How it’s built
Four layers,
and why each is there.
Each layer was chosen for a particular reason. Security, reproducibility and openness are built into the foundation rather than added later.
NixOS
Operating systemA fully declarative Linux distribution. All system configuration lives in .nix files — reproducible, auditable, shareable. Your server is exactly what the config says it is. Always.
Declarative · ReproduciblePodman
Container runtimeServices run as isolated containers. Podman over Docker because it runs rootless — as its own unprivileged user, not as root. Each service is contained and self-sufficient.
Rootless · IsolatedSystem daemon
System layerA Rust process handling all system-level work: managing containers, configuring networking, running system commands. It exposes a Unix socket. Nothing else touches the system.
Root · Unix socketBun + TypeScript
Management GUIA web interface served by Bun, running as an unprivileged user, talking to the daemon over that Unix socket. The code runs entirely on your machine — fully inspectable, fully customisable. Bun and TypeScript were selected so there are no third party runtime dependencies.
Unprivileged · YoursThe whole stack is free and open source. Nothing is hidden, nothing phones home, and every layer can be read, audited and changed by anyone who cares to look.
It’s built in the open.
Get involved →