Bun
Audited from github.com/oven-sh/bun
Bun is the JavaScript and TypeScript runtime, bundler, test runner and package manager published from this repository as a single `bun` executable — a Rust and C++ codebase built around an embedded JavaScriptCore engine, positioned as a drop-in Node.js replacement.
- Language
- Rust
- Database
- SQLite
- Hosting
- Docker
- Running for
- 3 years
- Team
- 1M+ MAU
Why this architecture
Implementing the runtime, bundler, installer and test runner as one Cargo workspace around a single embedded JS engine keeps startup and cross-tool integration fast, while a dedicated *_jsc crate layer isolates the JavaScriptCore bridge from the rest of the Rust codebase.
Tech stack by layer
6 technologies · audited Sep 17, 2026- RustDominant implementation language by byte count; the Cargo workspace has dozens of crates under src/ (bundler, resolver, install, http, css, semver, js_parser).
- C++Second-largest language; used for the JavaScriptCore integration layer and native modules, reflected in crate names like css_jsc, http_jsc, js_parser_jsc.
- JavaScriptCoreBun's embedded JS/TS engine; the README says the runtime is written in Rust and powered by JavaScriptCore, bridged via numerous *_jsc crates.
- TypeScriptBundled TS/JSX transpiler support and the packages/bun-types type declarations, published as the bun-types npm workspace package.
- SQLiteBuilt-in SQLite bindings for bun:sqlite; scripts/update-sqlite-amalgamation.sh vendors the SQLite source and bench/sqlite benchmarks it.
- Dockerdockerhub/alpine, dockerhub/debian, dockerhub/debian-slim and dockerhub/distroless directories build the official bun Docker images for different base OSes.
- GitHub ActionsWorkflows handle release publishing, docs-site deploys, Rust/source lints and vendored-dependency update bots (cares, highway, libarchive, zstd, and others).
Bun architecture diagram
Open SVGDiagram as text
- JS / TS / JSX sources (apps · tests · scripts) → bun executable (Rust · single binary): run · test · build
- bun executable (Rust · single binary) → Core crates (bundler · install · resolver): dispatch
- Core crates (bundler · install · resolver) → *_jsc bridge crates (Rust to JSC bindings): expose to JS
- *_jsc bridge crates (Rust to JSC bindings) → JavaScriptCore (embedded engine · C++): bindings
- Core crates (bundler · install · resolver) → Vendored C libraries (patches/ · libuv · zstd): link
- *_jsc bridge crates (Rust to JSC bindings) → bun:sqlite (SQLite amalgamation): bun:sqlite
- Core crates (bundler · install · resolver) → npm registry (packages): bun install
- bun executable (Rust · single binary) → Docker images (alpine · debian · distroless): packaged
Key architectural decisions
5 decisions- 01
Runtime, bundler, package manager and test runner are one Cargo workspace, not separate
Cargo.toml lists dozens of member crates (src/bundler, src/install, src/http, src/css, src/semver, src/resolver, and more) that all compile into the single bun executable, rather than being distributed as independent binaries.
- 02
A dedicated *_jsc crate layer bridges Rust to the embedded JavaScriptCore engine
Crates such as src/css_jsc, src/http_jsc, src/install_jsc, src/js_parser_jsc, src/ast_jsc, src/bundler_jsc, src/sourcemap_jsc, src/semver_jsc and src/sql_jsc exist specifically to expose their non-jsc Rust counterparts to JavaScriptCore, keeping the engine-integration surface separate from the core logic.
- 03
Native C dependencies are vendored and patched in-tree, not left as system libraries
The patches/ directory carries patches for cares, hdrhistogram, highway, libarchive, libjpeg-turbo, libuv, lshpack, lsqpack, lsquic, picohttpparser, rust-argon2, tinycc, zlib and zstd, and dedicated GitHub Actions workflows (update-cares.yml, update-highway.yml, update-zstd.yml, and others) keep each vendored copy current.
- 04
Official Docker images are built per base OS, not from one shared Dockerfile
dockerhub/ has four separate build contexts (alpine, debian, debian-slim, distroless), each producing a distinct published image rather than a single multi-stage Dockerfile with build args.
- 05
CI runs primarily on Buildkite, with GitHub Actions for lighter-weight checks
.buildkite/ci.mjs, .buildkite/bootstrap.yml and .bk.yaml configure the main Buildkite pipeline (including a bootstrap Docker image in .buildkite/Dockerfile), while .github/workflows covers release publishing, docs deploys, lint jobs and bot automation.
How Bun is built
How Bun is structured
The repository builds a single bun executable from a Cargo workspace (Cargo.toml) with dozens of member crates under src/: functional areas like src/bundler, src/resolver, src/install, src/http, src/css, src/semver, src/js_parser, src/watcher and src/glob sit alongside a parallel set of *_jsc crates (css_jsc, http_jsc, install_jsc, js_parser_jsc, ast_jsc, bundler_jsc, sourcemap_jsc, semver_jsc, sql_jsc, sys_jsc) whose job is specifically to bridge those Rust modules into JavaScriptCore. Outside the workspace crates, packages/ holds separately published npm packages: bun-types (the one entry in the root package.json workspaces field), debugger/inspector tooling (bun-inspector-frontend, bun-inspector-protocol, bun-debug-adapter-protocol), a VS Code extension (bun-vscode), and bundler plugins (bun-plugin-svelte, bun-plugin-yaml). test/ is a large, separate suite (with its own AGENTS.md/CLAUDE.md) that exercises both Bun's own APIs and Node.js compatibility.
Backend & APIs
As a runtime rather than a web application, Bun's "backend" is the engine itself. src/api and src/bunfig implement Bun's own configuration and API surface; src/http, src/http_jsc, src/http_types and the vendored src/uws/packages/bun-uws/packages/bun-usockets crates implement its built-in HTTP/WebSocket server; src/install and src/install_jsc implement the bun install package manager; and src/bundler/src/bundler_jsc implement the bundler used by bun build. src/sql and src/sql_jsc provide Bun's built-in SQL client bindings, and src/valkey provides a Redis-protocol-compatible client.
Data & persistence
Bun ships built-in SQLite support (bun:sqlite): scripts/update-sqlite-amalgamation.sh vendors the SQLite amalgamation source, and bench/sqlite benchmarks it directly against the native binding. This is embedded-database support inside the runtime rather than a persistence layer for the Bun project itself, which has no application database.
Build, test & deploy
package.json scripts wrap a TypeScript build orchestrator (scripts/build.ts) invoked as bd/build:debug/build:release/build:ci, alongside cargo watch for incremental Rust checks. CI runs primarily on Buildkite: .buildkite/ci.mjs and .bk.yaml define the pipeline, .buildkite/bootstrap.yml and .buildkite/Dockerfile set up the build environment, and scripts/ci-slowest-tests.ts/scripts/update-test-durations.mjs manage test-duration tracking for scheduling. GitHub Actions workflows cover release.yml, deploy-site.yml (documentation), rust-lints.yml, source-lints.yml, format.yml, and a family of update-*.yml bots that refresh vendored C dependencies (cares, hdrhistogram, highway, libarchive, libdeflate, lolhtml, lshpack, sqlite3, zstd). flake.nix/shell.nix provide a reproducible Nix development shell as an alternative to the bootstrap scripts.
Self-hosting notes
Bun is a CLI/runtime rather than a hosted service, so "self-hosting" here means building and distributing the binary. dockerhub/alpine, dockerhub/debian, dockerhub/debian-slim and dockerhub/distroless each define a separate Docker build context for the corresponding official image; .buildkite/Dockerfile is a separate, CI-only build container rather than a runtime image. completions/ ships shell completion scripts (bash, fish, zsh, plus a bun-cli.json for other tooling) for the compiled binary.
What to copy (and what not to)
Isolating engine-integration code into a dedicated crate suffix (the *_jsc crates here) is a good pattern for any project embedding a large third-party engine or SDK: it keeps the "translate to the embedding API" concern out of the core logic crates, and makes it easier to reason about what actually touches JavaScriptCore. Vendoring and patching native C dependencies in-tree, backed by automated update workflows per library, is worth copying for any project that needs tight control over exact versions of C libraries it links against — but it is a meaningful maintenance investment (a dozen-plus update-*.yml bots here) that only pays off at Bun's scale and native-dependency surface area.
Sources & repo audit
- Audited
- Sep 17, 2026
- Commit
- b52d513
- License
- NOASSERTION
- README.md (Rust + JavaScriptCore description)
- Cargo.toml (workspace members, *_jsc crates)
- package.json (bun-types workspace, build/ci scripts)
- .buildkite/ci.mjs and .bk.yaml (Buildkite CI pipeline)
- scripts/update-sqlite-amalgamation.sh (vendored SQLite)
Independent analysis of repository at github.com/oven-sh/bun. Spotted an inaccuracy? Use the claim form to request a correction.
Show this stack on your README or website
[](https://stackitfast.com/project/bun)Paste it into your README. It shows your current stack and links to this page.
Scaffold it with your agent
Paste this prompt into Claude Code, Cursor, Windsurf or AGY to start a project with Bun's architecture.
- 1Copy the promptThe full markdown spec, with every layer and decision.
- 2Open your AI toolClaude Code, Cursor, Windsurf or Copilot, in a new repo.
- 3Paste and scaffoldUse it as the first instruction; review before you ship.
# MISSION: Scaffold "Bun" Production Architecture
You are an expert Senior Staff Software Architect and Full-Stack Engineer. Your mission is to scaffold and implement a production-grade, highly reliable, and modular codebase following the proven architecture of **Bun**.
---
## 1. PROJECT SPECIFICATIONS & BENCHMARK
- **Reference Architecture**: Bun
- **What It Does**: Bun is the JavaScript and TypeScript runtime, bundler, test runner and package manager published from this repository as a single `bun` executable — a Rust and C++ codebase built around an embedded JavaScriptCore engine, positioned as a drop-in Node.js replacement.
- **Domain & Category**: All-in-One JavaScript Runtime & Toolchain
- **Production Scale**: 1M+ MAU
- **Development Mode**: CLASSIC
- **Architectural Rationale**: Implementing the runtime, bundler, installer and test runner as one Cargo workspace around a single embedded JS engine keeps startup and cross-tool integration fast, while a dedicated *_jsc crate layer isolates the JavaScriptCore bridge from the rest of the Rust codebase.
- **Live Website Reference**: https://bun.sh
- **Source Repository**: https://github.com/oven-sh/bun
---
## 2. PRODUCTION TECH STACK
- **Full Stack Array**: Rust, C++, TypeScript, JavaScriptCore, SQLite, Cargo
- **Primary Language(s)**: Rust, C++, TypeScript, C, JavaScript
- **License of the reference repo**: NOASSERTION
- **Backend & APIs**: Rust — Dominant implementation language by byte count; the Cargo workspace has dozens of crates under src/ (bundler, resolver, install, http, css, semver, js_parser).; C++ — Second-largest language; used for the JavaScriptCore integration layer and native modules, reflected in crate names like css_jsc, http_jsc, js_parser_jsc.; JavaScriptCore — Bun's embedded JS/TS engine; the README says the runtime is written in Rust and powered by JavaScriptCore, bridged via numerous *_jsc crates.; TypeScript — Bundled TS/JSX transpiler support and the packages/bun-types type declarations, published as the bun-types npm workspace package.
- **Data & persistence**: SQLite — Built-in SQLite bindings for bun:sqlite; scripts/update-sqlite-amalgamation.sh vendors the SQLite source and bench/sqlite benchmarks it.
- **Infrastructure & deploy**: Docker — dockerhub/alpine, dockerhub/debian, dockerhub/debian-slim and dockerhub/distroless directories build the official bun Docker images for different base OSes.; GitHub Actions — Workflows handle release publishing, docs-site deploys, Rust/source lints and vendored-dependency update bots (cares, highway, libarchive, zstd, and others).
---
## 3. KEY ARCHITECTURAL DECISIONS (audited from https://github.com/oven-sh/bun @ b52d513)
1. **Runtime, bundler, package manager and test runner are one Cargo workspace, not separate**: Cargo.toml lists dozens of member crates (src/bundler, src/install, src/http, src/css, src/semver, src/resolver, and more) that all compile into the single bun executable, rather than being distributed as independent binaries.
2. **A dedicated *_jsc crate layer bridges Rust to the embedded JavaScriptCore engine**: Crates such as src/css_jsc, src/http_jsc, src/install_jsc, src/js_parser_jsc, src/ast_jsc, src/bundler_jsc, src/sourcemap_jsc, src/semver_jsc and src/sql_jsc exist specifically to expose their non-jsc Rust counterparts to JavaScriptCore, keeping the engine-integration surface separate from the core logic.
3. **Native C dependencies are vendored and patched in-tree, not left as system libraries**: The patches/ directory carries patches for cares, hdrhistogram, highway, libarchive, libjpeg-turbo, libuv, lshpack, lsqpack, lsquic, picohttpparser, rust-argon2, tinycc, zlib and zstd, and dedicated GitHub Actions workflows (update-cares.yml, update-highway.yml, update-zstd.yml, and others) keep each vendored copy current.
4. **Official Docker images are built per base OS, not from one shared Dockerfile**: dockerhub/ has four separate build contexts (alpine, debian, debian-slim, distroless), each producing a distinct published image rather than a single multi-stage Dockerfile with build args.
5. **CI runs primarily on Buildkite, with GitHub Actions for lighter-weight checks**: .buildkite/ci.mjs, .buildkite/bootstrap.yml and .bk.yaml configure the main Buildkite pipeline (including a bootstrap Docker image in .buildkite/Dockerfile), while .github/workflows covers release publishing, docs deploys, lint jobs and bot automation.
---
## 4. NON-NEGOTIABLE ARCHITECTURAL GUARDRAILS
1. **Monorepo & Modular Separation**:
- Structure as a Turborepo monorepo with strict package boundaries:
- `apps/web`: Application UI, routing, layouts, and server endpoints.
- `packages/ui`: Shared design tokens, CSS variables, and Radix UI primitive components.
- `packages/db`: Database schemas, client singleton, declarative migrations, and seed scripts.
- `packages/config`: Shared TypeScript, ESLint, and build configurations.
2. **Strict Type Safety & Zero `any` Policy**:
- Enable `strict: true`, `noImplicitAny: true`, and `strictNullChecks: true`.
- Validate ALL external inputs, API request bodies, and query parameters with **Zod** schemas before execution.
3. **Frontend & Rendering Guidelines**:
- Isolate interactive UI state to leaf components. Keep core pages lightweight and performant.
4. **Design System & Aesthetics**:
- Keep every color, radius, shadow and font in a single token file (CSS variables) and consume tokens everywhere; never hardcode hex values in components.
- Prefer crisp 1px borders and one subtle shadow scale over blurry default shadows. Pair one sans-serif for body/headings with one monospace for tags, badges, metrics, and code.
5. **Data Layer & Reliability**:
- Write declarative schema definitions with foreign keys, composite indexes on queried filters, and automated timestamp triggers.
- Use connection pooling and prepared statements for serverless database execution.
---
## 5. STEP-BY-STEP SCAFFOLDING ROADMAP
- **Phase 1: Workspace & Root Config**: Initialize package manager, monorepo configuration (`turbo.json`, `tsconfig.base.json`, `package.json`).
- **Phase 2: Database Schema & Client**: Set up the data layer (SQLite): client, connection pool, models, and migration scripts.
- **Phase 3: Design Tokens & UI Primitives**: Build accessible `Button`, `Input`, `Card`, `Badge`, and layout wrappers inside `packages/ui`.
- **Phase 4: Core Application Routes & Handlers**: Implement primary authentication, user session handling, and application routes.
- **Phase 5: Quality Assurance & Build Verification**: Run `tsc --noEmit`, ESLint, Prettier, and smoke test suites to ensure zero compilation or runtime errors.
---
## 6. EXECUTION INSTRUCTIONS
1. Review all specifications, architectural guardrails, and stack choices above.
2. Present the full monorepo directory tree structure.
3. Systematically generate the complete, production-ready codebase according to the 5-phase roadmap above — starting with the root workspace setup, followed by the database schema, UI design system package, and full-stack application routes until the repository is fully scaffolded and ready to run.Frequently asked about Bun
What is Bun built with?
Bun is a Cargo workspace of Rust crates (the majority of the codebase by byte count) with a C++ layer bridging into an embedded JavaScriptCore engine — the README states it is 'written in Rust and powered by JavaScriptCore under the hood.' TypeScript is used for bundled tooling and the published type declarations.
Does Bun depend on Node.js or V8?
No. Bun embeds JavaScriptCore (the engine from WebKit) rather than V8, and is positioned as a standalone, drop-in replacement for the Node.js runtime rather than something that runs on top of it.
How does Bun handle native C library dependencies like SQLite and zlib?
Native C libraries are vendored into the repository and patched in-tree (the patches/ directory holds patches for cares, libuv, zlib, zstd, and others), with dedicated GitHub Actions workflows to pull in upstream updates, rather than relying on system-installed versions.
What CI system does Bun use?
The primary CI pipeline runs on Buildkite, configured through .buildkite/ci.mjs, .buildkite/bootstrap.yml and .bk.yaml, including its own bootstrap Docker image. GitHub Actions handles release publishing, documentation-site deploys, source/Rust linting and bot-driven vendor updates.
Does Bun ship official Docker images?
Yes, four separate build contexts under dockerhub/ (alpine, debian, debian-slim, distroless) produce the official published Bun Docker images, each with its own Dockerfile rather than a single shared one.
One email a month: new deep dives and stack trends
New source-audited architectures, head-to-head comparisons and the monthly stack report. No spam, unsubscribe anytime.
Similar architectures
- DenoClassicSecure JavaScript & TypeScript Runtime · 20+ peopleShares Rust · TypeScript · SQLite
- Tailwind CSSClassicUtility-First CSS Engine & Framework · 1M+ MAUShares TypeScript · Rust
- OllamaAI-agentLocal AI Inference Engine · 1-5 peopleShares TypeScript · C++ · SQLite
- Next.jsHybridFullstack React Framework · 1M+ MAUShares TypeScript · Rust
- PocketBaseClassicEmbedded Backend · SoloShares SQLite
- LocoClassicRails-Style Rust Web Framework · 2-5 peopleShares Rust · SQLite