drift Docs
Start
What is Drift?
The tour, if you are new here.
Why Drift?
Two reasons, and they are independent.
The case for a small cloud
What disappears, and what it costs you.
Made in Europe
Built, hosted and owned in the EU.
Use cases
Whether Drift does your thing.
Getting started
Nothing to deployed, in one command.
Architecture
How a slice is put together.
What it costs
The free grant, four unit prices, two rules.
Build
Atomic
Serverless functions.
Write a function
The handler shape, and what you pay for.
Six languages
Go, Python, Node, Ruby, PHP, Rust.
Runtime versions
Which interpreter version your function runs on.
Authentication
The auth= gate, and per-route API keys.
Request headers
What reaches your handler, and what does not.
Triggers
Queue-triggered and scheduled functions.
Streaming
SSE and WebSocket from one function.
Outbound egress
What a slice may dial.
Memory and concurrency
What a booking buys, and what happens at the edge of it.
Limits and alerts
Timeout, memory and rate, and being told.
Elements
One language, one manifest, many functions.
The CLI surface
Every drift atomic command.
Backbone
Secrets, data, blobs, queues.
NoSQL
JSON collections, upserted on _id.
SQL
Per-slice SQLite, with transactions.
Blobs
Files and uploads, organised by bucket.
Secrets
Encrypted config a function declares.
Queues
FIFO messages that trigger functions.
Cache
Key/value strings with a TTL.
Locks
Stop two workers doing one job.
Realtime
In-slice pub/sub over WebSocket.
Canvas
Static sites, same origin as your API.
Deed
Identity, devices and wallets.
KeyAuth
Passwordless login with device keys.
JWT
Sign and verify with the slice's own key.
Vault
Ciphertext the slice cannot read.
Link
Enroll a second device by attestation.
Pocket
E2EE app data that follows an identity.
Tools
CLI
One binary, every noun.
Reference
The binary, and every noun.
account
Sign up, log in, delete.
slice
Create, resize, snapshot, domains.
file
Lint it, apply it, run it.
atomic
One function at a time.
backbone
Reach into the data plane.
deed
One read-only status command.
canvas
Deploy a static site.
migrate
Move off another cloud.
doctor
Explain a failure code, offline.
Dashboard
What bare drift opens.
SDK
Six languages, zero dependencies.
Writing a handler
Arguments, request, return.
API reference
Both namespaces, every call.
NoSQL
Documents, by _id or storage key.
SQL
Queries and transactions.
Cache
Strings with a TTL.
Secrets
Read what the function declared.
Blobs
Bytes, addressed bucket/key.
Queues
Push, and pull if you must.
Locks
A token you hand back.
Realtime
Publish, and count who heard.
Deed
KeyAuth, JWT, Vault, Link, Pocket.
Utilities
Logs, egress, cross-slice calls.
Languages
The same handler, six ways.
Driftfile
One file that describes your app.
Anatomy
Every top-level key, and the name rules.
A worked example
One app with every section written out.
Atomic
Function limits, schedules, alerts, egress.
Backbone
Collections, databases, buckets, secrets.
Canvas
Sites, and the route each mounts on.
Domains
Custom hostnames the slice answers on.
Environments
One project, several slices, one file.
Deploying
Lint it, hook a build on, read its errors.
Operate
Auth
Route gates, API keys and your account.
Security
Boundaries, sandboxing and hardening.
Troubleshooting
Error codes
What went wrong, and what to do about it.
Legal
Acceptable use
What a slice may not be used for.
Data processing
The DPA, and every sub-processor.

atomic

Functions, one at a time. drift file apply covers the whole project; these are for working on a single function and for operating what is live.

Develop

Command Description
drift atomic new [name]Scaffold a function: one flat source file in an element, not a folder. Interactive, or drive it with -l go, -m post, -q <queue>, -a apikey, -e <element>.
drift atomic deploy <dir>Build and ship every function the Driftfile declares in <dir>, leaving the rest of the project alone (Go, Python, Node, Ruby, PHP, Rust)
drift atomic run <dir> [--function name] [--port N]Run one declared function locally with hot reload. --function picks which one when the folder declares several.
drift atomic fetch [path]Resolve dependencies for every function under a path

Operate

Command Description
drift atomic listList deployed functions (flat or grouped by element)
drift atomic logs <name> [-n N] [-f]Fetch function logs (-f streams new lines)
drift atomic logs purge <name>Clear a function's in-memory logs
drift atomic metrics <name>Request count, error rate, and average duration
drift atomic delete <name>Delete a deployed function

Roll back

Command Description
drift atomic history <name>Show a function's deployment history
drift atomic rollback <name> <position>Roll back to an earlier deployment (positions from history)
drift atomic redeploy <name>Re-deploy the last known artifact

A function is addressed by method and path.

delete, redeploy, rollback and history all take --method/-m. A function is addressed by method and path, so without it get:x and post:x are indistinguishable by name.

Authentication

Command Description
drift atomic auth set <fn> <key> [-m method]Set or rotate a function's API key
drift atomic auth list <fn>List the API keys configured for a function (fingerprints, not raw keys)
drift atomic auth revoke <fn> [-m method]Revoke a function's API key

A key set without --method get protects nothing.

set and revoke default to --method post. Setting a key for a GET route without --method get reports success and protects nothing. A configured key also overrides the declaration, making a route apikey-protected even if it shipped as auth=none. See Authentication.

Elements & triggers

Command Description
drift atomic element listList functions grouped by element
drift atomic trigger listList registered triggers
drift atomic trigger register queue <name> --queue Q --target URL [--poll-ms N] [--max-retry N]Poll a Backbone queue and invoke a function on each message. Defaults: --poll-ms 500, --max-retry 3 before a message moves to its dead-letter queue.
drift atomic trigger register schedule <name> --cron "..." --target URLFire a function on a 5-field cron schedule
drift atomic trigger unregister <name>Remove a trigger

Alerts

Command Description
drift atomic alert add <name> <function> [--on errors] [--threshold N] [--window 5m] [--notify webhook=URL]Register an alert (v1: an error-count trigger, a webhook notification)
drift atomic alert listList alerts on the active slice
drift atomic alert remove <name>Remove an alert

Alerts can also be declared per-function in the Driftfile. The deploy writes every alert the manifest declares; one that is live and no longer declared is left in force and named in apply's closing report, not removed. Take it away with drift atomic alert remove <name>.

Egress

Command Description
drift atomic egress listShow the slice's active mode, declared hosts, and the IPs last resolved for them
drift atomic egress refreshRe-resolve DNS and re-apply the allowlist
drift atomic egress test <host>Does this host match the active allowlist? A local pattern match, with no DNS and no call to the platform. A “did I spell it right” tool.

There is no add or remove. The Driftfile's atomic.egress block is the source of truth; these commands are for inspection. In open mode every public host is reachable; in allowlist mode only the resolved IPs behind the declared hosts are, and a host that is not declared is refused. Either way, private RFC-1918, link-local and CGNAT ranges are always blocked. See the Atomic guide for the full model.