One filesystem.
Every protocol. Any backend.
Simple to run, versatile by design. DittoFS serves your files over NFS and SMB with no client agents to install, and stores them on any backend you choose, from local disk to S3. No FUSE, no kernel modules, no appliance.
- NFS + SMB
- served together
- Any S3 backend
- multi-cloud
- Native clients
- no FUSE, no kernel
- One binary
- pure Go
Versatile
No lock-in
Zero agents
Portable
Why teams choose DittoFS
Network storage without the usual baggage
Standard protocols, your own backends, and nothing proprietary in the path. Fewer moving parts to deploy, secure, and pay for.
Nothing to deploy on clients
DittoFS speaks NFS and SMB natively, so machines mount it with the clients they already ship. No FUSE, no kernel modules, no agent to roll out or keep updated across a fleet.
No vendor lock-in
Serve the same data from any S3-compatible backend, on any cloud, on-prem, or the edge. Switch providers or go hybrid without re-platforming your applications.
No appliance, no licensing
Open-source software on hardware you already own. Compute and storage scale on their own, with no proprietary NAS or SAN, no per-shelf fees, and no forklift upgrades.
Security you can attest to
Client-side encryption, NFSv4 and Windows ACLs, and Kerberos. Running in userspace means no privileged kernel access, and your object store only ever holds ciphertext.
Other network filesystems
- Install a kernel driver (FUSE) on every client, with privileged access
- Or rewrite applications against a language-specific SDK
- An agent to deploy, update, and troubleshoot on every machine
DittoFS
- Speaks NFS and SMB natively, the clients every OS already ships
- No application changes. Mount a share and read and write files
- Nothing privileged to run, nothing per-machine to manage
Why DittoFS
Storage decisions, decoupled from protocols
Decouple the interface your clients speak from the backend your data lives on, per share, so storage choices never dictate how teams connect.
protocols
Multi-protocol, one server
NFS and SMB run at the same time on the same server, serving the same files to Linux, Windows, and macOS.
backends
Pluggable storage
Mix metadata stores (memory, BadgerDB, PostgreSQL) and block stores (filesystem, S3) per share.
runtime
Runs in userspace
No FUSE, no kernel modules, no root. DittoFS runs as an ordinary process you can start anywhere.
security
Client-side encryption
Per-remote envelope encryption with AES-256-GCM or ChaCha20-Poly1305, keyed locally or via KMIP. Blocks are encrypted before they leave the server, so the object store only sees ciphertext.
efficiency
Deduplication
Files split into content-defined chunks, addressed by BLAKE3 hash. Identical chunks across files are stored once.
control plane
REST control plane
Manage users, groups, and shares through a JWT-authenticated REST API or the dfsctl command line. Provision by script, not by editing config files.
And more
- Easy to containerize One static Go binary drops into any container or orchestrator.
- Compression Remote block stores compress with zstd or lz4 before upload.
- Share snapshots Point-in-time holds with no data copy. Restore from CLI or REST.
- Kerberos and signing RPCSEC_GSS, SPNEGO Kerberos, SMB3 signing and transport encryption.
- Cross-platform ACLs NFSv4 and Windows/SMB ACLs enforced consistently across clients.
- Cross-protocol xattrs Extended attributes (RFC 8276 over NFSv4.2, native over SMB) read and write the same values across protocols.
No lock-in
Object storage, with filesystem semantics
DittoFS puts real NFS and SMB on top of any S3-compatible object store. Serve the same bucket from any cloud, on-prem, or the edge. Your data follows your architecture, not a vendor.
Bring your own backend
Multi-cloud and hybrid
Serve the same data from AWS, MinIO, Ceph, Cubbit DS3, or a local disk. Move between clouds and the edge without re-platforming.
No appliance to buy
Run it on commodity hardware or a VM you already pay for. There is no NAS controller to size and no capacity to license up front, and compute scales separately from the storage behind it.
Runs anywhere
One static binary on a laptop, a bare-metal edge box, a VM in any cloud, or Kubernetes with the official operator.
How it works
Three clean layers
Adapters speak protocols. The runtime owns every operation. Stores hold the bytes. Each layer is replaceable on its own.
Protocol adapters
NFS and SMB adapters handle wire framing, dispatch, and type conversion. Nothing more. Business logic never leaks into the protocol layer, so you can add a protocol by implementing the adapter interface.
Runtime control plane
A single entrypoint composes users, shares, mounts, and identity. Every operation carries an auth context from the wire all the way to the store.
Pluggable stores
Each share picks a metadata store and a block store. A fast local cache fronts a durable remote, syncing in the background. Bring your own by implementing the store interface.
Capabilities
What each protocol does
The same data, exposed through different protocols. Capabilities follow what each protocol can express.
| Capability | NFSv3 | NFSv4.1 / 4.2 | SMB2 / 3 |
|---|---|---|---|
| Mount & file I/O | supported | supported | supported |
| ACLs | not applicable | supported | supported |
| Extended attributes | not applicable | supported | supported |
| Kerberos auth | supported | supported | supported |
| Leases / delegations | not applicable | supported | supported |
| Wire encryption | partial | partial | supported |
| Client-side encryption | supported | supported | supported |
| Snapshots | supported | supported | supported |
supported partial not applicable
From zero to mounted
A share in five commands
Start the server with dfs, then
drive it with dfsctl: create a
share, enable a protocol, mount it, write a file. The write lands
locally and syncs to the remote.
The write path
Local first, durable second
Fast where it counts: users hit the local tier, not the network. Writes land locally and are acknowledged immediately. A background pass then dedupes, compresses, and encrypts before syncing to durable storage.
The local tier stays the fast path. The remote is the source of truth, and it only ever holds deduplicated, compressed ciphertext.
- 01 Write, acked locally. The client writes to a mounted share. DittoFS appends to a per-file log and acks from the local cache right away, with no network round trip in the hot path.
- 02 Chunk and dedupe. A rollup splits the log into content-defined chunks (FastCDC), addresses each by BLAKE3 hash, and deduplicates against blocks already stored.
- 03 Compress, encrypt, sync. The syncer uploads new blocks to the durable remote, S3 or filesystem, optionally compressed and encrypted. Reads verify each block by hash.
Use cases
Where it fits
One server, many shapes. Consolidate systems instead of stacking them. Because protocols and storage are decoupled, DittoFS adapts to where your data needs to live and who needs to reach it.
Multi-tenant cloud
Host many tenants on shared infrastructure without crossing streams. Isolated shares, per-tenant stores, and client-side encryption keep data separated.
Tiered storage
Keep hot data fast and cold data cheap. A local cache fronts durable S3, so users hit the local tier while data syncs to the remote in the background.
Hybrid Linux and Windows
Consolidate mixed fleets onto one server. Linux over NFS, Windows and macOS over SMB, all serving the same data instead of running parallel systems.
Dev and test
Ship faster with a throwaway filesystem in one command. In-memory, no FUSE, no privileges, nothing external to provision.
Cloud-native deployments
Drop a single userspace binary into Kubernetes with the operator. Scale shares, not kernels, with no privileged DaemonSets to maintain.
Backup and recovery
Guard against accidental deletes with point-in-time snapshots that copy no data, restorable from the CLI or REST API in seconds.
Built in the open
Honest about where we are
DittoFS is under active development and not yet production-ready. We would rather tell you that up front, and show you the path. The core works today; we are hardening it toward a 1.0 you can run with confidence.
- Shipped Working today
- Multi-protocol engine: NFSv3/v4/4.1/4.2 and SMB2/3
- Pluggable metadata and block stores
- Client-side encryption, dedup, and compression
- REST control plane, CLI, and Kubernetes operator
- In progress Where we are
- Stability and performance hardening
- Wider test coverage and benchmarks
- Deployment guides and reference docs
- Next What's coming
- Production-ready 1.0
- Managed PRO console with role-based access
- Commercial support tiers
Follow progress and open issues on GitHub.
DittoFS PRO
A management UI and support, on top of the open core
The community edition is fully open source. PRO adds a web management UI and commercial support for teams that run DittoFS in production.