Strato
Strato is a fast, secure, and easy to deploy private cloud platform based on battle tested technologies and built for modern infrastructure. It enables operators to run efficient, secure, and powerful infrastructure easily.
Features
- 🚀 High Performance: Swift control plane and agent, QEMU with KVM acceleration on Linux hypervisor nodes
- 📦 VM Management: Full lifecycle management via QEMU, with snapshots, live resize, graphics consoles, and cloud-init provisioning
- ⚡ Sandboxes: Fast, disposable Firecracker microVMs booted straight from OCI images, with exec, fork, and snapshot/restore
- 🔒 WebAuthn/Passkey Authentication: Modern passwordless authentication, plus API keys and optional OIDC/SCIM federation
- 🔐 Fine-grained Authorization: built-in Cedar policy engine (IAM roles, guardrails, decision logs) — no external authz service
- 🛡️ Secure by Default: Deployments generate strong secrets on first run; agents authenticate only by SPIFFE/SPIRE mTLS
- 🌐 Software-defined Networking: OVN/OVS on Linux — multi-node overlay networks, security groups, floating IPs, IPv4/IPv6 dual-stack
- 📊 PostgreSQL Backend: Reliable data persistence with Fluent ORM
Quick Start
Secrets (database and session-store passwords) are generated automatically in
both paths — a fresh install is secure by default with zero secret
configuration.
Single host (Docker Compose)
git clone https://github.com/samcat116/strato.git
cd strato/deploy/compose
./setup.sh # generates .env with strong random secrets
docker compose up -d
Open http://localhost and register — the first user automatically becomes
the system administrator. Database migrations run automatically. See the
Docker Compose guide for
real-hostname/TLS deployments.
Kubernetes (Helm)
git clone https://github.com/samcat116/strato.git
cd strato/helm/strato-control-plane
helm dependency build
helm install strato . \
--set image.repository=ghcr.io/samcat116/strato-control-plane \
--set frontend.image.repository=ghcr.io/samcat116/strato-frontend \
--set image.tag=main --set frontend.image.tag=main
The chart defaults to local image names; these overrides select published
images. Pin matching immutable tags for reproducible deployments. Strong
credentials are auto-generated on first install and reused across
upgrades (stored in the <release>-strato-credentials secret). See the
Kubernetes guide for production values
(Gateway exposure, TLS, WebAuthn hostname).
Adding a hypervisor
In the web UI: Agents → Add Agent (or POST /api/agent-enrollments),
which prepares the node's identity in SPIRE and returns a
bootstrapCommand — one short-lived token to run on the hypervisor host:
curl -fsSL https://your-control-plane/api/agent-enrollments/install \
| sudo bash -s -- 'enroll_v1_...'
The script exchanges that token for the server-selected agent name, trust
domain, endpoints, and a fresh one-time SPIRE join token. It then installs the
agent and its host dependencies (QEMU, libvirt, OVN, swtpm/OVMF), attests the
node to SPIRE, and enables strato-agent.service.
Agents authenticate only with SPIFFE/SPIRE X.509 SVIDs over mTLS — there is
no token or password join, and no long-lived shared secret sits on disk, so
restarts and reboots just work. See the
agent deployment guide.
Local development
The Swift packages build and test independently. The agent, shared, and CLI
suites need no infrastructure; the control-plane suite runs against Postgres
(DATABASE_* env vars, defaults localhost:5432 / strato / strato_test —
the local development guide has a
matching docker run one-liner):
swift test --package-path control-plane
swift test --package-path agent
swift test --package-path shared
swift test --package-path cli
To run the full stack, use the Docker Compose deployment above; it can build
the control plane from your working tree instead of pulling the published
image. See the local development guide.
Core Technologies
- Swift - Modern, safe, and performant programming language
- Vapor - Server-side Swift web framework
- QEMU - VM execution with KVM on Linux hypervisor nodes
- Firecracker - MicroVMs for sandboxes and lightweight Linux VMs
- PostgreSQL - Advanced open source database
- Cedar - Policy language powering the built-in authorization engine
- OVN/OVS - Software-defined networking (Linux)
- SPIFFE/SPIRE - Workload identity and mTLS for agent authentication
- Next.js - Web frontend
Authentication
Strato uses WebAuthn/Passkeys for secure, passwordless authentication. Users can register and authenticate using:
- Security keys (YubiKey, etc.)
- Platform authenticators (Touch ID, Face ID, Windows Hello)
- Cross-platform authenticators
The WebAuthn origin must exactly match the URL users visit; both deployment
paths configure it from your hostname (see the deployment docs).
Project Structure
strato/
├── control-plane/ # API, database, scheduler, IAM (Vapor)
│ └── web/ # Next.js frontend (separate strato-frontend service)
├── agent/ # Hypervisor node agent (QEMU/Firecracker)
├── shared/ # Wire protocol and DTOs shared by both
├── cli/ # strato CLI
├── clients/swift/ # Generated Swift API client
├── SwiftFirecracker/ # Vendored Swift wrapper for the Firecracker API
├── sandbox-guest/ # Guest init + kernel build for sandbox microVMs
├── deploy/
│ ├── compose/ # Single-host Docker Compose deployment
│ ├── agent/ # Agent install script
│ └── ovn-central/ # Per-site OVN central services
├── helm/ # Kubernetes Helm chart
└── docs/ # VitePress documentation site
Documentation
Start with the documentation map:
The VitePress site preserves the same guides and architecture references.
Proposal and gated-feature pages describe their own implementation and
validation status; their inclusion is not a production-support claim.
Contributing
- Fork the repository
- Create a feature branch:
git checkout -b feature/amazing-feature
- Follow repository guidance and make focused changes.
- Run the checks appropriate to the change;
documentation-only changes need the docs build and link checks.
- Submit a pull request
License
This project is licensed under the Functional Source License 1.1 with MIT Future License - see the LICENSE.md file for details.
Support
