Form a private cluster
Run one authenticated Pepper agent per machine. Nodes advertise capacity, discover peers over QUIC, and repair durable content after failures.
$ pepper-agent --config node.toml
Pepper 0.2.0 · Developer preview
A private data fabric, across your machines.
Store immutable content by CID, build linearizable key-value spaces, versioned buckets, and filesystem histories, serve them through native tools or S3, and run Firecracker jobs close to the data.
5 peers · healthy
BLAKE3
verified CIDs
QUIC
encrypted transport
3
Raft replicas per namespace
S3
SigV4-compatible gateway
HOW IT WORKS
One mesh. Multiple data models.
Each agent contributes the storage and compute you choose. Pepper handles identity, placement, integrity, consensus, durable publication, and repair across the cluster.
Choose a data primitive
Use immutable blocks and objects directly, or create a transactional KV namespace, versioned bucket, or filesystem.
$ pepper namespace create --kind kv
Use any healthy ingress
Reads and writes route to providers or the current Raft leader. CIDs, revisions, receipts, metrics, and history make results verifiable.
$ pepper namespace status <namespace>
BUILT FOR BORING RELIABILITY
Storage, transactions, and compute—together.
Pepper 0.2.0 builds transactional services on verified content-addressed storage, with quorum durability and operations designed for real node failure.
Verified immutable storage
Blocks, chunked objects, directory DAGs, replication, and Reed-Solomon erasure coding are addressed by BLAKE3 CIDs and verified on read.
Transactional namespaces
Three-node Raft groups provide linearizable KV, conditional writes, atomic transactions, stable scans, immutable history, snapshots, and rollback.
Versioned buckets and S3
Native buckets retain object versions and tombstones. The opt-in S3 gateway supports SigV4, ranges, copy, checksums, and durable multipart uploads.
Filesystem history
Object-backed files and Merkle-map directories produce structurally shared atomic commits with checkout, diff, restore, rollback, and cloning.
Durability before visibility
Publication leases and synchronized pins protect staged DAGs, and namespace mutations become visible only after required replicas acknowledge the data.
Firecracker compute
Data-local microVM jobs consume CID inputs and return bounded outputs, logs, cancellation state, and signed receipts as durable content.
Self repairing
Capacity-aware placement, provider records, corruption recovery, replication repair, erasure repair, and safe learner replacement restore healthy state.
Private by default
Cryptographic node identities, encrypted authenticated QUIC peers, a loopback-only HTTP API, bearer auth, and S3 SigV4 credentials keep boundaries explicit.
Operable through failure
Readiness, Prometheus metrics, bounded diagnostics, signed backups, verified restore, identity fencing, checkpoints, and explicit disaster recovery support operators.
OPEN SOURCE · BUILT IN RUST
Build on your own machines.
Start with verified immutable storage. Add transactional data services and sandboxed compute when you need them—all inside a private cluster you operate.