Browser requirements
OxideVM runs real x86-64 machine code in WebAssembly, in workers on your users’ machines. That needs a recent desktop browser and a page served with two security headers.
This browser
Section titled “This browser”These checks ran when this page opened. They download nothing.
- Secure page (HTTPS or localhost)Checking
- Cross-origin isolated (COOP and COEP headers)Checking
- WebAssembly SIMDChecking
- WebAssembly tail callsChecking
- Promise.withResolversChecking
- Origin private file system (for saved workspaces)Checking
Minimum versions
Section titled “Minimum versions”| Browser | Minimum version |
|---|---|
| Chrome | 119 |
| Edge | 119 |
| Firefox | 121 |
| Safari | 18.2 |
These are the oldest versions with every feature the engine uses: WebAssembly SIMD, WebAssembly tail calls and Promise.withResolvers. The SDK probes the features themselves, never the user agent, and refuses to load the engine in a browser that lacks one.
A cross-origin isolated page
Section titled “A cross-origin isolated page”The engine shares memory between workers, which browsers allow only on cross-origin isolated pages. Serve every response of your app with these headers, error pages included, and with a self-hosted engine also its workers and .wasm files:
Cross-Origin-Opener-Policy: same-originCross-Origin-Embedder-Policy: require-corpThe page must also be a secure context: HTTPS, or localhost during development. Once the page is isolated, every cross-origin resource it loads (fonts, scripts from a CDN, images) needs CORS or Cross-Origin-Resource-Policy headers. Deploying covers headers for common hosts.
When a page is not isolated, createVM fails with a VMError whose code is FEATURE_NOT_AVAILABLE. A browser that lacks a required feature fails with CORE_LOAD_FAILED and detail.reason "browser-unsupported". See Errors.
Storage
Section titled “Storage”A VM without a workspaceId gets a temporary workspace: its files live in browser storage while the VM runs and are deleted when the VM is disposed. With a workspaceId, the workspace is kept in the browser’s origin private file system or IndexedDB, so it survives reloads. Private windows and low storage quotas can limit or clear saved data, so check vm.workspace.persistence before promising that work is kept.
Memory
Section titled “Memory”Each VM runs a whole Linux userspace inside the tab and needs a large share of memory. Run one VM per page and dispose it with await vm.dispose() when the user leaves.