Substrate cloud platform
Substrate is the control plane for your infrastructure. It turns a bunch of machines into your own private cloud platform, ready to run workloads. You get the convenience of managed services, but on your own hardware, under your control.
Managed cloud services such as a managed database and managed Kubernetes, come at the cost of giving up privacy and control. Moreover, the cloud gets prohibitively expensive at scale. On the other end of the spectrum, maintaining your own server fleet and the system software on top is a big commitment and requires a specialized skill set. You spend time and money on busywork that is not your core business, such as keeping the hosts up to date, reachable, and compliant. Substrate automates that part, so your platforms team can focus on what matters for your product.
Substrate consists of an open source daemon that runs on every host, and a public source control plane. Together they implement composable primitives that turn your machines into a useful cluster. Many tools make it easy to run the 80% of your workloads that fit the paradigm, while being so hopelessly unsuitable for the remaining 20% that the cure is worse than the disease. Substrate is not like that. It does not dictate how you should run your workloads; rather it’s a toolkit that enables your platforms team to build and automate. Continuous deployment workflows, release automation, advanced failover automation … Substrate gives you the building blocks, so your team can focus on what is unique to your infrastructure.
Substrate primitives
A single global view of your fleet
A single dashboard shows you all your hosts, across multi-cloud, multi-vendor, and hybrid setups. See at a glance what runs where, and whether a machine is vulnerable to known CVEs. Build your own tooling on top of the API.
Image-based OS with managed updates
Every node runs an immutable Linux distribution with A/B boot and automatic rollback. Rollouts are staged across your fleet with automated health checks, and you can restrict reboots to your maintenance window.
Disk encryption with automatic unlock
Machines authenticate to the control plane at boot for unattended unlock. The key is split between you and the control plane, so Substrate alone cannot decrypt your disks.
Encrypted virtual private network
All nodes join a unified encrypted mesh network. Connect on-prem, colocation, and cloud. Substrate handles key distribution and peer configuration subject to ACLs.
End-to-end encrypted secrets management
Built on top of trusted machine identity, our workload receives the secrets scoped to it. Every secret is encrypted with a per-machine key, and every access audit logged. The control plane never sees your secrets.
Service discovery and routing
Cluster-wide DNS and stable IPs for every service. IPVS at the kernel level routes traffic directly to the right node, with zero proxy hops. Fully programmable with healthchecks and geodistribution.
Managed or self-hosted, at your option
The easiest way to start managing a fleet with Substrate is through our managed control plane. We offer enterprise-grade security and reliability with a 99.99% uptime SLA, and you sidestep complex bootstrapping and disaster recovery questions. The control plane never sees your data: it decides which machines can connect to each other and which disks to unlock, but it does not see your network traffic, nor the contents of your disks. For situations where depending on a managed service is unacceptable, you can alternatively host the control plane yourself. You can even verify our reproducible binaries from source.
Private beta access
Substrate is currently under private development. We use it to run our own production fleet, and the partners we work with get early access. Interested in joining the private beta? Tell us a bit about yourself, your infra, and your use case, and we’ll add you to our waitlist.