Pre-1.0 v0.8.1 — one ISO, one node or a cluster. Keep production data off it.
Your own enterprise cloud, on your own hardware.
An open-source, multi-tenant cloud you install on your own servers, behind the cloud API shape you already know.
The demo is a real cluster: create a Stratum Account and request access. Already in? Sign in.
Who it is for
People who own servers and want a cloud on them.
-
An IT department with a rack
Several teams on one set of hardware, with real boundaries.
-
A company that keeps its keys
Data, network and secrets stay in your building.
-
A lab, or a first look
One x86 machine shows you the platform.
Pre-1.0 software, no vendor support. What it costs.
What it is
A cloud, not a hypervisor manager.
One Go control plane on stock Linux servers, over deliberately boring parts. Multi-tenant from the first login: organizations, projects, policies, audit. One ISO covers a single node and a cluster.
The substrate
- libvirt / KVM
- compute
- OVN
- multi-tenant networking
- LVM-thin / Ceph
- storage (Ceph on a cluster)
- PostgreSQL
- control-plane state
- podman + systemd
- everything that runs on a host
The console
A complete console, easy to use.
Everything the API can do. Captured 2026-09-19, before v0.8.1; click to enlarge.
-
Project home Findings, instances, alarms, storage and capacity against quota. -
Instances Every list is the same table: search, filters, sort, saved views. -
VPC topology Subnets, gateway and external address, drawn from the live VPC. -
Stratum Database A managed Postgres with its endpoint inside your VPC. -
Auto Scaling Groups over launch templates, with health-checked replacement. -
Machine images Images from instances, imports and Image Builder recipes. -
Object storage S3-compatible buckets with per-project keys and policies. -
Secrets Manager Versioned secrets with rotation, fetched from inside the VPC.
How it is built
Declare what you want; a reconciler makes the hardware match.
A create is recorded and answered at once; reconcilers converge the hardware.
Three shapes, one binary
- available
Single node
The platform on one server. No fault tolerance.
- available, current focus
Hyperconverged
3 to 5 nodes, each running everything. Survives a node failing.
- planned
Disaggregated
Control plane, hypervisors and storage on their own machines. Not started.
What works today
16 platform services, and the managed services built on them.
If it is not on this list, it does not exist yet. Object storage, Auto Scaling and the database need a cluster.
| Service | What you get | Built on |
|---|---|---|
| Stratum API | One API, one identity, one audit trail; on every control-plane node of a cluster. | Go, PostgreSQL, keepalived, Patroni, raft |
| Compute | Instances, shapes, cloud-init, serial console, cold and live migration, evacuation. | libvirt / KVM |
| Block storage | Volumes, pools, storage classes, encryption. | LVM-thin, Ceph RBD on a cluster, LUKS |
| Networking | VPCs, subnets, security groups, gateways, floating IPs, peering. | OVN |
| Load balancing | Application load balancers with TLS termination and health checks. | axlbd, a Go data plane per VPC |
| DNS | Public and private zones, per-VPC resolution, ACME DNS-01. | axdnsd + Unbound recursors |
| Object storage | S3-compatible buckets, keys, policies, versioning, lifecycle. Cluster only. | Ceph RGW |
| Machine images | Capture, import, share, publish; scheduled Image Builder recipes. | qcow2 on the volume drivers |
| Auto Scaling | Launch templates, groups, scaling policies, instance refresh. Cluster only. | the reconciler on workload metrics |
| Identity | Organizations, projects, roles and policies, OIDC, an ARN on every resource. | Cedar policies, argon2id, OIDC |
| Secrets Manager | Versioned secrets, rotation, sharing, in-VPC fetch. | OpenBao, envelope encryption |
| SSH access | Short-lived host and user certificates. | SSH CA |
| Client VPN | Per-VPC WireGuard endpoints for remote access. | WireGuard on OVN |
| Security posture | Software inventory and vulnerability findings from an agent in each instance. | the instance agent, feed matcher |
| Observability | Metrics, logs, traces and alarms for the platform and tenants. | VictoriaMetrics, VictoriaLogs, Tempo, OTel |
| Audit | A hash-chained, verifiable event for every meaningful call. | PostgreSQL |
Managed services
Built on the platform services, for tenants who want the thing rather than the parts: a resource in your project, an endpoint in your VPC.
| Service | What you get | Built on | Status |
|---|---|---|---|
| Stratum Database | PostgreSQL today; Valkey, MongoDB and MariaDB planned. Endpoint in your VPC. | Auto Scaling, images, networking, DNS, Secrets, object storage | shipped cluster only; other engines planned |
| Stratum Kubernetes | Hosted control planes, node groups as your instances. | Auto Scaling, machine images, load balancing, networking | planned no tenant API yet |
| Managed backup | Backup plans, vaults and restore for volumes. | block storage; an operator-set backup target | partly shipped volumes only |
| Messaging | Topics and queues. | a replicated message substrate the tenant never sees | planned no spec yet |
Single node or cluster
One ISO installs both.
-
Single node
One machine runs everything. For a lab, an edge site or a first look. No fault tolerance.
-
Hyperconverged
3 to 5 machines, each running everything. Survives a machine failing; adds object storage, the managed database and Auto Scaling.
Four ways in
One contract, generated from one document.
What one can do, all four can.
-
REST API
The cloud API shape you already know, generated from a single OpenAPI 3.1 document.
-
Terraform provider
Declare the whole estate as code.
-
stratumctl
A CLI for the same surface, with shell completion.
-
Web console
Every resource, every action, on one consistent table-and-drawer standard.
stratumctl login
stratumctl instances create web-01 \
--image img-… --instance-type m1.small --subnet subnet-… \
--public-ip --key-pair laptop
stratumctl instances listresource "stratum_vpc" "demo" {
project_id = var.project_id
name = "demo-vpc"
cidr_block = "10.50.0.0/16"
internet_gateway = true
}
resource "stratum_instance" "app_a" {
project_id = var.project_id
name = "app-a-1"
instance_type = var.instance_type
image_id = var.image_id
subnet_ids = [stratum_subnet.app_a.id]
security_group_ids = [stratum_security_group.app.id]
}curl -H "Authorization: Bearer $STRATUM_TOKEN" \
https://console.example/v1/projects/p-…/compute/instances
# every resource carries an ARN and answers the same verbs:
# GET /v1/projects/{project}/db/instances
# POST /v1/projects/{project}/db/instances -> 202, status=creating
# PATCH /v1/projects/{project}/db/instances/{id} -> pending changesThe demo
A real cluster, your own organization on it, free.
Request it from your Stratum Account. It is a lab: it sleeps at night and nothing on it is safe to keep.
The demo tier
- Instances
- 3
- VPCs
- 1
- Floating IPs
- 1
- Load balancers
- 1
- Buckets
- 3
- Databases
- 1
From the blog
What broke, what shipped, and why.
- 2026-09-19
The demo is open
A real cluster you can ask for an invite to, an account portal that provisions your own organization on it, and the same console, CLI and Terraform provider an install ships with. What you get, what it costs (nothing), and what to expect from a lab that sleeps at night.
- 2026-09-19
Stratum Database: a managed Postgres with the endpoint in your VPC
The first managed service built on Stratum's own auto scaling spine. What shipped in the first three slices, the one rule that decided where the endpoint lives, and what a VM being killed under a running database looks like from the outside.
- 2026-08-10
What Stratum is
An enterprise cloud you install on your own hardware. The decisions that actually matter are where the tenancy lives, why the substrate is deliberately dull, and why a node's role is a bootstrap choice rather than a different product.
Questions people ask
- Is it Kubernetes?
- No. It runs virtual machines, networks and storage: the layer Kubernetes would run on. Managed Kubernetes is planned.
- What hardware does it need?
- x86 servers with virtualisation and UEFI: one to look, 3 to 5 for a cluster. See what it costs.
- Does it phone home?
- No. The console news widget is the one optional exception, off unless the operator sets a feed.
- What does it cost?
- Nothing. Free software under the AGPL-3.0; the source opens at 1.0.0.
How this compares
Software you install on hardware you own — not a provider, not a hypervisor manager. The comparison page puts it next to a public cloud, OpenStack and Proxmox VE, row by row.