An S3 proxy in front of your bucket, with the same API and no changes to your clients:
Built by Beshu Tech (the ReadonlyREST team), which serves its own 1.71 TB build catalog through the proxy in production. Our engineers write it with Claude as a coding aid, and we say so in the commit trailers.
This is a screen recording of the real product. In it we create an encrypted, compression-enabled backend, route a bucket to it, set up a user, and then upload a versioned file. The upload lands at 96.7% smaller on disk, measured live.
These are the same ten uploads of a 91 MB build artifact, stored two ways. The bars are proportional. We draw the deltas with a two-pixel floor, or they would be invisible.
The gap widens with every release. By v100 it's 9.1 GB against about 106 MB, which is 8,600% smaller. Our own release catalog landed at 8,850% smaller on a real release line.
The proxy stores each upload as a binary diff against a full reference copy that it keeps beside it, and every read rebuilds the exact original. All of this sits behind the same S3 API your tools already speak.
It speaks the S3 protocol your tools already speak: SigV4 signing, multipart uploads, range reads, presigned URLs. Repoint the endpoint; nothing else changes.
s3:
- endpoint: https://s3.eu-central-1.amazonaws.com
+ endpoint: https://dgp.internal:9000
access_key_id: ${AWS_ACCESS_KEY_ID} # unchanged
secret_access_key: ${AWS_SECRET_KEY} # unchangedxdelta3 files next to a plain reference
object, so the stock CLI can rebuild every file without the
proxy running.
Point it at Hetzner, Wasabi, MinIO, or AWS. Per-user IAM, SSO, replication, lifecycle, and encryption at rest ship in the same binary.
You get IAM with fine-grained ABAC permissions, plus OAuth/OIDC SSO with group mapping. That’s an access layer your budget object store doesn’t have.
Replicate buckets between providers, event-driven or scheduled, with pause and resume. Use it to migrate or to run multi-cloud without lock-in.
The proxy encrypts objects with AES-256-GCM before they hit the bucket. Your key stays in your runtime, so the backend only ever sees ciphertext.
Replication, lifecycle, migrations, and re-encryption run as resumable jobs with run history. The proxy can send every event to a webhook or to Slack. It keeps an audit trail of each admin action, and it shows live operational logs that you can tail and filter in the browser.
Run several instances on shared S3 storage. They sync users, groups, and SSO settings through an encrypted database in a bucket, elect one leader per replication rule with automatic failover, and lock each delta baseline across nodes. The Kubernetes operator puts them behind a router that keeps each multipart upload on one pod.
The proxy config is one YAML file. The admin UI edits it and exports it back, and secret references like ${env:NAME} survive the round trip. The config lint command checks a file offline, and in declarative mode the YAML also owns users, groups, and SSO providers.
These screens ship inside the binary you download. Click one to enlarge it.
Each answer links to something you can check yourself.
Every delta read is rebuilt and checked with SHA-256 against the hash recorded at upload. More than 2,000 unit tests and an integration matrix against a real MinIO must pass before every merge.
Read the source: every line is publicWe pushed our own 1.71 TB release catalog through the proxy. Upstream TMPDIR, proxy timeouts, and EBS exhaustion broke along the way, and we published every bug with its fix.
Read the migration logA correctness audit by five investigators found 10 bugs. We fixed all of them, pinned each one with a regression test, and wrote them up bug by bug where you can read them.
The bug-by-bug CHANGELOG
The people whose names are in git log. Your mail
goes directly to the engineers who wrote the code.
The engineers in git log, with help from Claude
(Opus 5.5 in the latest commits); most of the commits are by
Simone Scarduzio, the founder of Beshu Tech. Nearly nine in ten commits on
main carry a Co-Authored-By: Claude
trailer that names the model used for that commit, starting
with the first release in December 2025. The engineers make
the commits and answer for them; the model works from
CLAUDE.md, a public file in the repo with the
architecture rules and the design decisions it may not change
(shelling out to the xdelta3 CLI is one). Every commit, with
or without Claude, goes through the same gate: more than 2,000
unit tests, the MinIO integration matrix, clippy with warnings
as errors, a RustSec audit, and cargo-deny.
These quotes are about ReadonlyREST, Beshu Tech's main product. The same engineers built it in 2017 and work on it today.
Our largest shared cluster [...] consolidates about 17 different use cases on the same hardware, lowering the total cost.
ReadonlyREST Enterprise is one of the few software I use or used professionally, and I would recommend it 200%.
I baked ReadonlyREST Free into SEC455 SIEM Design and Implementation. I'm openly recommending it to students and highlighting its features.
ReadonlyREST was quick and easy to implement, that gave us more time to spend on other important tasks.
| Your data looks like | Expected | Recommend |
|---|---|---|
| CI artifacts, build catalogs, plugin marketplaces | 1,000% to 10,000% smaller | Yes |
| DB dumps, daily backups, ML model variants | 500% to 5,000% smaller | Yes |
| Container layers, Maven / PyPI mirrors | 1,000% to 5,000% smaller | Yes |
| Random user uploads, encrypted blobs, raw video | 0% to 100% smaller | Use plain S3 |
| Append-only logs, streaming telemetry | 0% smaller | Use plain S3 |
Then put your real numbers into the savings calculator. There is more detail for CI & build artifacts and for regulated buyers.
$ docker run --rm -it -p 9000:9000 -v dgp-data:/data \
-e DGP_AUTHENTICATION=none \
beshultd/deltaglider_proxy
Open http://localhost:9000/_/ for the browser, or
point any S3 SDK at http://localhost:9000. Open
access is meant for a first look on localhost;
the second tutorial
locks it down.