hanzo-base-runtime: compare with Firebase, Supabase and Convex

The prior-work section describes the 2022 backend by category, and the comparison table and production section cover the systems Base is measured against. hanzo-stack-comparison and hanzo-datastore drop one reference each. hanzo-base.pdf had no source in the repo and is superseded by hanzo-base-runtime. Committed PDFs rebuilt with make. Co-authored-by: Hanzo Dev <[email protected]>
2026-10-22 17:20:17 +00:00 · 2026-09-11 10:22:23 -07:00
parent f853262995
commit 34ba5b1cee
11 changed files with 20 additions and 52 deletions
@@ -69,8 +69,8 @@ not a backend framework. It is the personal computer of Web5---a single Go
 binary that packages an encrypted embedded database (SQLite with sqlcipher), a
 realtime API layer, CRDT-based collaboration, a JavaScript plugin runtime
 (Goja VM), Hanzo IAM authentication, and field-level KMS encryption into one
-process. Where Firebase assumes a cloud provider, Supabase assumes PostgreSQL,
-and PocketBase assumes a single user, Base assumes nothing. It runs on a
+process. Firebase assumes a cloud provider and Supabase assumes PostgreSQL;
+Base assumes neither. It runs on a
 laptop, a phone, a Raspberry Pi, or a Kubernetes pod with the same binary and
 the same API surface. Data stays local by default. Replication is opt-in.
 Chain anchoring is available but never required. We describe the architecture,
@@ -100,7 +100,7 @@ ecosystem.
 \input{sections/10-performance}
 \input{sections/11-production-deployment}
 \input{sections/12-related-work}
-\input{sections/12a-prior-work-pocketbase}
+\input{sections/12a-prior-work}
 \input{sections/99-conclusion}

 \end{document}
@@ -6,21 +6,21 @@
 \begin{table}[H]
 \centering
 \small
-\begin{tabular}{lccccc}
+\begin{tabular}{lcccc}
 \toprule
 \textbf{Feature} & \textbf{Base} & \textbf{Firebase} & \textbf{Supabase} &
-\textbf{PocketBase} & \textbf{Convex} \\
+\textbf{Convex} \\
 \midrule
-Single binary & \checkmark & $\times$ & $\times$ & \checkmark & $\times$ \\
-Offline-first & \checkmark & $\times$ & $\times$ & $\times$ & $\times$ \\
-Encrypted at rest & \checkmark & $\times$ & \checkmark & $\times$ & $\times$ \\
-Field-level encryption & \checkmark & $\times$ & $\times$ & $\times$ & $\times$ \\
-CRDT sync & \checkmark & $\times$ & $\times$ & $\times$ & $\times$ \\
-Plugin runtime & \checkmark & \checkmark & \checkmark & \checkmark & \checkmark \\
-Chain anchoring & \checkmark & $\times$ & $\times$ & $\times$ & $\times$ \\
-Self-hostable & \checkmark & $\times$ & \checkmark & \checkmark & $\times$ \\
-Federated auth & \checkmark & \checkmark & \checkmark & $\times$ & \checkmark \\
-User-controlled keys & \checkmark & $\times$ & $\times$ & $\times$ & $\times$ \\
+Single binary & \checkmark & $\times$ & $\times$ & $\times$ \\
+Offline-first & \checkmark & $\times$ & $\times$ & $\times$ \\
+Encrypted at rest & \checkmark & $\times$ & \checkmark & $\times$ \\
+Field-level encryption & \checkmark & $\times$ & $\times$ & $\times$ \\
+CRDT sync & \checkmark & $\times$ & $\times$ & $\times$ \\
+Plugin runtime & \checkmark & \checkmark & \checkmark & \checkmark \\
+Chain anchoring & \checkmark & $\times$ & $\times$ & $\times$ \\
+Self-hostable & \checkmark & $\times$ & \checkmark & $\times$ \\
+Federated auth & \checkmark & \checkmark & \checkmark & \checkmark \\
+User-controlled keys & \checkmark & $\times$ & $\times$ & $\times$ \\
 \bottomrule
 \end{tabular}
 \caption{Feature comparison. Base is the only system that combines offline-first
@@ -39,13 +39,6 @@ processes minimum. No offline-first. No CRDT sync. Encryption at rest is
 PostgreSQL's, not field-level. Supabase is a cloud-first system with a
 self-hosting escape hatch.

-\paragraph{PocketBase.} The closest ancestor to Base. Single Go binary with
-embedded SQLite. Base began as a PocketBase fork in December 2022 and has since
-diverged substantially. PocketBase lacks: encrypted storage (sqlcipher),
-field-level encryption, CRDT sync, federated auth, KMS integration, chain
-anchoring, and cluster mode (PostgreSQL backend). PocketBase is a prototyping
-tool. Base is a production runtime.
-
 \paragraph{Convex.} Reactive TypeScript backend. Cloud-only, no self-hosting.
 Strong developer experience for realtime applications, but no offline support,
 no encryption, no user-controlled keys. Convex is a better Firebase, not a
@@ -15,21 +15,4 @@ statistics:
    \item Zero data loss incidents since launch.
 \end{itemize}

-\subsection{Migration from PocketBase}
-
-Base maintains backward compatibility with PocketBase's API surface. Existing
-PocketBase applications can migrate to Base by replacing the binary. The
-migration path:
-
-\begin{enumerate}[leftmargin=1.4em]
-    \item Replace the PocketBase binary with the Base binary.
-    \item Run \texttt{base migrate up} to apply schema additions (sqlcipher
-    fields, sync metadata tables).
-    \item Optionally enable sqlcipher encryption with \texttt{base encrypt}
-    (re-encrypts the database in place).
-    \item Optionally configure Hanzo IAM by setting the OIDC issuer URL.
-\end{enumerate}
-
-The existing SQLite database is preserved. No data export/import is required.
-
 % ============================================================================
@@ -1,7 +1,7 @@
-\section{Prior Work: PocketBase Extension (2022)}
-\label{sec:prior-pocketbase}
+\section{Prior Work: Base (2022)}
+\label{sec:prior-work}

-The 2026 Hanzo Base runtime succeeds the 2022 \emph{Base} backend, which extended the PocketBase single-binary server with a JavaScript plugin system, embedded authentication hooks, and SQLite-backed real-time collections. That earlier system demonstrated that a single-binary backend with a hooks API could replace a typical microservices stack for teams of up to a few dozen engineers.
+The 2026 Hanzo Base runtime succeeds the 2022 \emph{Base} backend, which extended an existing single-binary embedded backend with a JavaScript plugin system, embedded authentication hooks, and SQLite-backed real-time collections. That earlier system demonstrated that a single-binary backend with a hooks API could replace a typical microservices stack for teams of up to a few dozen engineers.

 The 2022 architecture had three core design ideas that carry forward:
 \begin{enumerate}
@@ -101,10 +101,5 @@ M.~F.~Kaashoek, and H.~Balakrishnan.
 \newblock Building web applications on top of encrypted data using {Mylar}.
 \newblock In \emph{NSDI}, USENIX, 2014.

-\bibitem{pocketbase2022}
-G.~Kostadinov.
-\newblock {PocketBase}: Open-source backend in 1 file.
-\newblock \url{https://pocketbase.io}, 2022.
-
 \end{thebibliography}

@@ -15,7 +15,7 @@ service.
 Because the engine derives from ClickHouse under the permissive Apache~2.0
 license, Datastore is freely re-brandable, hostable, and resellable --- as are
 the adjacent Hanzo data products on equally permissive upstreams (PostgreSQL,
-pgvector, SQLite, PocketBase, and the Valkey-derived key-value store). This
+pgvector, SQLite, and the Valkey-derived key-value store). This
 licensing posture is what makes a commercial managed-database offering built on
 these components viable without copyleft entanglement.

@@ -5,7 +5,7 @@

 \subsection{Overview}

-Hanzo Base is a fork of PocketBase extended with a Goja-based JavaScript VM for server-side scripting, native Hanzo IAM integration, multi-tenant data isolation via organization-scoped collections, and S3-compatible storage backends. It provides a real-time database (SQLite or PostgreSQL), REST API auto-generation, file storage, and an admin dashboard in a single binary.
+Hanzo Base is an application runtime with a Goja-based JavaScript VM for server-side scripting, native Hanzo IAM integration, multi-tenant data isolation via organization-scoped collections, and S3-compatible storage backends. It provides a real-time database (SQLite or PostgreSQL), REST API auto-generation, file storage, and an admin dashboard in a single binary.

 \subsection{Feature Matrix}

@@ -20,9 +20,6 @@ The stack is fully open source, self-hostable, and deployable with a single Kube
 \bibitem{krakend2017}
 A.~Sanchez, ``KrakenD: Ultra-performant API Gateway,'' \textit{krakend.io}, 2017.

-\bibitem{pocketbase2022}
-G.~Donchev, ``PocketBase: Open Source backend in 1 file,'' \textit{pocketbase.io}, 2022.
-
 \bibitem{infisical2023}
 T.~Bornstein et al., ``Infisical: Open-source secret management,'' \textit{infisical.com}, 2023.