CloudPilot AI
Documentation
All toolsRecorded lab · May 27, 2026 · sample access trace

Hermes Lazy Loading

Prepare once. Mount early. Read only what runs. Explore the recorded startup race, the image-selection policy, and the split control and data paths.

Compressed image

10.8 GiB

Hermes Pod Ready

15.032s

overlayfs Pod Ready

333.589s

Artifact preparation

8m 58s

Separate from startup

The startup race
15s
Starting
Normal overlayfs
Pull every layer

15s

Pull and unpack every layer before starting.

Pod Ready
Hermes lazy loading
Pod Ready

15s

Mount with prepared metadata; fetch layer spans as they are read.

Layer access trace
Illustrative span access; timing comes from the recorded lab run.
Layer1Remote
Layer2Read
Layer3Remote
Layer4Remote
Layer5Read
Layer6Remote
Layer7Remote
Layer8Read
Layer9Remote
Layer10Remote
Layer11Read
Layer12Remote
Benchmark boundary
The 15.032-second result starts with a ready SOCI artifact. First preparation took about 8m 58s in the published lab run; that cost is not included in Pod startup.
The library analogy
Open the reading room with the catalog; retrieve only books that readers need.
4 of 12
Without a catalog

12 books

Move everything before opening

With Hermes

4 books

Catalog → mounted filesystem → requested spans

Platform-owned image policy
Normal OCI images are unchanged. This editor evaluates sample image references locally.
763104351884.dkr.ecr.us-east-1.amazonaws.com/vllm:0.9-gpu-py312-ec2Build SOCI artifact
public.ecr.aws/opensearchproject/opensearch:2.19.1Build SOCI artifact
public.ecr.aws/docker/library/busybox:1.36Runtime fallback
apiVersion: hermes.cloudpilot.ai/v1alpha1
kind: HermesPolicy
metadata:
  name: demo-large-images
spec:
  paused: false
  imageSelectors:
    - imageRegex: ".*(vllm|opensearch).*"
      platforms:
        - linux/amd64
Control and data paths
Metadata comes from Hermes; original layer bytes remain in the registry.
Step1

Kubernetes API

Step2

Reuse ready artifact

Step3

Node daemon

Step4

Original OCI registry

Reuse prepared metadata, mount through FUSE, and fetch compressed spans on demand.

How it works

A normal overlayfs start waits for the entire image to download and unpack. Hermes asks for a ready SOCI index, mounts the layers through FUSE, and lets the workload drive the reads that matter first.

Press “Jump to 15s” first. Hermes is already Ready while overlayfs is still pulling. Then run the complete race to show where the remaining 5 minutes and 19 seconds go.

remote

read

Illustrative access trace. Benchmark timing is measured; span access varies by workload.

Measured after the Hermes artifact reached Ready.

Imagine an application needs four books to open for the day. The traditional path moves every book into the reading room first. Hermes brings the catalog, opens the room, and sends a librarian for only the pages readers actually request.

The library remains the source of truth, just like the OCI registry. The catalog is the SOCI index and zTOCs; the reading room is the mounted filesystem; requested pages are compressed layer spans fetched by the node daemon.

The doors stay locked until the entire collection arrives.

CATALOG

Readers can begin

The room opens first; the librarian serves each requested book.

Application teams keep publishing normal OCI images. Platform teams use one cluster-scoped HermesPolicy to decide which observed Pod images should receive SOCI artifacts.

Change the regular expression to “.*busybox.*” or pause the policy. Unmatched images are not blocked: with registry fallback enabled, they continue through the normal runtime path.

v1alpha1

apiVersion:

kind:

metadata:

name:

spec:

paused:

imageSelectors:

imageRegex:

platforms:

MATCH

NO MATCH

The controller prepares and serves a compact map of the image. The node daemon uses that map to mount layers and fetch compressed spans directly from the original registry as the workload opens files.

Walk left to right: Kubernetes tells the controller what to optimize; Hermes serves only the index and zTOCs; the registry remains the source of the original image data.

Observe image references and match selectors.

Resolve the existing digest-keyed artifact.

Prepare a remote snapshot without a full pull.

The original manifest and layers never change.

Only files the workload opens cause layer span reads from the registry.

The published EC2 + kind run compared Pod Ready time for the same 10.8 GiB vLLM image. Hermes reached Ready in 15.032 seconds after the artifact was already prepared; the normal overlayfs baseline took 333.589 seconds.

This is the credibility slide. Say the artifact build took about 9 minutes in this lab and is intentionally outside the 15-second startup result. The value is reuse across later Pods.

PASS

The first vLLM artifact took about 8m 58s to reach Ready in this run. Hermes does not erase that first build cost; it moves it off the later Pod startup path.

Hermes builds SOCI v1 metadata outside the application build pipeline.

A policy miss creates no artifact and can fall back to the normal container runtime.

Prepare once. Mount early. Read only what runs.

Explore Hermes on GitHub ↗

CloudPilot AI / Interactive tools