wasmtime and wasmer are basically state-of-the-art. Our compilation backend is a fast, but straightforward translator from wasm to binary (think v8 liftoff vs turbofan), so it's faster than interpreting, but still slower than a well-crafted optimizing compiler. However depending on your use case, that kind of performance may not be everything: e.g. when I/O dominates .
The good news is an optimizing backend is being worked on as we speak and should be available very soon :)
I don't suppose you have any concrete benchmark numbers, e.g. coremark? (:
Also, how do you sandbox the guest program? Just bounds checks on memory accesses? Do you use the same trick as wasmtime does where they map a ton of inaccessible address space and depend on a SIGSEGV to catch violations? What about potential stack overflows - how do you protect against those?
The good news is an optimizing backend is being worked on as we speak and should be available very soon :)