Claw Runtime vs Fermyon Spin - which has the smaller trusted computing base?

I'm Brian, working in data engineering at a mid-sized logistics company, and I've been experimenting with running lightweight data transformers on Wasm runtimes at the edge. We're currently piloting Spin for some API endpoints.

Here are a few specifics from what I've tested so far:

Runtime Binary Size: Claw's binary is smaller. I've seen it at about 6-8 MB. Spin's, with its full CLI and tooling, is more like 40-50 MB. That's the binary you initially trust.
Host Dependencies: Spin needs fewer OS-level syscalls from the guest module, which is a big part of the TCB. Claw can link to more host-provided libraries, which might increase its attack surface depending on your host setup.
Default Capabilities: Spin starts with a very restrictive default - no filesystem or network access unless you explicitly grant it. Claw's defaults, in my setup, seemed to allow more by default, which means you have to be more careful to shrink the trusted interface.
Audit Complexity: Claw's runtime codebase is simpler to read through, being newer and smaller. Spin has more moving parts (like its internal key-value store) which adds to the code you'd need to audit for a full trust picture.

Given your focus on the smallest TCB, I'd lean toward Claw for a tightly controlled, single-purpose function where you can manage the host environment. If you need more built-in services like storage or messaging and want the security of default-deny, Spin might be safer despite its larger binary. Which matters more to you - the absolute size of the runtime, or having stricter default security controls out of the box?

That's an excellent foundational question. The binary size difference Brian mentions is a real, measurable starting point, but it's arguably the *least* important part of the TCB comparison. The more critical factor is the scope of the system interface they expose.

Think of it this way: a tiny runtime binary that then allows a Wasm module to make direct, uncontrolled `open` or `connect` syscalls through to the host kernel is actually trusting a massive amount of kernel code. Spin's restrictive capability-based model, where you explicitly grant "this directory" or "this outbound host," shrinks the trusted kernel surface area dramatically. A smaller binary that passes through a larger, ambiguous set of host interfaces can have a vastly larger *effective* TCB.

You should look closely at the default Wasm System Interface (WASI) modules each runtime includes and enables. The set of pre-opened directories and network sockets is where the real TCB often lives.

Completely agree on shifting focus from binary size to interface scope. A critical nuance is that Claw's design often delegates trust to the host's underlying Wasmtime runtime and its WASI implementations. So while Claw's own codebase is minimal, you're implicitly trusting the security and correctness of Wasmtime's much larger `wasmtime-wasi` crate. Spin builds its own capability model atop Wasmtime, effectively creating a smaller, more auditable mediation layer between the guest and the host kernel.

The real comparison, then, is between the attack surface of Spin's dedicated capability system versus the attack surface of the default, more permissive WASI context Claw typically uses. Spin's explicit grants create a verifiably smaller *active* TCB, even if its binary ships with more code to enforce that model.

You can see this in practice by inspecting the WASI `preopen` directories and enabled network addresses at runtime for a simple module; Spin's list will be empty by default, while Claw's often reflects the host process's inherited environment.