The Case for Rust in the base system

Original Article ↗ Hacker News Discussion ↗

FreeBSD developers and users are weighing whether to adopt Rust in the operating system’s “base system” — the core kernel, libc, and standard utilities shipped with every install. Proponents highlight Rust’s memory safety, stronger type system, and modern tooling as a way to reduce security vulnerabilities and enable more robust system components, while critics warn about added build complexity, weak support for some architectures, and the risk of fracturing a traditionally conservative, C-centric project. Many voices suggest a gradual, selective use of Rust and closer coordination with upstream Rust tooling rather than a wholesale shift.

Scope: What “base system” Means in FreeBSD

  • Includes kernel, libc (tied closely to kernel), core utilities, dtrace, and compilers needed to build base.
  • Delivered and updated as a single cohesive unit (binary patches), distinct from “ports” and third‑party packages.
  • Project culture trends toward a slim base; languages like Perl were removed; LLVM toolchain is now the main “bloat”.

Motivations for Rust in the Base System

  • Desire for a stable Rust target on FreeBSD and better integration for system tools (e.g., jails, ZFS management).
  • Access to FreeBSD‑specific Rust code by core developers seen as valuable guidance.
  • Easier creation of custom ISOs that bundle Rust‑based management utilities.
  • Some want Rust to replace C++ in base and move OpenSSL out to ports, using Rust TLS libraries for tools like fetch.

Rust vs C/C++: Safety and Language Features

  • Stronger static guarantees around memory safety and data races via ownership/borrowing and the borrow checker.
  • Destructive moves and clear handling of “borrowed” vs “owned” objects prevent many use‑after‑free and iterator invalidation bugs that C/C++ leave to runtime or undefined behavior.
  • Modern tooling (Cargo), richer standard library concepts, and advanced type/iterator/monadic patterns praised; learning curve acknowledged as steep.
  • Debate over how different this really is from RAII in C++, but consensus that Rust makes lifetime and concurrency mistakes much harder.

Platform and Toolchain Concerns

  • Rust tier‑1 support is narrow; FreeBSD supports more architectures, though that list is shrinking.
  • Doubts FreeBSD has resources or interest to push FreeBSD targets to Rust tier‑1.
  • Suggestions: use GCC Rust frontend or C‑generating compilers (e.g., mrustc) for long‑tail platforms, but practicality is questioned.
  • Some argue legacy architectures that cannot keep up with modern toolchains are already on “borrowed time”; others see BSDs as a last bastion for such hardware.

Build, Size, and Integration Issues

  • Concern about doubling already heavy LLVM‑centric build times if Rust is in base.
  • Discussion of adding an extra build stage for Rust‑dependent components after buildworld, and/or decoupling toolchains from world.
  • Tension between keeping base minimal vs integrating Rust deeply.

Security, Reliability, and Testing

  • Multiple comments tie 60–70% of serious vulnerabilities to memory unsafety and see Rust as a partial remedy.
  • Others stress that most large‑scale attacks are still “basic” issues and that Rust doesn’t solve all security problems.
  • Debate whether language choice or testing/QA discipline matters more; several argue language guarantees directly reduce testing burden and certain bug classes.
  • Some worry kernel/low‑level Rust will still be full of unsafe and add complexity, undermining the simplicity prized in secure OS cores.

Mocking, Testing Strategy, and Developer Experience

  • Example: a FUSE filesystem test suite using heavy mocking argued to be effectively impractical in C but manageable in C++/Rust.
  • Counter‑argument that mocking itself is often a poor testing strategy, regardless of language.
  • General praise for Rust’s tooling and test infrastructure, though mocking in Rust isn’t universally loved.

Ecosystem, Philosophy, and Community Impact

  • Comparisons: FreeBSD/Go seen as conservative and stable; Linux/Rust as fast‑moving and flexible.
  • Some fear Rust in base could be divisive and destabilizing, likening it to an “emacs vs vi” style schism.
  • Others see selective introduction (non‑kernel components, new daemons) as a reasonable path that won’t immediately replace C but expands options.