  In real-world scenarios, trusted execution environments (TEEs) frequently
host applications that lack the trust of the infrastructure provider, as well
as data owners who have specifically outsourced their data for remote
processing. We present Twine, a trusted runtime for running
WebAssembly-compiled applications within TEEs, establishing a two-way sandbox.
Twine leverages memory safety guarantees of WebAssembly (Wasm) and abstracts
the complexity of TEEs, empowering the execution of legacy and
language-agnostic applications. It extends the standard WebAssembly system
interface (WASI), providing controlled OS services, focusing on I/O.
Additionally, through built-in TEE mechanisms, Twine delivers attestation
capabilities to ensure the integrity of the runtime and the OS services
supplied to the application. We evaluate its performance using general-purpose
benchmarks and real-world applications, showing it compares on par with
state-of-the-art solutions. A case study involving fintech company Credora
reveals that Twine can be deployed in production with reasonable performance
trade-offs, ranging from a 0.7x slowdown to a 1.17x speedup compared to native
run time. Finally, we identify performance improvement through library
optimisation, showcasing one such adjustment that leads up to 4.1x speedup.
Twine is open-source and has been upstreamed into the original Wasm runtime,
WAMR.
