panto
contact

Store it once.
Materialize it anywhere.

One content-addressed store per machine. Containers, VMs, and archives deduplicate against each other, and mount straight from it.

panto mount ubuntu/24.04 /mnt/rootfs

Measured

8×1
less image on disk when eight machines boot the same one
4.2×2
more duplicate content found than layer deduplication
3.1×3
less fetched before a VM is up and serving
  1. 89.5 MB read for eight guests against 530.6 MB for eight copies, and flat as the count rises.
  2. 12.2% of this fleet is shared content, against the 2.9% its registry can see.
  3. 21.8 MB of a 67.2 MB image read to reach a login prompt.

44 images · linux/amd64 · one production host

One store, many machines

8×less image on disk for eight machines

Eight machines, one copy.

Eight boots normally means eight copies. Here it means one, plus whatever each machine differs by.

aarch64 · KVM

Bytes read from the device, one to eight guests booting concurrently.

What a host actually keeps

An image is stored twice before anything runs.

A host keeps the layers it pulled and the extracted copy the union mount reads. panto keeps one store and serves it.

44 images backing the services on one production host

4× less disk for the same 44 images
a container host 11.5 GB
one panto store 2.8 GB
  • compressed tarballs, 3.2 GB
  • extracted layers, 8.3 GB
linux/amd64

Every version, still there

Scrub back through a machine like a document.

Every snapshot is a complete tree, so going back to one is a mount, not a restore.

Launch before it lands

Start a VM before its image has downloaded.

The root disk is a block device backed by the store, so a machine can netboot with no local copy at all. Blocks arrive from the remote as it asks for them, verified on the way in.

21.8 MB read of a 67.2 MB image

How it works

No server A directory of blobs behind range requests or S3. Nothing to run.
Nothing in the kernel Served over stock FUSE or an ordinary NBD device.
No database to operate Plain files published by rename. The index is derived, so losing it costs time, never data.
Verified on read Content is re-hashed against the id it claims, on by default.
One writer, many readers A lock file, not a daemon. Nothing has to be running to read a store.
Nothing to migrate The on-disk format is frozen, and every parser is fuzzed against corruption.

Get in touch.

For fleets that pull the same large artifacts over and over.

[email protected]