Locked-down CI runners, HPC nodes, sandboxes, and networks where the only way out is HTTPS.
PodUtils is a family of small Rust tools that still work there, one static binary at a time.
| Tool | What it does | Status |
|---|---|---|
| pod | One installer for every PodUtils tool: install, pin, verify, update, roll back | soon |
| podcat | Pipe bytes between sockets, tunnels and processes, like netcat and socat | soon |
| podci | Run CI/CD actions on pods | soon |
| podfs | File system tools for restricted hosts and sandboxes | soon |
| podinfo | Fetch and probe a host: what it is, and what it lets you do | soon |
| podinit | Turn a fresh Linux server into a locked-down fleet node in one command | soon |
| podkey | An in-memory secret agent with a time window, like ssh-agent for any secret | soon |
| podlog | Ship logs and metrics from a node over HTTPS, with buffering and redaction | soon |
| podmesh | Mesh networking between hosts behind NAT and strict firewalls | soon |
| podnet | Tunnels, WARP and per-process proxying in one binary | beta |
| podnode | The one agent of a fleet server: enrol, supervise, self-update, no open port | soon |
| podrelay-worker | The podssh relay as a Cloudflare Worker with Durable Objects | soon |
| podrepl | Continuous SQLite replication between nodes and to object storage | soon |
| podrunner | Ephemeral CI runners on your own servers, one fresh unit per job | soon |
| podshell | A resilient remote terminal, a mosh alternative for strict networks | soon |
| podsnap | Encrypted, append-only backups with signed manifests and verify | soon |
| podssh | SSH from machines whose only way out is HTTPS, through a WebSocket relay | beta |
| podutils | The PodUtils umbrella: install and manage the whole family | soon |
| podvm | Container runtime for rootful-but-restricted sandboxes, CI executors and HPC nodes | beta |
| podwatch | Outside prober and heartbeat that alerts once and closes on recovery | soon |
Shared libraries for all of them live in podcrates.
- One static binary. No installer, no runtime, no shared libraries. Copy it and run it.
- No root, no daemon. Built for hosts where you get a shell and little else.
- Made for hostile networks. Proxies, HTTPS-only egress and blocked UDP are the normal case, not the edge case.
- Free to use. Everything is under 0BSD.
Made with care, for the machines that make it hard.