How Crate Works

Built on Bare Metal. Powered by Go. Designed for Speed.

Vol. I

Physics > Virtualization

Modern cloud gateways are slow because they are bloated. They run inside virtual machines, inside container orchestrators, inside shared VPCs.

Crate is different. We run compiled Go binaries directly on Bare Metal hardware. We bypass the "Virtualization Tax" to deliver sub-millisecond processing overhead.

Network: Docker Host Networking (Raw wire speed, no NAT bridge).

State: Redis (In-memory counters).

Storage: CockroachDB (Distributed consistency).

# Crate Runtime Specs OS: Custom Linux Kernel Memory: Direct Mapping Latency: < 0.5ms Isolation: Core Pinning

Vol. II

The Data Plane

The Gateway is the "dumb muscle" of the operation. It is stateless, fast, and designed to fail open.

Written in Go: We leverage lightweight goroutines for massive concurrency, allowing Crate to handle millions of simultaneous connections with minimal footprint.

Zero-Copy Routing: We inspect headers and route traffic without buffering the entire request body, keeping memory footprint incredibly low even under heavy file-transfer load.

Hot-Swapped Config: Routing rules and certificates are loaded directly into RAM. When you update a rule, the Gateway updates its internal map instantly via a Redis broadcast—no restarts, no dropped connections.

Zero-Copy Engine

Packet -> Destination

Vol. III

The Control Plane

Your dashboard and API configuration live in a separate "Control Plane" powered by CockroachDB.

Isolation: If our dashboard or billing API were to ever go offline, your API traffic keeps flowing. The Gateway caches everything it needs to run autonomously.

Visual Management: We map your routing rules into a visual tree, allowing you to audit your entire API surface at a glance and prevent routing conflicts before they happen.

Vol. IV

Zero-Downtime SSL

We built a custom ACME implementation to handle SSL at scale without manual intervention.

The Hijack: The Gateway listens on Port 80 but only processes one specific path: /.well-known/acme-challenge/. All other traffic is redirected to HTTPS.

The Proxy: Challenge requests are tunneled securely to our Control Plane, which negotiates with Let's Encrypt.

The Broadcast: Once a certificate is issued, it is saved to the database and broadcast to all Gateway nodes.

The Result: Your new domain gets a green lock in under 60 seconds, with zero config required on your end.

status: SECURE algorithm: ECDSA P-384 cert_expiry: In 89 days auto_renew: ENABLED

Vol. V

Global Rate Limiting

We don't just rate limit per-server; we rate limit globally.

We use Redis Lua scripts to perform atomic "Check-and-Increment" operations. This ensures that if you set a limit of 1000 req/sec, that limit is enforced accurately across our entire cluster, protecting your backend from abuse.

-- Global Rate Limit Logic local key = KEYS[1] local limit = tonumber(ARGV[1]) local current = redis.call("INCR", key) if current == 1 then redis.call("EXPIRE", key, 1) end return current <= limit

Distributed Atomic Counters

Propagated in <10ms

Experience Raw Performance.

Launch the console and see why developers are switching to Bare Metal gateways.