unit of trust.
  3. Put a real sandbox (container / microVM) around it if tenants are hostile — Vow is API confinement inside the language.

Next

Section titled “Next”