Container orchestration in one binary — containerd, its own eBPF datapath, Let's Encrypt TLS, GitOps, autoscaling, and an MCP server. No Kubernetes.
Kanea is a lightweight container orchestration platform written in Go. Services run on containerd, networking and load balancing are Kanea's own eBPF datapath, TLS comes from Let's Encrypt, a per-node CA, or certificates you already have, and it ships a real-time shadcn/ui dashboard, an MCP server for AI agents, GitOps pipelines (rootless BuildKit), eBPF-driven autoscaling, and encrypted S3-backed state replication with backup and restore.
Website · PRD · Threat model · DR runbook
The installer fetches the binary, verifies it, and stops. Checksum verification is mandatory and there is no flag to skip it; the Sigstore signature is verified too when cosign is on PATH. It generates no keys and starts nothing.
kanea init then installs the runtime — containerd, runc and rootless buildkitd — at versions pinned by SHA-256 in the binary (PRD §5.2.12). The network layer needs no component: the eBPF datapath is compiled into kanea itself (§5.2.5). It installs under its own prefix on its own socket, so a node that ran Docker yesterday runs it tomorrow.
Prefer to do it by hand? Every release publishes kanealinux.tar.gz, checksums.txt, and a keyless cosign signature over the checksums:
There is no long-lived signing key to guard: the signature is bound by Sigstore to the release workflow in this repository, and the proof is in a public transparency log.
Homebrew ships the CLI, not the node (PRD §5.2.12): on macOS you get the authoring half — kanea plan validates job specs with file-and-line diagnostics, no daemon needed — while the platform itself runs on Linux. On a Linux machine
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/m18h--kanea.html)
Self-hosted error tracking. A drop-in for Sentry and AppSignal SDKs: one Go binary and Postgres, with Slack, Linear, email and an MCP server for coding agents.
Dokoyamo-Lisa/MeridianA panel for proxy and VPN servers: Xray (VLESS/REALITY, VMess, Trojan, Shadowsocks), Hysteria2 and WireGuard, with users' own pages, a live status globe, country rules, a REST API and MCP.
Resetnak/cooldeckKeyboard-first terminal dashboard for Coolify: deployments, live logs across your whole fleet, and an MCP server for your agent
helv-io/skgateAny MCP server. Anywhere. An OAuth-protected MCP gateway that can also run the servers, plus SI provider proxying with model aliases, and your Grok subscription as an OpenAI-compatible API with no API
mkk2026/agentregDNS for AI agents: a self-hosted registry to register, discover, and health-check MCP agents. One Go binary.
YigitCittan/mongorescueSelf-hosted MongoDB backup and disaster recovery: streaming mongodump to disk or S3, safe-clone restores, encryption, alerts, web dashboard and MCP server. Single Go binary.
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.