What is pylon?

Pylon is CPython 3.14 compiled to wasm32-wasip2 as a component-model wasm binary. It runs anywhere wasmtime (or any WASI Preview 2 component runtime) runs. It ships with 70+ capability components giving you real SQL (DuckDB, SQLite), TLS (OpenSSL), compression, cryptographic primitives, and more — no dlopen, no host escape.

Why

Pylon is Python for the places you can't run a normal Python interpreter. Edge / plugin / lambda / audit contexts where you need real Python surface area — import ssl, import sqlite3, import duckdb, import hashlib — but the host will only run a sandboxed wasm module.

Everything CPython normally gets from libc + a POSIX kernel gets routed through a small set of capability components that are content-addressed, digest-trusted, and swappable. The capability boundary is a WIT interface, not a syscall, so it composes across languages and runtimes.

What's in the box

Pylon is the composition of three artifacts and a launcher:

• python.wasm — CPython 3.14 built by Tools/wasm/wasi build against WASI SDK 33, plus every capability C extension statically linked.
• ~74 cap components — one wasm component per capability, built in sibling ~/git/<name>-wasm/ repos. openssl-component.wasm gives you TLS, ducklink_core.wasm gives you DuckDB SQL, zstd-wasm.wasm gives you Zstandard streaming, and so on.
• pylon.wasm — the composed artifact (~115 MB). Output of wac plug over python.wasm and every cap component.
• pylon launcher — a small shell wrapper around pylon-launch (Rust), which embeds composectl (a component-orchestration substrate) to load a plan JSON describing which components to compose and instantiate.

For the architectural detail, see the Architecture overview.

Two runtimes, one cap layer

The default runtime is CPython 3.14 (pylon --cp, the default). MicroPython 1.24 is available as a smaller alternative (pylon --mp) for embedded / edge / cold-start contexts. Both runtimes wire to the same cap layer.

The capabilities are consumer-agnostic — the same openssl-component.wasm satisfies CPython's _ssl_capability and MicroPython's _ssl_cap because both consumers import the same WIT interface.

Toolchain

Component	Version
CPython	3.14.3
MicroPython	1.24
WASI SDK	33
wasmtime	46.0.1
Host triple	wasm32-wasip2

License

PSF-2.0 (inherited from CPython, which pylon builds and distributes). Pylon also bundles MicroPython (MIT) and a large set of vendor libraries via cap components (individually licensed).

If pylon is useful to you and you write about it, cite the repo: https://github.com/tegmentum/python-wasm.

Next steps

• Quickstart — install and run in three commands.
• Build from scratch — fresh-machine bootstrap with reproducibility digests.
• Architecture overview — what a cap is and how compose works.