Introduction | Cellar

Cellar is a container orchestrator control plane for isolated sandboxes. This project implements the cluster identity layer (mTLS gRPC, Raft-replicated CA) and sandbox lifecycle (desired state in Raft, Docker + hardened runc on every node, userspace egress policy).

Clients: Go sdk/go and TypeScript @cellar/node talk to cellar-gateway over HTTPS — see Client API and the SDK pages.

Quick start

Initialize a cluster and join a worker

Install

Build binaries and install systemd units

Sandboxes

Create, exec, and network-isolate sandboxes

Client API

HTTP gateway, API keys, and SDKs