Skip to content
LimniFS

λιμνη · LIMNĒ · THE LAKE

A lake for
your data.

LimniFS is a content-addressed, compressed, immutable filesystem image format. Layered like a lake — warm surface, thermocline, cold deep. Merkle-rooted, network-native, signed.

0
External wire-format dependencies
4
Target adapter languages (Rust, Python, Ruby, TS)
Overlay chain depth (format-unbounded)
LAYER 3 · MANIFESTThe signed identity.magic · versions · feature flags · slab index · cryptoparams · EC params · DMS · delta · history · Merkle rootthermoclineLAYER 2 · FILESYSTEM METADATAThe Merkle B-tree.inodes · directory tree · xattrs · slice → drop mapsper-class Seine recordsdeterministic · content-addressed · delta-friendlyLAYER 1 · DROP STOREThe bulk bytes.slabs (4–64 MiB) · drops · solid windows · Reed-Solomon shardsslab 0slab 1slab 2slab 3+ Reed-Solomon shards (optional)SURFACETHERMOCLINEDEEP

DropId = BLAKE3(plaintext) · the same drop lives in many representations across all three layers

.features

Six invariants of the lake.

Every LimniFS decision ladders back to these six. Spec-first, custom wire format, OCP via registries.

.identity

Content-addressed identity

Every drop is named by BLAKE3 of its plaintext. Codec, encryption, and erasure coding are representations — they never change identity. Dedup survives re-encryption, re-compression, re-encoding.

.layers

Three-layer format

Drop store (bulk bytes), filesystem metadata (deterministic Merkle B-tree), manifest (small, signed). Each independently versioned. Each byte-addressable.

.tiers

Staged compression

Write fast with LZ4 (epilimnion). Deepen in the background with zstd, lzma, or brotli per class (hypolimnion). Identity never changes; readers stay tier-agnostic.

.deltas

First-class deltas & overlays

A delta is a normal image with a base_root. Stack them as overlays (meromictic chains are valid forever). Flatten for metadata-only compaction. Turnover for full repack + GC.

.locators

Locator-agnostic distribution

Slabs live behind file://, https://, s3://, ipfs://, or limni-p2p:// locators. Mirror racing fetches in parallel; lying locators are demoted. Manifest can live apart from drop store.

.crypto

Authenticated encryption, signed roots

AEAD registry (XChaCha20-Poly1305 mandatory baseline; AES-OCB; GCM; Ascon). HPKE per-recipient key wrap. Optional sigstore signature bundle over the Merkle root.

.quickstart

Three commands
to your first .lim image.

The limni CLI (from λιμναω, "to sketch a lake") packs, mounts, verifies, and re-distributes. Cross-platform; reproducible.

bash — limni
# press a directory into a .lim image
limni limn ./my-app -o my-app.lim

# verify content-addressed identity
limni verify my-app.lim

# mount read-only and explore
limni mount my-app.lim /mnt/lim

Output: my-app.lim — content-addressed, Merkle-rooted, ready for any locator.

.ecosystem

One org, four repos.

Separation is load-bearing: the spec lives alone so any language can implement from it; the Rust workspace lives alone for atomic cross-crate PRs; the legacy adapter lives alone as a license-scan boundary.

.begin

Dive in.

Read the spec. Dissect every byte. Build an adapter in your language.