5
production regions
CoreLink is a multi-tenant, content-addressed cache and execution fabric — live on Cloudflare's network across five production regions — where identical work is never repeated and compute is a disposable cursor over a shared store. The bill follows the structure: flat concurrency instead of metered minutes, zero egress instead of transfer fees.
Software re-does finished work constantly: the same dependency compiled on a million machines, the same node_modules filling a million disks, CI re-testing code nobody touched. Give every piece of work a content address, do it once, share it. Watch it run below — the logs are real.
$ clw snapshot --name demo-journey . # tree → content-addressed snapshot $ clw hydrate /tmp/fresh --name demo-journey $ clw -v run --input src -- cargo test # memoized: unchanged inputs never re-run▋
npm, PyPI, Homebrew and OCI — every public wheel, bottle and layer is fetched from upstream once, ever, then served from a shared, content-addressed mirror across every tenant. Your private work stays walled off in TLA+-proven isolation; the public commons is shared.
_public mirrorcontent-addressed · token-gated · zero-egress R2One bet, applied three ways: if work is a pure function of its inputs, then the cache, the CI runner, and your working tree are all just addresses over the same content-addressed store.
Inside your tenant, every artifact is addressed by what it is (BLAKE3), not where it lives — so your whole team holds one copy of everything, shared across every laptop, CI job and region. A teammate's build becomes your instant hit; CI's compile lands warm on your laptop. Private, isolated, and yours.
CAS + Action Cache keyed by BLAKE3/SHA-256. Identical inputs resolve to identical outputs — computed once, anywhere, reused everywhere. Your tools already speak it: Bazel REAPI v2, Turborepo, sccache.
Cross-tenant byte non-leakage is a formal spec that runs in CI on every change. Each blob path is HMAC-derived over tenant identity under a key the edge can't read — another tenant's path can't even be guessed.
Memoize whole build actions, not only their outputs — an unchanged action never re-executes anywhere in your org. Native Bazel REAPI v2 and Turborepo remote caching, with a per-tenant $-ceiling that fails closed. (Public packages get their own shared mirror — below.)
Stored on Cloudflare R2 across five regions — pulling from the cache is free, exactly where S3-backed caches bleed on transfer fees. Residency is enforced per tenant, not assumed.
$ bazel build //... --remote_cache=…humangr.com 1,284 artifacts · 1,190 hits (92.7%) $ pip install --index-url …/pip/acme numpy numpy ← _public mirror (upstream once, ever) ✓ tenant path = HMAC(tenant) · un-guessable ✓ audit ed25519 chain · verified offline
Runners boot cache-warm and replay memoized steps instead of re-running them. Fresh, fail-closed microVMs; cryptographically signed outcomes; and a bill that goes flat instead of counting minutes.
Inputs are already local when the job starts, and memoized steps replay instead of re-running. The repeats — the compile nobody changed, the test nobody touched — cost nothing.
Each job gets a fresh microVM, destroyed afterward. Images are digest-pinned and refused unless verified; boxes carry per-lease scoped tokens, never master credentials.
Every result returns as an Ed25519-signed attestation binding the full outcome — inputs, image, result — verifiable offline, with no trust in the runner required.
Flat per parallel runner, unlimited minutes — modeled well under hosted per-minute CI at typical use, before memoization zeroes the repeats entirely.
# job picked up — boots cache-warm ▸ inputs local · 0 bytes downloaded ▸ microVM fresh · fail-closed · digest-pinned ✓ # memoized steps replay; unchanged never re-runs ✓ cargo build replayed from memo · 1.2s ✓ cargo test ok. 214 passed; 0 failed ▸ teardown microVM destroyed · token expired ✓ attestation ed25519:9f3c1a… outcome bound
clw snapshots a directory into the store and hydrates it on any machine in seconds — only the chunks that machine is missing travel. Heavy checkouts stop duplicating themselves across every laptop and runner.
clw snapshots a whole tree into a single content-addressed ref. The working tree stops being a place on a disk and becomes an object you can move by name.
Only the chunks a machine is missing travel — a fresh box pulls from zero-egress R2, a warm one from local L1. Seconds, not a full re-clone, on every machine.
clw run memoizes by inputs — unchanged inputs never re-run, they replay the recorded result. Compute becomes a disposable cursor you point at work.
Shipped to Homebrew, five-target releases minisign-signed, per-crate SBOM, a local L1 cache. The journey in the hero ran these exact commands.
$ clw snapshot --name feature-x . root d82d924b…685043be · 3 chunks up $ clw hydrate ~/box --name feature-x bytes_from_cache 205 · downloaded 0 $ clw run --input src -- cargo test [clw] cache hit · replayed in 1.64s test result: ok. 1 passed; 0 failed
Spin up a tenant, point your build cache at CoreLink, and watch the cache-hit rate climb — with the tenant isolation and audit trail your security team will actually sign off on.
Get started free →