JACO

The idea

Kubernetes is overkill for a handful of nodes, but plain Docker Compose stops being enough the moment you want more than one machine, real failover, and HTTPS that just works. JACO sits in that gap: a single self-contained orchestrator you can run across a few servers without standing up a control-plane zoo.

It ships as two binaries — jacod, the long-running daemon managed by systemd, and jaco, the operator CLI that talks to a local daemon over a unix socket and to peer daemons over TCP. Bring up one node, mint a join token, point the others at the leader, and you have a cluster.

What it does

JACO replicates cluster state through a HashiCorp Raft state machine, so the control plane survives node restarts and leader changes. A leader-only scheduler reconciles deployments with spread, pack, or pinned-host placement, performing rolling updates that never drop below your replica count.

Workloads run on the Docker engine driver, with a per-replica health watcher, image pulls that back off exponentially, and orphan reconciliation when a daemon reboots. Networking is where JACO gets opinionated: every (deployment, network) pair gets its own Docker bridge with deterministic /24 IPAM, joined into a WireGuard mesh and firewalled with nftables so east-west traffic is isolated by default, each bridge with its own DNS.

Ingress is handled by an embedded Caddy v2 reverse proxy. Per-route certificates are issued via ACME, with HTTP-01 challenge coordination and certificate storage backed by Raft — so any node can serve any route with valid TLS.

Installation

The recommended path is the signed package mirror at pkgs.jaco.sh — add the repo once and JACO upgrades with the rest of your system. Every published release is mirrored as signed APT, DNF, and Alpine repositories, verified against each release's SHA256SUMS before publishing. Full instructions live at jaco.sh/install.

# Debian / Ubuntu (apt)
curl -fsSL https://pkgs.jaco.sh/jaco.gpg \
  | sudo tee /etc/apt/keyrings/jaco.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/jaco.gpg] https://pkgs.jaco.sh/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/jaco.list
sudo apt update && sudo apt install jaco

# Fedora / RHEL / CentOS (dnf)
sudo tee /etc/yum.repos.d/jaco.repo <<'EOF'
[jaco]
name=JACO
baseurl=https://pkgs.jaco.sh/rpm
enabled=1
gpgcheck=0
repo_gpgcheck=1
gpgkey=https://pkgs.jaco.sh/jaco.gpg
EOF
sudo dnf install jaco

# Alpine (apk)
sudo curl -fsSL https://pkgs.jaco.sh/jaco.rsa.pub \
  -o /etc/apk/keys/jaco.rsa.pub
echo "https://pkgs.jaco.sh/alpine/v3" \
  | sudo tee -a /etc/apk/repositories
sudo apk update && sudo apk add jaco

Prefer a one-off binary? Every release also ships .deb, .rpm, .apk, and a generic .tar.gz for linux/amd64 and linux/arm64, plus a SHA256SUMS manifest.

curl -fsSL -O https://github.com/PatrickRuddiman/JACO/releases/latest/download/jaco_<arch>.deb
sudo dpkg -i jaco_<arch>.deb
sudo systemctl enable --now jaco

Initialise the first node, then join the rest:

sudo jaco cluster init
JACO_TOKEN=<operator_token> jaco node issue-join-token
sudo jaco node join --peer <leader-host>:7000 --token <single-use>

License

MIT