Cygnus – A fast, lightweight self-hostable serverless runtime and PaaS
I built Cygnus because of a long standing frustration with the compromises needed to be made when choosing a deployment option for web applications. The ecosystem is fragmented into a few distinct camps, each sacrificing user experience or runtime compatibility to balance isolation, startup latency, and their own profit margins. Docker: Heavier and slower because it has to supervise more than web apps. Paying overhead you don't need. MicroVM's: Good isolation, but huge maintenance surface area and substantial overhead. Great for untrusted code, overkill for your own apps. Workerd: Tries to…
What it does
In the maker’s words, at launch
I built Cygnus because of a long standing frustration with the compromises needed to be made when choosing a deployment option for web applications. The ecosystem is fragmented into a few distinct camps, each sacrificing user experience or runtime compatibility to balance isolation, startup latency, and their own profit margins. Docker: Heavier and slower because it has to supervise more than web apps. Paying overhead you don't need. MicroVM's: Good isolation, but huge maintenance surface area and substantial overhead. Great for untrusted code, overkill for your own apps. Workerd: Tries to dance around hardware isolation by enforcing an in-process V8 isolate model. Neutered runtime to prevent arbitrary syscall execution. Personally I still find the tradeoff worthwhile for their edge footprint, but I still find myself complaining about it from time to time. Vercel/Managed serverless: Delivers a great developer experience, uses microVM's which is good for compatibility but has a business model that eventually hands you a six-figure bill with a straight face ($0.15/GB bandwidth when budget providers charge cents per TB) and makes you sacrifice statefulness. These constraints make sense for hyperscalers or enterprises, but I don't have those kinds of needs. I just wanted something as light and fast as workerd(not exactly but closest i guess), but more rigid than just running them as bare userspace processes. Containers are just standard Linux processes wrapped in namespaces, cgroups, seccomp, and netns. You can do the same with systemd. And with Bun mature enough for production, combining an all-in-one JavaScript runtime directly with native Linux kernel primitives becomes a no-brainer. So I combined them into Cygnus, a single Rust daemon that turns raw kernel primitives and Bun into a self-hosted, scale-to-zero application platform. [ CLIENT: HTTP/1.1 · HTTP/2 · HTTP/3 (QUIC) ] | v [ Cygnus Daemon ] ├─ TLS termination (rustls) + ACME manager ├─ H1/H2/H3 front, normalized to H1 upstream ├─ Routing: SNI/Host → ArcSwap<HashMap> ├─ io_uring proxy loop (splice UDS↔TCP) ├─ Cage supervisor (spawn, health, drain, reap, crash backoff) └─ Admin API (root-only UDS) + Tenant-0 bridge (typed commands) | | HTTP/1.1 over per-app UDS (pooled, keep-alive) v ========== CAGE — per app, warm, reused ========== userns · mntns · pidns · ipcns · utsns · netns cgroup v2 (mem/cpu/pids) · seccomp allowlist bun (text shared via page cache, per version) ├─ preload shim: listen()/Bun.serve → UDS └─ artifact: bundle.js + bundle.jsc (RO mount) egress: veth ─ nftables policy ─ host NAT DNS: host-side forwarder at gateway IP What you get: - ~50ms cold starts with 0 guest kernel overhead - Page-cache shared runtime(low resource usage) - 100% native compatibility(it's literally running bun) - Zero-config setup(injects a listener shim to serve the app, no manual changes needed) - Dogfooded control plane with a great UX and dashboard running as tenant 0 Cygnus uses cages, a shared-kernel process isolation model. The way it currently is, it's designed for trusted code(your apps or apps you trust). It provides defense-in-depth against buggy code, supply-chain attacks, and SSRF. However, it is not designed for untrusted, anonymous multi-tenancy (yet). I'd love to hear your thoughts on the architecture, kernel primitive choices, and seccomp filtering strategy! Trying it out is a 1 liner, it works on macOS too but without any of the Linux isolation benefits, for testing it out or running locally. curl -fsSL https://cygnus.run/install.sh | bash Github repo has a demo gif if you want to see what it looks like! https://cygnus.run https://github.com/0xchasercat/cygnus
Does the same job
all alternatives →
- VQVas-quod – A minimal Linux container runtime written in Rust2020 · github.com · ▲110
- PAPaz – A Simple Docker PaaS Written in Node.js2015 · github.com · ▲90
- EAEmpire – A Self-Hosted PaaS Built on Docker and Amazon ECS2015 · medium.com · ▲36
- FSFaaS – Serverless functions framework for Docker2017 · github.com · ▲73
- SIStampede.io – Hybrid IaaS/Docker Orchestation Running on CoreOS2014 · ibuildthecloud.com · ▲40
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, July 2026
the whole month →- IR
I might be the only SRE on Earth with his own bowling center. It's a more in-depth gig than you'd think. My family and I bought an abandoned 8-lane bowling center in the rural mid-west. In our small town there weren't many recreation options for families. You've heard of a food desert? This is an R&R desert. It had been abandoned for a good reason. The roof leaks, the electrical system was constantly surging, and my 70-year-old bowling equipment (still) doesn't work perfectly. The system that keeps your score is particularly interesting to me. It's the thing you watch during your game, but…
Life & fun · Jul 2026
- EElevators▲1,680
Life & fun · Jul 2026 · john.fun
- 1W18 Words▲1,160
Life & fun · Jul 2026 · 18words.com
- BA
Over the past few months, our team has been building more and more slidedecks using web frontend technologies with coding harnesses like Claude Code, but a common complaint is to make even small edits we need to edit the code either manually or via the harness. To avoid this loop, I ended up creating Bento, a single HTML file with everything you need in a slide tool including animations and shared editing. There's no install or cloud login, everything works offline. The default deck is around 560 KB and it doesn't need to fetch anything once you got it. Open it in a browser and then you can…
Dev tools · Jul 2026 · bento.page
- GG
A few days ago I found myself trying out GLM 5.2 and was really positively impressed. The capabilities and security I was getting from this LLM are similar to those I've gotten from models like Claude or GPT, and this really surprised me. But then I thought, "I wonder how it would work on a normal computer like mine," and above all, "I wonder if it would work without going into OOM on a computer like mine." So I started working with the help of agents to test this possibility. I started converting the model to int4, understanding MTP usage, and if possible implementing DSA for long context.…
AI · Jul 2026 · github.com
