Early access · Node.js FaaS on Docker Swarm

Push your functions. We run the swarm.

BFast Cloud turns a GitHub repository of bfast-functions into a live, TLS-secured service. You get one-push deploys, per-service secrets, logs and a console your whole team can sign in to with Google.

Request early access →

4 function types
1 git push to deploy
0 servers to SSH into

deploy · my-functions_faas

$ git push origin main
→ github  push · main · a1b2c3d "Add /orders route"
→ webhook signature verified (per-service secret)
→ swarm   rolling update 1/2 … 2/2 converged
→ runtime cloned main · npm install · 6 functions
→ traefik https://my-functions.api.example.com TLS ✓
$ curl …/functions-health
{"message":"running"}

HTTP routesSocket.IO eventsCron jobsGuardsGit push deploysAutomatic HTTPSWrite-only secretsLive logsGoogle sign-inArchive & unarchivePer-user accessSwarm status

How it works

From your laptop to a live URL in five moves.

01
Scaffold a workspace
The bfast CLI creates a functions workspace with a functions/ folder and a bfast.json. Run it locally with file-watch reloads.
02
Export functions
Every exported descriptor becomes an endpoint: onRequest for HTTP, onEvent for Socket.IO, onJob for cron, onGuard for middleware.
03
Push to GitHub
A signed webhook reaches BFast Cloud. The HMAC signature is checked with your service's own secret, and only pushes to the default branch of the matching repository deploy.
04
Swarm rolls it out
Docker Swarm replaces tasks one at a time. Each new task clones your default branch, installs dependencies and loads your functions.
05
Live over HTTPS
Traefik routes your hostnames and issues Let's Encrypt certificates automatically. Health and function listings are built in.

terminal

$ npm i -g bfast-tools
$ bfast fs create my-functions
  ✓ bfast.json
  ✓ package.json
  ✓ functions/index.mjs
$ cd my-functions && bfast fs serve
  listening on :3000 · watching files

functions/index.mjs

export const orders = {
  method: 'post',
  path: '/orders',
  onRequest: async (req, res) => {
    res.status(201).json({id: crypto.randomUUID()});
  }
};

export const live = {
  name: '/live',
  onEvent: ({body}, res) => res.announce(body)
};

push → main

POST /github-webhook/my-functions_faasX-Hub-Signature-256: sha256=9f2c…e41a

Signature matches service secret
Event is a push
Ref is the default branch
Repository matches GIT_CLONE_URL

Restart requested

manager-1

worker-1

worker-2

old task new task

🔒 https://my-functions.api.example.com/orders

HTTP/2 201
content-type: application/json

{ "id": "7c0e…b2" }

Certificate · Let's Encrypt · auto-renewed

bfast-functions

Four descriptors. Everything a backend needs.

Plain JavaScript objects. No framework lock-in, no build step: Express under the hood for HTTP, Socket.IO for realtime, node-schedule for jobs.

HTTP routes

Express request and response objects, any method, any path. Omit path and the route becomes /functions/<name>. Add a description and it appears on the built-in /functions-all page.

export const hello = {
  method: 'get',
  path: '/hello',
  description: 'Greets the caller',
  onRequest: (req, res) =>
    res.json({message: `Hello ${req.query.name}`})
};

Socket.IO events

Each descriptor is a namespace. Reply to the sender, broadcast, announce to everyone, or join topics for rooms.

export const chat = {
  name: '/chat',
  onEvent: ({auth, body}, res) => {
    res.topic(body.room).join();
    res.topic(body.room).announce(body.message);
  }
};

Scheduled jobs

Cron-style rules powered by node-schedule. Reports, clean-ups and reminders live next to the code they belong to.

export const nightlyReport = {
  rule: '0 2 * * *',
  onJob: async () => {
    await sendDailySummary();
  }
};

Guards

Middleware for authentication, rate limits or logging, mounted globally or on a path prefix.

export const apiKey = {
  path: '/orders',
  onGuard: (req, res, next) =>
    req.get('x-api-key') === process.env.API_KEY
      ? next()
      : res.status(401).end()
};

The console

Day-to-day operations, without SSH.

BFastCloud / Swarm managerdev@team.io · user

Services

orders_faas2/2 running

shop_faas1/1 running

legacy_faasarchived

orders_faas

OverviewEnvironmentSecretsAuto-deployLogs

DATABASE_URL••••••••••••

STRIPE_KEY/run/secrets/stripe-key

MODEgit

12:04:11 orders_faas.1 | POST /orders 201 18ms12:04:13 orders_faas.2 | GET /functions-health 20012:04:15 orders_faas.1 | job nightlyReport scheduled

Environment editorText, file and Base64 values, hidden until revealed.
Write-only secretsVersioned Swarm secrets mounted under /run/secrets.
Auto-deployPayload URL, per-service secret, pause, rotate and delivery history.
Logs & tasksTail the last 1,000 lines and see why a task failed.
ArchiveScale to zero when a project sleeps; unarchive in one click.
Team accessAssign services to Google accounts; nobody sees what isn't theirs.

Platform

Built on boring, proven infrastructure.

⇪

Git push deploys

Point a GitHub webhook at your service. Pushes to the default branch roll out; pushes to feature branches are recorded and ignored.

🔒

HTTPS everywhere

Traefik with Let's Encrypt. Default hostnames per project, plus your own domains.

⟳

Rolling updates

Docker Swarm replaces tasks one by one and restarts them on failure.

⚙

Resource limits

CPU and memory limits per service, plus replica count and restart policy.

◎

Swarm status

Nodes, roles, availability and every service's running versus desired tasks.

{ }

Bring your npm packages

Your package.json dependencies install on start. Run from Git, an npm package or a tarball URL: MODE=git, npm or url.

Security

Secure defaults, not optional extras.

Everything that changes your services is authenticated, signed and scoped.

Signed deploysGitHub HMAC-SHA256 signatures, with a separate rotatable secret for every service.
Google identityFirebase-verified Google accounts with verified email only.
Hardened sessionsHttpOnly, Secure, SameSite=Strict cookies with CSRF tokens and exact-origin checks.
Secrets stay secretSwarm secrets are write-only and never returned by the API or written to logs.
Least privilegeUsers only reach their assigned services. Infrastructure services are read-only.
No surprise deletesServices are archived, not deleted, from the console.

Plans

Start free during early access.

Pricing will be announced before general availability. Early-access teams keep their setup.

Developer

Free during early access

Functions services on the shared Swarm
Git push deploys over HTTPS
Environment, secrets and logs
Community support

Request access

For teams

Team

Everything in Developer
Multiple services and teammates
Custom domains
Higher CPU and memory limits
Priority support

Talk to us

Self-hosted

Run the stack on your own servers
Your Swarm, your data, your domains
Setup assistance
Open-source runtime and CLI (MIT)

Email us

Documentation

Read the docs, straight from the source.

Docs are pulled live from the public bfast repositories, so they always match the code.

Start

Getting started

Install, write, run, push, deploy.

Runtime

Function specification

HTTP, events, guards and jobs.

CLI

bfast-tools

Create and serve workspaces locally.

Cloud

Console & deploys

Webhooks, roles, secrets and operations.

FAQ

Questions developers ask.

What do I need to deploy?

A GitHub repository containing a bfast-functions workspace. Your package.json dependencies install when the service starts, and the default branch is what runs.

Can I use private repositories?

Yes. Set GIT_USERNAME and a GIT_TOKEN on the service, ideally through a Swarm secret.

How do I store API keys?

Create a Swarm secret in the console, attach it to your service, then set an environment variable to its /run/secrets/… path. The runtime loads the value at start-up.

What happens to a service I'm not using?

Archive it. It scales to zero replicas and keeps its configuration, secrets and hostnames. Unarchive starts one replica again.

Is it open source?

The runtime (bfast-functions), the CLI (bfast-tools) and the deploy webhook are on GitHub. You can run the stack on your own Swarm with the self-hosted plan's help.

Ship the function.
Skip the servers.

Get early access →Read the guide