Published on (
 See this if you're having trouble printing code examples

Moonlight: Silverlight Goes Mono

by Edd Dumbill

You might have heard of Microsoft's Silverlight technology. It's a rich internet application (RIA) framework positioned to rival Adobe's Flash. Unlike Flash however, it's only available for Windows and Mac, not Linux. This is where Moonlight comes in. Moonlight is a project to create a Silverlight plug-in for the Mono environment, which will run on Linux, Mac and Windows.

Silverlight 1.0 was very much an early-stage implementation and, at the time of writing, is in release candidate stage. Though 1.0 is exciting in itself, many developers are waiting for Silverlight 1.1, widely seen as the serious release, as it introduces the ability to use managed code under the .NET runtime. This 1.1 version, currently in alpha release, is the one I'll reference in this article when making statements abou t functionality and compatibility. Moonlight targets compatibility with both 1.0 and 1.1 releases of Silverlight.

What Is Silverlight?

Silverlight is designed as a web browser plug-in that delivers richer interactivity and control than HTML plus scripting will allow. Effectively, it's Microsoft's answer to evolving the capability of the browser. Silverlight offers the expressive power of desktop GUI platforms, along with network awareness. So far, just like Flash. The difference from Flash is that Silverlight does this in languages you probably already know, as opposed to Flash's ActionScript.

The GUI layer is expressed in XAML, a simple markup language for user interfaces. Here's "Hello, World!"

Listing 1. Hello World in XAML
  <TextBlock>Hello, World!</TextBlock>

The control in Silverlight applications is provided by either a precompiled C# or Visual Basic.NET assembly or dynamically, by a scripting language such as JavaScript. Thanks to Microsoft's Dynamic Language Runtime, there's a choice of scripting languages available to program Silverlight in. You will be able to choose Python or Ruby, as well as JavaScript. (In Silverlight 1.0, you're restricted to JavaScript, as there's no .NET runtime support.)

Rather than being monolithic, a Silverlight application is a bundle of files, most typically being the XAML description of the UI plus a script file to provide the behavior. Through the Silverlight APIs, applications have access to a broad spectrum of functionality, covering widgets, network access, and multimedia. Additionally, Microsoft's ASP.NET technology provides convenient integration APIs on the server side, though Silverlight can interact with any server via Ajax.

Just in case you were concerned that Microsoft expects people to code all this stuff by hand, don't worry. There's a whole tool suite called Expression that you can look at. It won't surprise you to find that Expression is positioned squarely in the same product space as Adobe's Creative Suite. The neat thing, of course, is that you can create Silverlight applications by hand, which lowers the bar for general adoption, integration, and source code sharing.

Technically, Silverlight is a hybrid of some of Microsoft's existing platform technologies: the Windows Presentation Foundation (WPF), .NET runtime, and ASP.NET on the server side. This puts the Mono project in a great place to get started on Moonlight, as many of the required components exist already in Mono.

Sprawl screenshot
Figure 1. Screenshot of Sprawl game, one of the Silverlight sample applications

Why Build Moonlight?

Moonlight emerged after a remarkable 21-day hackathon staged by the Mono project. Faced with an invitation to demo the then only-talked-about Moonlight at the REMIX'07 conference in Paris, Miguel de Icaza challenged Novell's Mono developers to a hack-a-thon. Their starting point was less than encouraging. Miguel described their initial state: "Other than the rectangle (that is currently not even rendering) and the video (without audio) I got nothing."

Miguel assembled a small team of expert Mono hackers, and over 21 days they committed more than 24,000 lines of C++ and 13,000 lines of C# into their subversion repository. The result was a partial Silverlight implementation and a collection of demos, including a working demo of the Surface application Miguel could show at the conference. You can see screen captures of their progress hosted on the Mono web site.

From such energetic beginnings, Moonlight has three aims: to enable Silverlight applications to run on Linux, to create an SDK, so that Silverlight applications can be developed on Linux alone, and to reuse the Moonlight engine to enable desktop applications.

This last aim is intriguing, and in the context of the Mono project at the moment, makes a lot of sense. It's a very tough game playing catch-up with Windows, and there's not much chance of Mono implementing the entirety of the Windows presentation subsystem. At the same time, GTK+ isn't a very satisfying cross-platform GUI toolkit, and it is certainly very strange for Windows developers coming over to Linux.

So, it would seem that Moonlight offers a promising route to creating lightweight graphical applications on Linux. If that doesn't grab you on the desktop, stop and think about all the neat little devices that now have Linux embedded in them. Moonlight on Linux could be seen as an alternative to developing for the iPhone, for instance.

Moonlight Implementation Challenges

Under the hood, Silverlight 1.1 is an extended subset of the .NET 2.0 framework. Many features have been trimmed, to leave those that make sense in a browser environment and some additional specialized APIs have been added. This in itself presents an interesting challenge to the Mono project. They don't really have the resources to manage multiple branches of the runtime, but want to be able to provide multiple incarnations of the package. A web user does not want to drag down 27 MB worth of Mono just to run a small applet.

The solution turned out to be Cecil, a library for operating on compiled CIL bytecode. A linker based on Cecil is able to create multiple profiles of the same libraries, creating appropriate Moonlight libraries after all the compilation has been done. This tuning process not only removes unneeded parts of libraries, but also adds in required attributes, avoiding large amounts of intrusive #ifdef macros in the original source. The current estimate is that Moonlight will be about eight or nine megabytes to download, about a third of the size of Mono.

In addition to the reduced API size, hosting Moonlight in the browser offers another, significant challenge: security. Applications delivered over the network and running in the browser must be subject to security that is both tight and easily understood. For Silverlight itself, Microsoft deprecated their previous .NET security mechanism, Code Access Security (CAS), using instead something called the CoreCLR security model (the CoreCLR being the reduced-footprint runtime powering Silverlight).

As with removing the obligation to implement all of WPF, not having to implement CAS in its entirety is a huge boon to the Moonlight project, although a subset of CAS functionality is available. At its most simple, Moonlight security comes down to three levels of access for code:

Transparent code is what all Silverlight applications are composed of; it is verifiable, meaning that the runtime is able to inspect the bytecode and ensure it doesn't attempt unsafe actions. The safe critical APIs provide a bridge between the Silverlight application code and critical APIs. For instance, accessing the filesystem would be considered a critical operation, as it requires native system calls. The safe critical API enforces the sandbox rules for filesystem access, wrapping the critical API, and only permits operations if the rules are satisfied.

Interestingly, once this model is implemented, it has advantages beyond embedding Mono in the desktop browser. As Miguel de Icaza observes, the CoreCLR security model is very similar to that required for the embedding of Mono in Second Life.

What Interesting Things Can I Do with Moonlight?

The obvious use of Moonlight is to run Silverlight applications in the browser, of course. Given the current state of play, it will likely be some time in the next year before you can do that securely. However, there's a really interesting application you can put Moonlight to right away: desklets.

Desklets, also known as widgets, are small applications with a dedicated purpose. If you've not seen any before, check out Mac OS X Dashboard, Yahoo! Widgets, or gDesklets. They're attractive, easy to use, and lightweight.

Following the hack-a-thon theme, the Moonlight desklets work was started as part of Novell's hack week, an exercise inspired by Nat Friedman where Novell employees got a week to work on a new project of their choice.

Desklets screenshot
Figure 2. Example Moonlight desklets in action

Desklets are implemented simply as a directory containing a XAML file and the logic to drive it. To see desklets in action, view this YouTube video and read more about how they work in Miguel's blog.

Also thanks to Novell's hack week, Mono's IDE (Monodevelop) is also getting some support for developing Moonlight applications. Jackson Harper's hack week work was focused on allowing Monodevelop to import Silverlight projects and to create new ones.

How Can I Get My Hands on Moonlight?

First, remember that Moonlight is an experimental implementation of an unreleased technology. The real fun with Silverlight itself will start when version 1.1 is finalized. So, you should limit expectations of what you can do to experiments for now. If you're not comfortable with compiling, patching, or begging for help on IRC, waiting a while is the best policy. That said, the Getting Started notes on the Moonlight home page give you instructions on how to start working with Moonlight now.

According to the Moonlight team, the Moonlight development tools will ship with Mono by the end of the year, or early 2008. They hope to soon publish a more formal roadmap of deliverables.

Moonlight Factfile


XML for UI, JavaScript, Python, Ruby, C# or Visual Basic.NET for code.


Optimized for the Web: built in Ajax functionality.


Through a web page in Firefox or via a desktop runner.


Linux, Mac, Windows. Theoretically, anywhere Mono runs.


Mono's Moonlight tools, Monodevelop IDE.


Mono, Mozilla, Cairo, GTK+, FFmpeg, ALSA

Microsoft worry factor

Microsoft seems to be actively helping Miguel's team in building Moonlight. After all, its ubiquity is to their advantage, and it's hardly the same as a full .NET 3.0 implementation.

Further Reading


Return to ONLamp.

Copyright © 2009 O'Reilly Media, Inc.