Sidecar: Bundling External Binaries

"Sometimes the feature you need already exists as a command-line tool. A sidecar lets you ship it inside your app and drive it."

What a Sidecar Is

A sidecar is an external executable you bundle with your app and run at runtime — ffmpeg for video, a Python script compiled to a binary, a Go CLI, anything. Instead of asking users to install a dependency, you embed it, and your Rust core spawns it when needed. It's how a Tauri app delivers heavy native functionality that would be impractical to reimplement in Rust.

Declaring and Naming It

You list the binary under bundle.externalBin in tauri.conf.json, and — this trips everyone once — the actual file must carry a target-triple suffix so the right binary ships per platform: ffmpeg-aarch64-apple-darwin, ffmpeg-x86_64-pc-windows-msvc.exe, and so on. Tauri picks the matching one at build time and resolves the plain name at runtime. Forget the suffix and the bundler can't find your binary.

Running It Goes Through shell — So Scope It

You execute a sidecar via the shell plugin's Command.sidecar(...), which means it's subject to the same security discipline: the shell capability must permit that specific sidecar, scoped to it and (ideally) its allowed arguments. A sidecar is privileged native execution, so treat it with the same caution as any shell command — grant exactly this binary, nothing more. (Note: not every app needs sidecars. Cinder, for instance, reaches its heavy image work over a network service rather than bundling a binary — a different architecture for a different need.)

Code

Declaring + naming the sidecar·json

// tauri.conf.json — declare the sidecar binary.
{
  "bundle": {
    "externalBin": ["binaries/my-tool"]
  }
}
// On disk, the file must be target-triple-suffixed, e.g.:
//   src-tauri/binaries/my-tool-aarch64-apple-darwin
//   src-tauri/binaries/my-tool-x86_64-pc-windows-msvc.exe

Executing the sidecar via the shell plugin·tsx

import { Command } from "@tauri-apps/plugin-shell";

// Run the bundled binary (resolved by its plain name at runtime).
const command = Command.sidecar("binaries/my-tool", ["--version"]);
const output = await command.execute();
console.log(output.stdout);

Exercise

Pick a tiny CLI (even a 'hello' script compiled or a system tool) and wire it as a sidecar: declare it in externalBin, name the file with your host's target triple, and run it via Command.sidecar from the frontend. Confirm the output comes back. Then write one sentence on what you'd scope in the shell capability so only this sidecar — with safe arguments — can run.

Hint

Find your triple with rustc -vV (look for 'host:'). Name the file binaries/<name>-<triple>. The capability should permit only this sidecar by name; constrain or validate args so the frontend can't turn it into arbitrary execution.