Keel
A security-first HTTP(S) core small enough to disappear — 5–8 MB, TLS 1.3-only — that wraps legacy services in modern compliance without a rewrite.
5–8 MB
Scratch-style production image
TLS 1.3
Only, by default
10+ years
The durability target
Compliance is a rewrite nobody funds.
A legacy HTTP service fails modern security posture — TLS policy, OWASP headers, authentication, authorization, observability — and the usual fix is a rewrite or a heavyweight service mesh. The tools that could wrap it instead are either not application-integrated, like nginx and HAProxy, or a kitchen sink that dwarfs the app it protects.
So the real competitor is the status quo: services left non-compliant because hardening them costs more than anyone will spend.
The smallest secure core.
01
A minimal, security-first core
Keel is the smallest useful subset of an HTTP(S) server, fully app-integrated: TLS 1.3-only, OWASP hardening, JWT and mTLS authentication, external OPA or HTTP authorization, tracing and metrics. Everything is default-on and opted out at build time, so nothing you do not use is linked and images land in the 5–8 MB range.
02
Keel-haul legacy into compliance
Run Keel as a sidecar envelope around an old HTTP or HTTPS app — sharing its pod or proxying a remote upstream — and it owns TLS, authentication, hardening, observability and backpressure without a single change to the application.
03
Backpressure before the OOM
Keel watches heap usage and flips its readiness probe before the process is OOM-killed, so the load balancer drains it gracefully instead of dropping requests. Built to behave predictably in Kubernetes, systemd and the boring infrastructure that has to run for a decade.
Released, and boring on purpose.
| Milestone | Status | Evidence |
|---|---|---|
| HTTP(S) core — library + sidecar | Running | Released, open source |
| TLS 1.3, OWASP, authn / authz | Running | Default-on |
| FIPS-compatible build (BoringCrypto) | Running | Documented |
| SBOM + provenance per release | Running | Attached to releases |
Keel is released and open source. The container-size and durability figures are the project’s stated targets and its own measurements — verify against the SBOM and provenance attached to each GitHub release.
"30,000-star boring."
The roadmap is deliberately conservative — stable APIs, HTTP/2 and HTTP/3, ACME edge mode, more middleware — held under a ten-year durability bar and a goal its authors describe as thirty-thousand-star boring.
Keel is the studio’s first released proof. It stands on its own as open-source infrastructure while informing the sealed-build and sovereign-hosting work across the portfolio.