In process: the platform owns the imagealpha

How does a Motoko actor run inside my platform's own process, and what does it cost?

In-process hosting runs a Motoko actor inside the platform's own process through moxzi-rts, a library, while the platform keeps the actor's durable image in its own store. It is the alpha-7 shape on all nine platforms. The separate moxzi-actor-host service each host page describes first still works; this is the faster form, and the one the numbers below measure.

Who owns what#

Nothing is written to disk by moxzi. After a committing turn the runtime hands back a delta — the changed pages and the new metadata — and the platform commits it atomically, only if its stored image version is the one the delta extends. If it cannot commit, it evicts the actor; the next turn reactivates it from what the store holds.

The contract, as a function call#

moxzi-rts answers the actor-host contract version 3 (docs/host-abi.md in the repository) without HTTP. Its C interface is moxzi/rts/include/moxzi_rts.h:

int  moxzi_rts_new(ns, ns_len, dep, dep_len, &rts);
int  moxzi_rts_add_type(rts, name, name_len, wasm, wasm_len);
int  moxzi_rts_learn(rts, key, key_len);
int  moxzi_rts_call(rts, method, method_len, url, url_len, body, body_len, &status, &out, &out_len);
void moxzi_rts_free_buf(out, out_len);

moxzi_rts_call("POST", "/v3/begin", body) returns what POST /v3/begin returns over HTTP. Every adapter drives a turn the same way:

The runtime usually has the module already — it hosts the type, or saw it earlier — so step 3 is rare, and a 380 KB module is neither read from the store nor sent on an ordinary activation. Store meta exactly as it arrives: meta.patches carries byte-level patches for pages whose stored copy is out of date, and only the runtime reads it. Store a delta's dedup chunks the way you store pages (overwrite by index) and return them as the image's dedup: they are the record that answers a retried turn exactly once, and an activation without them is refused.

Bindings#

The cgo, P/Invoke, JNA and ctypes bindings load libmoxzi_rts from moxzi/target/release: build it first with cargo build --release -p moxzi-rts in moxzi/. Those hosts and Restate select the in-process form with MOXZI_IN_PROCESS=1; wasmCloud's and Cloudflare's in-process hosts are separate builds. The launch files the conformance harness uses, moxzi/conformance/hosts/<platform>-inproc.json, hold the exact commands and environment.

From a release, without Rust#

Each release carries the runtime prebuilt, in bundles that unpack into the same directory as the toolchain tarball (moxzi-<version>-<target>/):

tar -xzf moxzi-<version>-<target>.tar.gz        # the toolchain
tar -xzf moxzi-sdk-<version>-<target>.tar.gz    # + runtime and adapters
tar -xzf moxzi-hosts-<version>-<target>.tar.gz  # + prebuilt hosts (Restate, wasmCloud, Cloudflare)

The release is refused unless the example compiles against the staged library and runs an actor, so it is known to work:

cc examples/rts_hello.c -I include -L lib -lmoxzi_rts -Wl,-rpath,lib -o rts_hello
./moxzi build hello.mo -o hello.wasm
./rts_hello hello.wasm
# status 200; the answer is … bytes of JSON, most of it the delta to commit
# "response":{"candid":"…","result":["Hello, world!"],"status":"replied"},…

What it costs#

Measured on the conformance fixture customer.mo, in process (docs/actor-cost-report.md):

scripts/actor_cost_ratchet.sh holds these on the release board.

Checking a host#

Things you cannot do#

• Share one runtime between processes. The runtime lives and dies with the host process; after a restart the host adds its modules and keys again (add_type, learn).
• Skip the per-key guarantee. Two turns for one key at once are the platform's bug to prevent, as for its own actors.
• Read the image yourself. Pages are DEFLATE-compressed and meta.patches must be applied; treat the image as opaque bytes you store and hand back.
• Rely on parallelism under wrangler dev. It runs every Durable Object in one isolate; Actor Parallelism is proven on the other eight platforms, not locally on Cloudflare. For Cloudflare, compile with --compact-rts: 2 MB GC partitions keep the wasm memory's length near what the heap uses, which matters inside a 128 MB isolate.

Next#

• /docs/hosts/overview/ — the nine platforms and how the matrix is run.
• /docs/hosts/restate/ — one platform end to end.
• /docs/server/overview/ — moxzid, when you want no platform at all.