drift Docs
Start
What is Drift?
The tour, if you are new here.
Why Drift?
The case for a smaller cloud.
Getting started
Nothing to deployed, in one command.
Architecture
How a slice is put together.
What it costs
The free grant, five unit prices, two rules.
Build
Atomic
Serverless functions.
Write a function
The handler shape, and what you pay for.
The directive
Trigger, route, auth and secrets on one line.
Six languages
Go, Python, Node, Ruby, PHP, Rust.
Runtime versions
Which interpreter version your function runs on.
Authentication
The auth= gate, and per-route API keys.
Request headers
What reaches your handler, and what does not.
Triggers
Queue-triggered and scheduled functions.
Streaming
SSE and WebSocket from one function.
Outbound egress
What a slice may dial.
Limits and alerts
Timeout, memory and rate, and being told.
Elements
One language, one manifest, many functions.
The CLI surface
Every drift atomic command.
Backbone
Secrets, data, blobs, queues.
NoSQL
JSON collections, upserted on _id.
SQL
Per-slice SQLite, with transactions.
Blobs
Files and uploads, organised by bucket.
Secrets
Encrypted config a function declares.
Queues
FIFO messages that trigger functions.
Cache
Key/value strings with a TTL.
Locks
Stop two workers doing one job.
Realtime
In-slice pub/sub over WebSocket.
Canvas
Static sites, same origin as your API.
Deed
Identity, devices and wallets.
KeyAuth
Passwordless login with device keys.
JWT
Sign and verify with the slice's own key.
Vault
Ciphertext the slice cannot read.
Link
Enroll a second device by attestation.
Pocket
E2EE app data that follows an identity.
Tools
CLI
One binary, every noun.
Reference
The binary, and every noun.
account
Sign up, log in, delete.
slice
Create, resize, snapshot, domains.
project
Deploy, diff, run locally.
file
Lint and explain a Driftfile.
atomic
One function at a time.
backbone
Reach into the data plane.
deed
One read-only status command.
canvas
Deploy a static site.
migrate
Move off another cloud.
Dashboard
What bare drift opens.
SDK
Six languages, zero dependencies.
Writing a handler
Arguments, request, return.
API reference
Both namespaces, every call.
NoSQL
Documents, by _id or storage key.
SQL
Queries and transactions.
Cache
Strings with a TTL.
Secrets
Read what the function declared.
Blobs
Bytes, addressed bucket/key.
Queues
Push, and pull if you must.
Locks
A token you hand back.
Realtime
Publish, and count who heard.
Deed
KeyAuth, JWT, Vault, Link, Pocket.
Utilities
Logs, egress, cross-slice calls.
Languages
The same handler, six ways.
Driftfile
One file that describes your app.
Anatomy
Every top-level key, and the name rules.
A worked example
One app with every section written out.
Atomic
Function limits, schedules, alerts, egress.
Backbone
Collections, databases, buckets, secrets.
Canvas
Sites, and the route each mounts on.
Domains
Custom hostnames the slice answers on.
Environments
One project, several slices, one file.
Deploying
Lint it, hook a build on, read its errors.
Operate
Auth
Accounts, tokens and scopes.
Security
Boundaries, sandboxing and hardening.

Atomic Outbound egress

Calling Stripe, Slack or an SMTP host is ordinary work for a function. What a slice may dial is declared in the Driftfile.

The allowlist is declared, not enforced.

A Driftfile's hosts list is validated and recorded, and drift project deploy says so in as many words: it reports the allowlist as declared for N hosts, and not yet enforced by the platform. Every slice reaches the public internet as if the mode were open. Read the block as a statement of intended reach, and keep the authentication and secret hygiene you would have used without it. The private-range block below is a separate mechanism and it is live.
Driftfile
atomic:
  egress:
    mode: allowlist              # open | allowlist, default open
    hosts:
      - api.stripe.com
      - hooks.slack.com
      - smtp.sendgrid.net:587     # port defaults to 443
Mode What it declares
openAny public host on any port. The default, and what every slice does today.
allowlistThe intent to reach only the declared hosts, on the declared port (443 when omitted).

Private address space is blocked either way, and that block is real. RFC-1918 ranges, link-local (including the cloud metadata endpoint) and CGNAT are excepted from the slice's outbound network rule, so a function cannot reach the platform's internal services or anything on a private network whatever the Driftfile says.

The Go SDK carries an EgressDeniedError that wraps a refused dial with the host it was for, so a handler can tell “my allowlist is wrong” from “the remote is down” once the allowlist does gate traffic. It is Go's alone; the other five SDKs return the underlying dial error unwrapped.

Go
var denied *drift.EgressDeniedError
if errors.As(err, &denied) {
    return 502, "Bad Gateway", map[string]string{"host": denied.Host}, nil
}

Inspect and repair the list from the CLI:

Shell
drift atomic egress list                  # mode, declared hosts, resolved IPs
drift atomic egress test api.stripe.com   # local pattern match, no DNS lookup
drift atomic egress refresh               # re-resolve DNS and re-apply

There is deliberately no add or remove: the Driftfile is the source of truth, and drift project deploy reconciles the list when that block changes.

Three edges the list already has.

A *.example.com wildcard passes schema validation and egress test reports it as a match, but the resolver skips it, so list concrete hosts. Only IPv4 addresses become rules, so an IPv6-only host is not covered. And addresses are resolved when the list is applied rather than per request, which is what drift atomic egress refresh is for.