afmpeg

FFmpeg in pure Go with no install, no CGO and no disk: a WASM build of FFmpeg running over a virtualised, in-memory filesystem, so media processing ships as a single binary and stays sandboxed. That virtual FS layer is a big part of the appeal, and the whole thing sits behind one clean Go interface, no dropping to a shell, no wrangling CGO bindings. A native FFmpeg backend is on the way too, for the performance edge cases where you can trade the security posture for speed, and it speaks the very same interface.

A security review read "safely process untrusted media" and asked the harder question. A sandbox stops escape; it does not stop exhaustion.

FFmpeg assumes a disk it can seek around in. Giving it a convincing in-memory filesystem, and testing the behaviour that would hurt most first.

FFmpeg in pure Go with no install, no CGO and no disk: a WebAssembly build running over an in-memory filesystem, and why it exists.