ricochet

Product

Your apps, your infrastructure.

ricochet integrates with your identity provider so your content remains secure. Incoming traffic is routed and apps scale intelligently based on demand.

How ricochet works

At its core, ricochet is a web server and application proxy. Built from the ground up in Rust for memory efficiency, a zero-dependency binary, and performance at scale.

Authentication

Verify access via your OIDC-compliant identity provider.

App proxy

Each app is load balanced behind a persistent and customizable URL.

Backend engine

Spawns the language runtime for each app on the host, in Kubernetes, or a container.

ricochetAuthenticationsales-dashboardshiny | R 4.5.1backend engineworker 1:7100backend engineworker 2:7101backend engineworker 3:7102forecast-apifastapi | Python 3.13backend engineworker 1:7200backend engineworker 2:7201+ on loadREST API

Access, activity, and telemetry

Identity comes from your provider, and ricochet stores authorisation, not passwords. Every action is logged, and every metric is yours to export.

Single sign-on

Bring any OIDC-compliant identity provider.

Scoped API keys

Keys carry explicit scopes and can be limited to named content.

Encrypted secrets

Environment variables are AES-256 encrypted at rest and decrypted into the process at start.

Audit logging

Deployments, changes and deletions are written to both file and database.

Telemetry

Built on OpenTelemetry, so metrics and traces plug into Grafana, Jaeger, Datadog, or whatever you already run.

Choose your engine

ricochet supports your infrastructure and your architecture at no additional cost, across three engines: your host Linux machine, a Kubernetes cluster, or containerized deployments in Docker or Podman.

HostserverContainerserverKubernetesclusterRJlPyDeployed on your Linux server, using anembedded, rootless OCI runtime.containerRcontainerJlcontainerPyDeployed via the provided containerdaemon and your execution environments.nodepodpodnodepodpodDeployed on your Kubernetes cluster.
The ricochet environment page, showing system information, installed R, Python, and Quarto interpreter versions, and package cache sizes including the R renv cache and Julia package depot.

Everything the UI does, the API does too

Our CLI is built on that same API and installs on macOS, Linux and Windows. The reference is powered by Scalar, so every endpoint comes with a ready-to-use snippet in your language.

The ricochet REST API reference for the schedule-a-task endpoint, showing its path parameters and responses next to a generated R snippet that calls the endpoint with httr2.

Isolated reproducible environments

Reproducibility and security is paramount. Every app runs in a rootless and isolated runtime with a standalone package evironment.

sales-dashboardR 4.5.1126 packagesrestored by renvchurn-modelJulia 1.1148 packagesrestored by Pkgforecast-apiPython 3.1391 packagesrestored by uv

Pinned dependencies

Package and language versions are pinned to ensure reproducibility.

Lockfiles as environments

renv.lock, uv.lock and Manifest.toml define app-level environments.

Deployed from Git

Connect a repository and a branch, and ricochet pulls and redeploys itself.

Get started and read the docs

The docs cover installation, the content model, backend engine configuration and the CLI in full.

Install ricochetRead the docs