Rust has moved from an enthusiast language to infrastructure that billions of devices depend on. Android ships millions of lines of it, the Linux kernel declared its Rust experiment over in December 2025, and Cloudflare runs a large part of its network on Rust code. Naturally, clients ask whether their next system should be written in Rust too. Sometimes the answer is yes. More often, the honest answer is that one part of the system benefits from Rust and the rest is better served by Go, Node.js, PHP, or whatever the team already knows well. This article explains where that line is, with a benchmark we ran ourselves.
What Rust Actually Gives You
Rust is a compiled language with performance in the same class as C and C++, but with one important difference: the compiler checks how memory is used. Each value has one owner, references are tracked, and code that could read freed memory or modify data from two threads at once does not compile. There is no garbage collector, so memory is released at a predictable point rather than during a collection pause.
- Memory safety without a garbage collector. Whole classes of bugs, such as use after free, buffer overflows, and data races in safe code, are ruled out at compile time.
- Predictable latency. Without garbage collection pauses, response times stay steady under load, which matters for proxies, trading systems, and real-time processing.
- Low memory use. Services often run in a fraction of the memory of the same logic on a managed runtime, which translates into smaller containers and cheaper servers.
- Small single binaries. A Rust program compiles into one executable with no runtime to install, which makes CLI tools, agents, and edge deployments simple.
- Strong tooling. Cargo handles builds, dependencies, tests, and documentation in one tool, and Clippy catches many mistakes before review.
The language releases a new stable version every six weeks; at the time of writing the latest is Rust 1.99.1 from October 2026. Bigger changes are grouped into editions, the latest being the 2024 edition released with Rust 1.85 in February 2025. Old code keeps compiling across versions, which makes upgrades much less painful than in many other ecosystems.
The Evidence from Large Codebases
- Android: in November 2025 Google reported that memory safety bugs had fallen below 20 percent of all Android vulnerabilities for the first time. Across roughly 5 million lines of Rust, it estimated a memory safety vulnerability density about 1,000 times lower than its C and C++ code, a rollback rate about four times lower, and 25 percent less time spent in code review.
- Linux kernel: in December 2025, after the Maintainers Summit, the Rust for Linux lead sent a patch titled "rust: conclude the Rust experiment". Rust is now a permanent part of the kernel, though not every architecture and toolchain combination is mature yet.
- Cloudflare: much of its proxy layer runs on Rust. Its outage on 18 November 2025 is a useful reminder of the limits: a configuration file grew past a hard limit, and Rust code that called unwrap() on the resulting error panicked. Rust prevents memory bugs, not logic or error handling bugs.
Our Benchmark: Rust, Go, and Node.js on 2 Million Rows
Benchmarks of tight loops say little about business software, so we chose a typical back office job: read an 84 MB CSV of 2 million orders, then calculate total sales and order count per region, total spending per customer with the top 5 out of 50,000 customers, and totals per month. We wrote it twice in each language. First the straightforward way a developer would write it on a normal day, then an optimized version that avoids allocating new strings for every row. Node.js was only written the straightforward way. All versions produced identical results. Each figure is the median of five runs on an AMD Ryzen 7 5700X under WSL2, using Rust 1.82, Go 1.24.2, and Node.js 22.14.
| Version | Rust | Go | Node.js |
|---|---|---|---|
| Straightforward: time | 0.50 s | 0.49 s | 1.43 s |
| Straightforward: peak memory | 7.1 MB | 12.4 MB | 89.7 MB |
| Optimized: time | 0.30 s | 0.27 s | Not tested |
| Optimized: peak memory | 10.1 MB | 12.6 MB | Not tested |
| Output | 475 KB binary | 1.4 MB binary (stripped) | Script plus the Node.js runtime |
Three conclusions, and the first may surprise people who expect Rust to win every benchmark:
- Rust and Go were practically tied on speed. For work dominated by reading files, splitting strings, and updating hash maps, Go is already fast, and Rust does not automatically make it faster.
- Memory is where the difference shows. The straightforward Rust version used about 7 MB, Go about 12 MB, and Node.js about 90 MB, roughly 12 times more than Rust. Across dozens of services or containers, that adds up.
- Optimization mattered more than language choice. Writing the code more carefully made both Rust and Go about 40 percent faster, a bigger gain than switching between them. Node.js was about three times slower than both, which is still fine for a job that runs once a night.
Where Rust Pays Off
- Components that process a lot of data per request or per second: parsers, file conversion, image and document processing, stream processing, search indexing.
- Services where tail latency matters, such as gateways, proxies, matching engines, or real-time bidding, because there are no garbage collection pauses.
- Software that runs in tight memory: edge functions, IoT gateways, small containers, or agents installed on many machines.
- CLI tools and background agents that should ship as one small file without asking users to install a runtime.
- Hot paths inside an existing Python or Node.js system. PyO3 and napi-rs let you write one slow function in Rust and call it from the existing code.
- WebAssembly modules for the browser, where Rust has some of the most mature tooling.
- Security-sensitive code that handles untrusted input, where memory safety bugs become vulnerabilities.
Where It Is Usually Overkill
- CRUD applications, admin panels, and internal tools, where the database is the bottleneck and development speed matters more than milliseconds.
- MVPs and products still searching for their shape. Rust rewards designs that are thought through; frequent big changes cost more than in a dynamic language.
- Teams without anyone experienced in Rust and a deadline in three months.
- Systems that depend on SDKs from local payment gateways, banks, or government services. These are usually offered for PHP, Java, Node.js, or Go, and rarely for Rust, so you end up writing and maintaining the integration yourself.
The Real Costs
The learning curve is real. Ownership, borrowing, lifetimes, and async Rust take most experienced developers several weeks before they stop fighting the compiler and a few months before they are productive. Compile times on large projects with many dependencies are noticeably longer than in Go. The pool of Rust developers in Indonesia is still small compared with Go, PHP, Java, or JavaScript, which affects hiring and long-term maintenance. None of this is a reason to avoid Rust, but it belongs in the decision alongside the performance numbers.
Choose Rust for the part of the system where memory, latency, or safety is the actual problem, not for the whole system because it is the fastest language on a chart.
How to Adopt Rust Without a Big Rewrite
- 1Measure first. Find the component that actually costs too much CPU, memory, or latency, with profiling data rather than a feeling.
- 2Start with something self-contained: a CLI tool, a queue worker, a file processor, or one hot function called through PyO3 or napi-rs.
- 3Use the mainstream stack so answers are easy to find: Tokio for async, Axum for HTTP, SQLx or SeaORM for databases, Serde for JSON, and tracing for logs.
- 4Treat unwrap() and expect() in production paths as a review finding. Return errors and decide explicitly what happens when input is larger or stranger than expected.
- 5Run Clippy, rustfmt, and cargo audit in CI from the first commit, and pin the toolchain with a rust-toolchain file so every developer builds with the same version.
- 6Pair new Rust developers with someone experienced for the first few weeks. Most of the learning curve is about patterns, and a good reviewer shortens it a lot.
- 7Compare results after a release: cost, memory, error rate, and how long changes take. Expand Rust only where the numbers justify it.
Rust is also becoming a serious option for desktop applications, through Tauri for web-based interfaces and GPUI, the framework behind the Zed editor, for fully native GPU-rendered interfaces. We cover GPUI in a separate article.
Key takeaways
- Rust gives memory safety without a garbage collector, predictable latency, low memory use, and small single binaries.
- Google reports far fewer memory safety bugs in Android Rust code, and the Linux kernel made Rust permanent in December 2025, but Rust does not prevent logic or error handling bugs.
- In our 2 million row benchmark, Rust and Go were equally fast, Node.js was about three times slower, and Rust used the least memory: about 7 MB against 12 MB for Go and 90 MB for Node.js.
- Rust pays off for data-heavy components, latency-sensitive services, memory-constrained deployments, CLI tools, and hot paths inside existing systems.
- For CRUD apps, MVPs, and teams without Rust experience, Go, Node.js, or PHP is usually the more practical choice.
- Adopt Rust one measured component at a time, with the mainstream crates, strict error handling, and CI checks from day one.
