c9 — one namespace, every machine

01 — the idea

There is no cluster.
There is a filesystem.

No sessions, no scheduler dashboard, no orchestration language. c9 collapses everything you used to do with a fleet into five filesystem verbs.

c9 online→ls /

c9 join sanjeev→cd /sanjeev

c9 leave→cd ..

c9 pool→mkdir team

c9 join pool→cd team

deploy scripts→c9 ship ssh://…

The moment you are inside someone else's namespace, you are pooling.

02 — primitives

Six ideas. That's the whole system.

01

Presence is `ls`

Machines announce themselves over mDNS and the registry, then appear at /. Liveness is a heartbeat — when it stops, the folder vanishes. Nothing to configure, nothing to poll.

/ % ls
lightning/  rishabh@desktop/  team/  ws/

02

`cd` is join

Walking into a machine dials it over TLS, verifies its Ed25519 identity, and binds its resources into your namespace. Trust-on-first-use with persistent pins — a changed key fails loudly, never silently.

/ % cd /lightning
/lightning % cat specs
{"cores":4,"os":"linux/amd64"}

03

`mkdir` is a pool

A pool is a signed directory — {owner, seq, members, policy} under an Ed25519 signature. Membership is the capability: join and every member can use every other member. Leave and the capability is revoked.

/ % mkdir team
/ % echo 'join lightning' > team/ctl
/ % cat team/members
rishabh@desktop
lightning

04

`run` is a file

Jobs are namespaced processes. Write a spec, read back the id. Stream stdout, block on wait, signal with kill. Pool placement picks the least-loaded member — the job reports where it landed.

/ws % run cmd=python3 train.py cores=2
job 7
epoch 160: loss=0.2811 w=2.0101
[done 0]

05

Your workspace follows jobs

Every job stages your /ws onto the machine before it runs and syncs changes back after. Files live in your namespace; machines are pure compute. Transfer ceases to exist as a concept.

% cat ws/report.txt
trained on linux: y = 2.0090x + 0.8613

06

Real isolation when you ask

The runc backend runs jobs in OCI containers: images pulled from registries, cgroup quotas for cpu and memory, your workspace bind-mounted at /ws. Identical protocol, one flag.

/ws % run image=oci://python:3.12 \
      cmd=train.py cores=2 mem=1G

03 — a real session

This is not a mockup

Everything below ran against a real studio in a datacenter, over SSH tunnels, in one login session.

c9 shell

04 — architecture

Three moving parts. Nothing centralized.

▣

agent

one per machine · exports cpu, gpu, mem, run as files · enforces every limit

trust boundary

◎

registry

rendezvous only · heartbeats + signed pool defs · holds pointers, never data

kill it, nothing breaks

⌂

namespace

yours · composed by c9 login · relays 9P over verified TLS on walk

this tree is the computer

/                          ← one flat userspace
├── rishabh@desktop/        ← your machine
├── lightning/              ← a studio in a datacenter
├── team/                   ← a pool, made with mkdir
│   ├── ctl · members
│   └── run/  gpu/
└── ws/                     ← your workspace, it follows jobs

05 — security

Trust is explicit,
never implicit.

a Every hop is TLS

Nodes, registries, and namespaces serve 9P over TLS 1.3 with Ed25519 certificates. Keys are pinned on first use; revocation sticks; a changed key fails loudly.

b Capabilities, not logins

Pool membership is the access token. Joining grants mutual use, leaving revokes it, owners can issue direct tokens. Every resource-affecting write is gated and audited.

c The agent is the boundary

Whatever a client claims, the agent enforces cgroup, GPU, and container limits on its own hardware. A compromised machine simply looks offline to everyone else.

06 — deploy

One line brings a machine online

terminal

$ c9 ship ssh://user@ssh.lightning.ai
installing c9 on ssh://user@ssh.lightning.ai (10.9 MB)
online as /lightning (agent tunnel tcp!127.0.0.1!5690)
tunnels held by this process; Ctrl+C takes the machine offline

$ c9 shell
/ % ls
lightning/ rishabh@desktop-5sm9v72/ team/ ws/

07 — get started

Two commands

1

Install

go install ./cmd/c9

2

Log in

c9 login

identity is generated on first run. ls / shows every machine on your network. Done.

The architecture spec — the single source of truth — lives at ARCHITECTURE.md in the repo.

There is no cluster.There is a filesystem.