Skr8tr — The Sovereign Orchestrator

⚡ OPEN SOURCE • C23 + RUST • POST-QUANTUM AUTH

The sovereign workload orchestrator.
No Docker. No YAML. No Kubernetes.
5 MB control plane. PQC-signed commands.

Get Started View on GitHub →

skr8tr — sovereign orchestrator

$ skr8tr --key ~/.skr8tr/signing.sec up api.skr8tr

submitting /opt/apps/api.skr8tr... ok

app api-server

node b33c8ed0ea05839d78934cb8

$ skr8tr nodes

3 live node(s)

NODE ID IP CPU% RAM

b33c8ed0ea05839d78934cb8dbb1c5f4 10.0.0.1 3% 45GB

a1f2c3d4e5f6789012345678abcdef01 10.0.0.2 9% 31GB

9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b 10.0.0.3 1% 62GB

$ skr8tr --key ~/.skr8tr/signing.sec rollout api-v2.skr8tr

rolling out... ok — new replicas launching, old draining (8s settle)

// WHY SKR8TR

Kubernetes is a tax on your infrastructure.

k8s was designed for Google's scale in 2014. Most teams don't need a 600 MB control plane, etcd consensus, iptables mazes, and 200-line YAML manifests to run a React app and an API server. Skr8tr cuts through it.

✗ Kubernetes

✗ 600+ MB control plane (etcd + apiserver + scheduler + controller-manager + ...)

✗ kubeconfig bearer tokens — base64-encoded secrets, effectively plaintext

✗ YAML + CRDs + Helm charts + kustomize layers

✗ Docker / containerd / runc / CNI — four abstraction layers to run a binary

✗ nginx-ingress as a separate Helm chart just to route HTTP

✗ Rollouts require readinessProbes, PodDisruptionBudgets, DeploymentStrategies

✗ Leader election, Raft consensus, SPOF etcd cluster

✓ Skr8tr

✓ 5 MB total — three C23 binaries + a Rust CLI

✓ ML-DSA-65 post-quantum signatures — key never leaves your machine

✓ .skr8tr manifest — 6 lines to deploy an app

✓ No Docker. Fork+exec. Any binary, any language.

✓ Built-in HTTP ingress — longest-prefix routing, Tower discovery

✓ skr8tr rollout app.skr8tr — one command, zero downtime

✓ Masterless mesh — no etcd, no leader, no SPOF

// FEATURES

Everything you need.
Nothing you don't.

Skr8tr is production-grade workload orchestration without the enterprise complexity tax.

🔐

Post-Quantum Auth

Every mutating command is ML-DSA-65 signed (CRYSTALS-Dilithium Level 3). Your signing key never touches the wire. Replay protection built in.

🔄

Rolling Updates

skr8tr rollout app.skr8tr — launch new replicas, wait for settle, drain old ones. One command. No readiness probe YAML required.

🌐

HTTP Ingress

Built-in reverse proxy with longest-prefix route matching. Dynamic backend resolution via the Tower on every request. No nginx, no Envoy config.

🧵

Masterless Mesh

No etcd, no Raft, no leader election. Every node is a sovereign peer. The Conductor schedules via UDP heartbeats. Add nodes by running the binary.

⚖️

Auto-Scaling

CPU-triggered scale-up and scale-down with configurable thresholds. Min/max replica bounds. No metrics-server, no HPA objects.

🔍

Service Discovery

Built-in Tower registry. Services register automatically on launch, deregister on kill. Round-robin across replicas. Query with skr8tr lookup.

❤️

Health Checks

HTTP GET probes per workload. Configurable interval, timeout, retry count. Failed replicas are killed and relaunched automatically.

📜

Log Streaming

Per-process ring buffer (last 200 lines). Query with skr8tr logs app. Auto-resolved to the correct node — no SSH required.

⚡

Bare Metal Speed

No container runtime. No OCI image pull. Fork + exec. Your binary starts in milliseconds, not seconds. Zero copy overhead on the data path.

// MANIFEST FORMAT

Six lines to deploy. Not sixty.

The .skr8tr manifest is Skr8tr's sovereign alternative to Kubernetes YAML. Human-readable. No anchors. No CRDs.

api-server.skr8tr

app api-server
  exec     /usr/local/bin/myapi
  args     --port 8080 --db postgres.internal
  port     8080
  replicas 3
  health {
    check  GET /healthz 200
  }

with auto-scaling

app api-server
  exec     /usr/local/bin/myapi
  port     8080
  replicas 2
  scale {
    min        1
    max        8
    cpu-above  80
    cpu-below  20
  }

// ARCHITECTURE

Three binaries. Infinite nodes.

Skr8tr's control plane is three C23 daemons and a Rust CLI. No etcd. No apiserver. No controller-manager. No scheduler pod. No kubelet.

Internet / Cloud LB │ HTTPS ┌──────────▼──────────┐ │ skr8tr_ingress │ HTTP reverse proxy │ (TCP :80) │ longest-prefix routing └──────────┬──────────┘ │ Tower LOOKUP ┌──────────────┐ UDP :7771 ┌────────▼────────┐ │ skr8tr CLI │ ───────────▶ │ skr8tr_sched │ The Conductor │ (Rust) │ ◀─────────── │ ML-DSA-65 auth │ Masterless scheduler └──────────────┘ └────────┬────────┘ │ LAUNCH via UDP :7775 ┌────────▼────────┐ │ skr8tr_node │ Fleet node (N nodes) │ fork + exec │ Runs your workloads └────────┬────────┘ │ REGISTER via UDP :7772 ┌────────▼────────┐ │ skr8tr_reg │ The Tower │ (UDP :7772) │ Service discovery └─────────────────┘

// QUICK START

Up in five minutes.

Build from source, run three daemons, deploy your first workload.

Clone and build

# Dependencies: gcc (C23), liboqs ≥ 0.15, rustup
git clone https://github.com/NixOSDude/skr8tr
cd skr8tr
make                               # builds all C23 daemons
cd cli && cargo build --release    # builds the CLI
cp cli/target/release/skr8tr ~/.local/bin/

Generate your signing keypair (once per operator machine)

bin/skrtrkey keygen
# → skrtrview.pub (1952 bytes) — copy to conductor host
# → ~/.skr8tr/signing.sec (4032 bytes, chmod 600) — stays here

Start the cluster

# On the conductor/tower host:
nohup bin/skr8tr_reg   > /tmp/tower.log   2>&1 &
nohup bin/skr8tr_sched --pubkey skrtrview.pub > /tmp/sched.log 2>&1 &

# On every worker node:
nohup bin/skr8tr_node  > /tmp/node.log   2>&1 &

# Optional: HTTP ingress
nohup bin/skr8tr_ingress --listen 80 --tower conductor-host \
  --route /api:api-svc --route /:frontend > /tmp/ingress.log 2>&1 &

Deploy your first workload

skr8tr ping                                                  # verify cluster is up
skr8tr --key ~/.skr8tr/signing.sec up examples/api.skr8tr   # deploy
skr8tr list                                                  # verify running
skr8tr logs api-server                                       # tail logs

// ENTERPRISE & CONSULTING

Skip the k8s migration hell.
We've already done it.

Skr8tr is Apache 2.0 — free forever. For teams that want expert deployment, custom integrations, or enterprise-grade features (RBAC, audit logs, SSO), we offer hands-on professional services.

RBAC & Namespaces

Role-based access control with team namespaces, ML-DSA-65 signed per-team keys, and permission scopes: read / submit / evict / admin.

Audit Export

Structured, cryptographically chained audit log shipped to S3, Elasticsearch, or any SIEM. Tamper-evident, append-only, queryable.

SSO / OIDC

Identity federation with your existing IdP — Okta, Azure AD, Google Workspace. Bridge OIDC tokens to ML-DSA-65 signing credentials.

Multi-tenant Conductor

Resource quotas, namespace isolation, and per-team scheduling policies — run multiple product teams on one Skr8tr cluster safely.

// CONSULTING

Cluster Setup & Migration

$1,500 / day

We design and deploy your Skr8tr cluster — bare metal, cloud, or hybrid. Migration from Kubernetes: workload audit, manifest conversion, ingress routing, CI/CD rework, PQC key provisioning.

Bare metal, cloud, or hybrid clusters
Full k8s migration (workloads, ingress, CI/CD)
PQC key provisioning + operator training
30-day post-deployment support included

Get a Quote →

// ARCHITECTURE REVIEW

Infrastructure Audit

$1,000 flat

A focused 2-hour deep dive into your current orchestration stack. We identify bottlenecks, security gaps, and waste. Written recommendations delivered within 48 hours — actionable, no fluff.

Current stack analysis (k8s, ECS, Nomad, etc.)
Bottleneck + security gap identification
Written report with prioritized recommendations
1 follow-up call included

Book a Review →

// TRAINING

Team Workshops

$2,000 / day

Half-day or full-day workshops for engineering teams. Topics: C23 systems programming, Skr8tr operations, post-quantum security fundamentals, and migrating off Docker/k8s.

Remote or on-site
Customized to your stack and team level
Hands-on labs with your real workloads
Workshop materials + recording included

Inquire →

All serious inquiries get a response within 24 hours.
Include your node count, workload types, and current orchestrator — we'll come back with a concrete proposal.