JACO
A small, opinionated container orchestrator.
Two binaries. Raft, WireGuard, nftables.
§ 01 — What is JACO
01 / 05JACO is a multi-node container orchestrator built on hashicorp/raft,
embedded Caddy, WireGuard, and per-(deployment, network) bridges with
nftables-enforced isolation. It ships as two binaries: jacod, the
long-running daemon managed by systemd, and jaco, the operator CLI
that talks to a local daemon over a unix socket and to peer daemons over
TLS gRPC for cross-host control.
No control-plane cluster to babysit, no YAML dialect to learn beyond a
small overlay on the docker-compose.yml you already have. Install on
your hosts, jaco cluster init, join the rest, jaco apply.
§ 02 — Quickstart
02 / 05sudo jaco cluster init
# cluster_id: <uuid>
# operator_token: <64 hex chars>jaco node issue-join-token
sudo jaco node join \
--peer node-1:7000 \
--token <single-use>export JACO_TOKEN=<token>
jaco apply --server node-1:7000 \
./hello/jaco.yaml
# Applied revision: 1Full walkthrough in getting started.
§ 03 — The shape of it
03 / 05Control plane
Raft-replicated state machine with a gRPC API for cluster, tokens, audit, deploy, and watch. On-disk snapshots survive restarts; the leader runs the reconcile loop.
Architecture →Discovery
Per-(deployment, network) docker bridges, deterministic /24 IPAM, a WireGuard mesh, and nftables east-west isolation with per-bridge DNS — kernel-gated, degrading gracefully.
Networking →Ingress
Embedded Caddy v2 reverse proxy with per-route ACME via raft-backed CertMagic storage. HTTP-01 challenge coordination runs through raft so any node can answer.
Ingress →§ 04 — Architecture
04 / 05Every node runs the same verticals in one jacod process; the leader runs the reconcile loop. See architecture.
§ 05 — Status
05 / 05Tagged releases through `v0.2.1`, functional for single-host and multi-host clusters via the two-binary path described above. The earlier open gaps are now implemented:
Known remaining item: the raft transport (:7001) is still plaintext TCP — run it over a private network or overlay you control.