Fil-C
A memory-safe implementation of C and C++ using runtime checks and a garbage collector.
Commenters like Fil-C for making existing C and C++ code memory safe without a rewrite123, and they note that real programs, up to a full Linux userland, already compile with it.456 The most common caveat is a cost of roughly 2x in performance78, so it suits network-exposed or infrastructure code that is not performance critical.91011
Why people recommend it
Memory safety · 3
Commenters see it as a practical defense against memory-safety bugs that lead to remote code execution, with some calling its guarantees stronger than Rust's.
“Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately.”
“it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”
Show 1 more
“An important improvement over rust is that”
No rewrite needed · 3
Existing C code keeps decades of bug fixes while gaining memory safety, avoiding the compatibility issues of a rewrite.
“it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”
“it profits from the decades spent fixing all the logic bugs”
Show 1 more
“turning it into a memory safe implementation of the C and C++ programming languages you already know and love”
Real-world compatibility · 3
Commenters say it compiles real programs such as GNU coreutils and the userland of a whole Linux distribution.
“You can compile a full working linux distro with fil-c”
“userland is compiled with Fil-C”
Show 1 more
“It certainly works in my C programs.”
Production practicality · 3
Recommended for servers, daemons and infrastructure that have spare CPU capacity.
“Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately.”
“Fil-C is an amazing technology, and we should use it”
Show 1 more
“It's an interesting option for infrastructure that's not performance critical.”
Easy start · 1
A commenter made a Bazel template that sets up a Fil-C build in a few steps.
“to make it super easy to get started with fil-c projects”
Caveats and dissent
Performance cost · 3
Code runs up to about 2x slower, so commenters suggest it for code that is not performance critical.
“it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”
“Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately.”
Show 1 more
“It's an interesting option for infrastructure that's not performance critical.”
Runtime-only checks · 3
Fil-C catches errors at run time rather than compile time, and it crashes instead of letting a program recover.
Show 1 more
“it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”
No JITs or GCs · 1
Code that implements a JIT or its own garbage collector cannot be compiled with it, which rules out programs such as Chrome.
“Fil-C is an amazing technology, and we should use it”
Overstated claims · 2
Some commenters think the project's marketing overstates its case against Rust.
“What I do not like, primarily comes down to how the project is talked about and marketed.”
Versus sanitizers · 1
One commenter found it underperforming existing sanitizers.
“Disappointing - but not unexpected - to see it underperforming existing sanitizers.”
Uses a GC · 2
It relies on a garbage collector, which one commenter pointed out as a drawback.
“Fil-C, which in case they haven't been paying attention, uses a GC, go figure!”
“turning it into a memory safe implementation of the C and C++ programming languages you already know and love”
Often compared with
From the makers not counted in the ranking
“according to our tests this turns all of the exploits into DoS”
“Fil-C's GC (Fil's Unbelievable Garbage Collector) uses an alternative on-the-fly algorithm, which I call Phil's Concurrent Marking.”
https://github.com/protocolbuffers/protobuf/commit/50f9ac3ba433e7be5869ee8ec7e7a85e6ca09a3d On a sufficiently anemic CPU doing enough fast allocation you can get measurable improvements from that kind of thing, but for a superscalar CPU and a general purpose allocator I agree you'd be hard pressed.
“Hence, a Fil-C program is memory safe down to the syscalls”
“This is what makes almost all JS implementations, and Fil-C, memory safe.”
Threads where it came up
- Notes by djb on using Fil-C 10 mentions
- Memory Safety Absolutists 7 mentions
- Fil-C: Garbage In, Memory Safety Out – Filip Pizlo – SSW 2026 [video] 6 mentions
- Zig's Incremental Compilation Internals 5 mentions
- A simplified model of Fil-C 5 mentions
- I want extern "fil-C" 3 mentions
Also written as FIL-C. Data: fil-c.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 43
“Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately.”
“Fil-C is a bit of a modern marvel in that regard!”
“An important improvement over rust is that”
“it has stronger* memory safety guarantees than rust, none of the compatibility issues that a wholesale rewrite has”
“or you adopt a high-cost runtime checker like Fil-C”
“Fil-C is the answer”
“It's an interesting option for infrastructure that's not performance critical.”
“The author of Fil-C worked on it also”
“It's not a replacement for Fil-C's role as a precise ASAN/Valgrind”
“But why should we prevent fil-C programs to be used from Rust (or C, for that matter)?”
“Fil-C does not ensure this.”
“It certainly works in my C programs.”
“even if Fil-C has cool technical accomplishments, I find it hard to speak positively about it”
> GC languages are slower This is not necessarily true. It depends on a language, e.g. Go is slow, Nim[0] is extremely fast with conventional GC and slightly faster with ARC/ORC[1]. GC programs can be faster than manually managed ones in some cases. It's just manual memory management gives you more control of where and when free is called. And a good type system is a privelege that gives Nim more control with destruc
“What I do not like, primarily comes down to how the project is talked about and marketed.”
“Fil-C is an amazing technology, and we should use it”
“I don't see why the full Linux kernel could not be compiled with Fil-C.”
“Rustafarians do seem to be worried by Fil-C and for good reason.”
“it's probably the more practical, complete and well-supported solution”
> It seems like "can switch on unsafe whenever" vs "has no escape hatches" is an obvious line in the sand and a very useful distinction with real world implications. Sure, although to me, the obvious distinction is that one of them gives you more flexibility (since neither Go nor Fil-C is at risk for someone accidentally writing unsafe code). > Why in the future? It exists and can be used right now. In fact, much of
“Where do you see anything saying the kernel can be build with Fil-C?”
“it's roughly the same idea as GCC "fat pointers"”
“Maybe Fil-C will be able to provide as large benefits to running C safely in production”
“Disappointing - but not unexpected - to see it underperforming existing sanitizers.”
“I want my application to be written in rust or at least use fil-c at bare minimum”
“how does Fil-C compare to https://security.apple.com/blog/memory-integrity-enforcement/?”
“it's this general syscall function that's safe in Fil-C.”
“Fil-C, which in case they haven't been paying attention, uses a GC, go figure!”
“I'm not yet convinced that the issue of C's unsafety is better solved by translating it to Rust rather than using Fil-C”
“using Fil-C's garbage collector”
“https://github.com/pizlonator/fil-c/blob/deluge/libpas/src/libpas/fugc.c#L41”
“Let's say I compile curl using Fil-C”
“I would probably list it in [1], given how many programs depend on it.”
“https://fil-c.org/programs_that_work”
“It is one of the reasons I'm interested in the FIL-C project.”
“Pair this with Fil-C”
“should I switch to Fil-C instead to debug my code?”
“people who may want to use these two together to make hermetic builds with it”
“I love Fil-C. It's underrated.”
“Fundamentally impossible in Fil-C.”
“You can compile a full working linux distro with fil-c”
“userland is compiled with Fil-C”
“turning it into a memory safe implementation of the C and C++ programming languages you already know and love”