Architecture
What a slice is
A slice is one running thing, always on. The four pillars aren't four services you wire together. They share one process, one disk and one lifetime. That is why a Canvas page can call an Atomic function on the same origin, and why a function reaches your data without crossing a network.
| Pillar | Who can reach it |
|---|---|
| Canvas | The internet. The only part of a slice the outside world reaches. |
| Atomic | Your own site, through Canvas's /api/*. Never addressed directly from outside. |
| Backbone | Your functions only, with one exception: Realtime channels, which browsers reach through Canvas at /realtime/<channel>. Nothing else in Backbone has a public endpoint to secure, because nothing else has one at all. |
| Deed | Your functions only. |
A slice runs as one thing and never as two. Your data sits where exactly one of them may hold it, so nothing is scaled up or down behind you, and nothing is scaled to zero either, which is why there are no cold starts to design around. The one capacity dial you set is memory per invocation, and you pay for what you set rather than have it adjusted for you.
How a function runs
Atomic runs each call in its own short-lived child process, sealed by a kernel-level filter installed before your code's first instruction. Any attempt to start a second process, re-exec, or attach to another is refused by the kernel rather than caught by a convention. Your function is the only child there will ever be.
Python and Node skip the per-call start: one long-lived server per language holds every deployed function of that language and dispatches by name. Go and Rust are compiled ahead of time, so there is nothing to warm up. Ruby and PHP get a fresh interpreter per call.
The four pillars
Every Drift app is built from four building blocks: Atomic, Backbone, and Canvas do compute, data, and hosting; Deed is a fourth, identity, sitting alongside the other three rather than under any of them. Use one, use all four. They're designed to click together, so your site can call your functions, your functions can reach your data, and your users can be who they say they are, with nothing to wire up.
Atomic Compute
Atomic runs your code as functions: small HTTP endpoints you write in the language you already know. You push the code; Atomic builds it, gives it a route, guards it, and keeps it reachable. A function is a source file with a one-line directive above the handler that sets its route and its authentication.
| Capability | What it does |
|---|---|
| Functions | HTTP API endpoints, zero boilerplate, multiple languages. |
| Elements | Group related functions into a single logical service. |
| Schedules | Run functions on a cron-style timetable. |
| Triggers | @atomic queue=<name> runs a function on queue messages instead of HTTP requests, and keeps it off /api/*. |
| Auth | auth=none or auth=apikey on the directive. Setting a key on a route forces apikey, whatever the directive says. |
| Logs & metrics | Structured logs in real time; request counts, durations, error rates. |
Backbone Data
Backbone is the encrypted data plane your functions talk to. It bundles the primitives most apps reach for (documents, files, secrets, queues, cache, coordination, and realtime) behind one simple interface, so you don't assemble (and pay for) five separate services.
| Capability | What it does |
|---|---|
| NoSQL | Document collections with indexing for fast lookups. |
| SQL | Per-slice SQLite databases with schemas and transactions. |
| Blobs | Object storage for files, uploads, and assets. |
| Secrets | Encrypted at rest, fetched per invocation and injected into the functions that name them. |
| Queues | FIFO message queues for background and asynchronous work. |
| Cache | In-memory key/value store for hot reads. |
| Locks | Coordination primitives so work isn't processed twice. |
| Realtime | In-slice pub/sub: live messages fanned out to subscribed clients over WebSocket. |
Canvas Hosting
Canvas hosts your website or frontend. Point it at a folder and it serves your site over HTTPS at your slice's URL. Its best trick: a Canvas site can call its own Atomic functions on the same origin: no CORS to configure, no separate API domain, no tokens to shuttle between two services.
| Capability | What it does |
|---|---|
| Static hosting | One-command deploy of any static site or single-page app. |
| Same-origin APIs | Call your Atomic functions from the browser with no CORS setup. |
| Custom domains | Bring your own hostname; TLS is issued and renewed for you. |
| Automatic TLS | Every site gets a certificate out of the box, with nothing to request. |
Deed Identity
Deed answers who a user is and lets them prove it. It is a peer of Atomic, Backbone, and Canvas, not a primitive under any of them, because identity is a different kind of problem than compute, data, or hosting. It runs on its own listener, separate from Backbone's, but it's reached through the SDK exactly like everything else.
| Capability | What it does |
|---|---|
| KeyAuth | Passwordless Ed25519 device-key auth that issues your slice's own session JWT. |
| JWT | General-purpose HS256 sign/verify with your slice's own signing key. |
| Vault | Zero-knowledge, user-scoped recovery store: the slice holds ciphertext it can't read. |
| Link | Multi-device continuity: enroll a second device via a signed attestation. |
| E2EE per-identity app data, following an identity across every enrolled device. |