Cygnus

Cygnus is a self-hosted serverless runtime for Bun and Node.js applications. It runs unmodified applications in kernel-sandboxed, scale-to-zero cages using namespaces and seccomp instead of containers.

The system consists of a single Rust binary that serves as the daemon. It terminates TLS, routes requests by SNI or Host header with a lock-free ArcSwap, and proxies through io_uring splice. Cages maintain no certificates and hold no administrative capability. The daemon remains in the data path to centrally enforce logging, metering, and rate limits rather than relying on tenant self-reporting. Isolation relies on user namespaces, mount namespaces, PID namespaces, network namespaces, cgroups version 2, and an allowlist of approximately 80 syscalls under seccomp. Writable mounts are mounted noexec while the read-only artifact mount permits execution.

Performance benchmarks show proxy overhead at 0.4 ms p50 and revival times with p99 of 42 ms within a 150 ms budget. Example workloads include one application achieving 298 requests per second, another at 84 requests per second with 11 ms p50 latency, and a third at 214 requests per second with 9 ms p50 latency. A cold start for one workload measured 29.4 ms from request to first user-code byte. The installation command is a one-line shell script that fetches and sets up the binary.

It supports HTTP/1.1, HTTP/2, and HTTP/3 over TLS, with per-app Unix sockets that maintain keep-alive connection pools. The approach eliminates the need for a container runtime, image registry, or YAML configuration files. The tool addresses the overhead associated with container-based deployments while preserving full Node.js compatibility and isolation guarantees.