Autback
Illustrated desert landscape beneath a star-filled sky and coral clouds

Remote execution for trusted teams

Heavy work.
Light laptop.

Remote tests and native image builds on compute you control.

Explore Autback See how it works
leapview / production
Worker connected
task test
$ autback exec -- task test
project leapview image sha256:40d2…
CPX32 · active 4 vCPU / 8 GB Full machine available
Job job_01K…3.893s
source 0 B uploaded runner starting task test passed exit 0
0 Brepeat source upload
13.68 sbuild + push median
1 jobthe whole machine
Apache-2.0open source

Built on the tools you already trust

REAPI CAS OCI Buildx BuildKit Testcontainers GitHub OIDC

Execute

Run anything without a pipeline language.

Your repository keeps its Taskfile, Makefile, scripts, and argument vectors. Autback adds the remote boundary—not another workflow format.

Repository contract
leapview / test ● live
Repository command $ autback exec \
  --cache go-build=/root/.cache/go-build \
  -- task test
authdevice tokenok
sourceREAPI CAS0 B
workerOCI sha256:40d2…active
resulttask testexit 0
Project-owned OCIPin the complete environment as code.
Arbitrary argvNo shell interpretation unless you request it.
Testcontainers readySibling containers use the worker Docker daemon.

Sync

Only the change crosses the wire.

Git chooses the exact worktree. REAPI Merkle trees and FindMissingBlobs upload only content the shared CAS does not already have.

Source architecture
worktree1,921 files
Shared CAS ea34… hit 9f02… hit 41c8… hit
0 Btransferred
Dirty bytes includedTracked and non-ignored untracked source.
Ignored files excludedLocal databases, secrets, and outputs stay local.
No clone driftThe uploaded tree is the worktree you invoked.

Strict FIFO

One queue. The whole machine.

Every dispatcher submits to one durable first-in, first-out queue. One active operation gets the worker’s available CPU and memory.

Operations model
shared worker4 vCPU · 8 GB
  1. 01task testrunning
  2. 02build --pushqueued
  3. 03task browser:testqueued
capacity follows the active job
Durable admissionQueue and active lease survive restart.
No resource profilesDeploy unchanged on a larger or smaller VPS.
Parallel within the jobYour task runner owns useful concurrency.

Build

Native Buildx in. Immutable digest out.

Autback gives Buildx a short-lived mTLS connection to upstream BuildKit. Your Dockerfile, registry, and standard flags remain unchanged.

Build and smoke-test
GitHub Actions autback build -- --push -t ghcr.io/flidai/app:sha .
Manifest pushedghcr.io/flidai/app@sha256:9f34…
13.68 s
Upstream BuildKitNo custom image builder protocol.
Short-lived mTLSThe CLI never receives Docker access.
Exact-digest proofSmoke-test what the registry will deploy.

Measured, not estimated

Warm-cache proof on an 8 GB VPS.

Observed on the existing Hetzner CPX32 during the LeapView proof on 2 August 2026.

Read the complete methodology
0 Brepeat test source upload
13.68 sproduction build + push median
13.31 ssite build + push median
3.89 sgeneric warm E2E sample

Workload-specific measurements with committed raw boundaries—not universal performance claims.

A deliberate boundary

Powerful because it trusts you.

Autback is for a small team, its own projects, and trusted pull requests. Jobs may use the Docker socket for Testcontainers. That is host control, not a sandbox.

LocalPer-device tokens

Revocable credentials stored by the operating-system keyring.

GitHubOIDC exchange

Short-lived project credentials bound to repository and workflow policy.

WorkerPrivate Docker

Only the control plane reaches Swarm; clients never receive host credentials.

Your compute. Your commands.

Send the hard work out back.

Open source remote execution for the trusted middle ground.

Explore the repository Deploy to a worker