Beta

Layers Scale

Containers without the baggage.

Layers Scale

The Layers Scale is Tophan’s application packaging and deployment system. It uses immutable overlayfs layers to compose applications — no daemon, no socket, no runtime to secure, no container escape to worry about.

The Problem with Containers

Traditional container platforms run a privileged daemon that manages everything. That daemon has root access, listens on a network socket, and is a high-value target for attackers. Container escapes are a well-documented attack class, and the entire security model depends on a single daemon not having bugs.

Tophan’s Layers Scale takes a different approach: applications are composed from immutable filesystem layers using the kernel’s own overlayfs. There’s no daemon to compromise because there’s no daemon at all.

Features

FeatureDescriptionStatus
Immutable Base LayersApplication base images are read-only. Always. No runtime modification possible.Stable
Application LayersEach application is a thin layer on top of a shared base. Only the differences are stored.Beta
Layer CompositionStack layers in any order. Base OS + runtime + application + configuration = running workload.Beta
DeduplicationIdentical layers across applications are stored once. 50 apps sharing the same base = 1 copy on disk.Beta
Image ManagementBuild, sign, verify, and distribute layer images. Private registries with content-addressable storage.Beta
Security ScanningEvery layer is scannable against known vulnerability databases. Scan at build time, at deploy time, and continuously.Planned
Namespace IsolationApplications run in separate Linux namespaces. Process, network, mount, and user isolation.Stable
Resource Limitscgroups v2 resource control. CPU, memory, I/O, and PID limits per application.Stable

How It Works

┌─────────────────────────┐
│    Application Config   │  Environment, ports, mounts
├─────────────────────────┤
│    Application Layer    │  App binaries + libraries
├─────────────────────────┤
│     Runtime Layer       │  Language runtime (if needed)
├─────────────────────────┤
│      Base OS Layer      │  Minimal root filesystem
└─────────────────────────┘
         overlayfs

At runtime, overlayfs merges these layers into a single coherent filesystem. The application sees a normal Linux root. Changes during execution go to an ephemeral upper layer that is discarded when the application stops.

No daemon assembles this. The kernel does it natively. tophand manages lifecycle (start, stop, health checks), but the isolation is a kernel primitive, not a userspace construct.

vs. Traditional Containers

AspectTraditional ContainersTophan Layers
Runtime daemonYes (privileged)None
Network socketYes (attack surface)None
Escape attacksWell-documented classNo daemon to escape to
Image formatProprietaryStandard overlayfs
DeduplicationPer-host onlyCluster-wide
ImmutabilityOptionalMandatory