... entirely in getting the bits onto a local disk before you can use them.

iSCSI solves this in theory. The protocol is built into every major OS — iscsiadm on Linux, a native initiator on Windows, globalSAN on macOS. Log into a target, and the remote disk shows up as /dev/sdX. The OS doesn't care where the blocks live. You can mount it, format it, boot from it.

In practice, nobody uses iSCSI this way because the server side is a pain. You need your own SAN or a box running targetcli, and you need to manage LUNs, IQNs, ACLs, CHAP secrets. Fine for a homelab you've already set up; terrible for "I just want to boot this Pi into Alpine for five minutes."

scsipub is my attempt to make that friction disappear. Pick an image from the catalog (Alpine, Debian 12, Memtest86+, or a blank scratch disk), get credentials, run iscsiadm --login. The disk appears. Each session gets a copy-on-write layer — your writes are yours, and they vanish when the session ends.

The no-setup path

For quick experiments there are unauthenticated targets that accept AuthMethod=None. Each TCP connection is its own ephemeral session. Connect, use the disk, disconnect — the overlay is gone. Available on both TLS (port 3261, terminated locally with stunnel since open-iscsi doesn't speak TLS natively) and plaintext (port 3260).

Hardware initiators

Not everything speaks iSCSI. That's where the hardware bridges come in.

ESP32-iSCSI-USB is the project I wrote about previously — an ESP32-S3 that logs into an iSCSI target over Wi-Fi and presents it as a USB flash drive. Plug it into anything with a USB port and the host sees a disk. No drivers, no software on the host side.

PI4-iSCSI-shim does the same trick for Raspberry Pi netbooting — a TFTP kernel and bootstrap SD image that pivots the Pi directly into an iSCSI rootfs. No local OS on the SD card, no flashing loop.

Privacy

No third-party cookies, no ad networks, no analytics scripts. The server logs page views with a daily-rotating hash — IP addresses are never stored. Block device contents are never inspected or indexed. Account deletion wipes everything: email, password hash, API keys, sessions. "Delete means delete" isn't a marketing claim, it's the implementation.

Try it

scsipub.com is live. If you've got a Linux box with open-iscsi installed, you're about thirty seconds from a mounted remote disk.