Run VMs like containers.
Pervasive as the sky.
Vyoma is a MicroVM manager powered by cloud-hypervisor. Use OCI images you already have, get hardware-level isolation in under 250ms. One binary. No YAML gymnastics.
$ vyoma run ubuntu:latest --vcpu 2 --memory 512M -p 8080:80
⚡ VM booted in ~250ms — 172.16.0.2
# Check running VMs
$ vyoma ps
| VM ID | IP ADDRESS | HOSTNAME |
|---|---|---|
| 3f2a... | 172.16.0.5 | - |
# View logs $ vyoma logs 3f2a... -f
[stdout] Alpine Linux 3.21
# Snapshot the entire machine state
$ vyoma snapshot my-vm --name before-deploy
📸 Snapshot saved: CPU + RAM + disk (11.8 MB delta)
# Roll back instantly — full fidelity
$ vyoma restore my-vm --from before-deploy
✓ VM restored (snapshot loaded) — every byte exactly as it was
The Problem
Containers share a kernel.
That's the problem.
Every container on a host shares the same Linux kernel. One kernel exploit, one container escape — and the attacker owns everything. Namespaces are policies. VMs are physics.
One escape = full access
Isolated by hardware
How It Works
If you know Docker,
you already know Vyoma.
Same workflow. Same images. Completely different isolation level.
Use OCI images you already have
Pull any image from Docker Hub or your private registry. No conversion step. No new image format to learn. Vyoma speaks OCI natively.
Vyoma boots a real VM in ~250ms
cloud-hypervisor creates a MicroVM with its own kernel, memory, and network stack. Hardware isolation via KVM — not namespaces. Not policy — physics.
Manage it like Docker
Same CLI patterns you already know. ps, logs, exec, stop, rm — they all work. Your muscle memory transfers 1:1. Learn nothing new.
$ vyoma logs my-vm -f
Do what containers can't
Snapshot entire machine state. Time-travel to any point. Live-migrate between hosts. Hibernate to zero cost. Branch like git.
$ vyoma time-travel my-vm --to v1
$ vyoma teleport my-vm --to eu-west-1
Features
Everything you need.
Nothing you don't.
One binary gives you VM isolation, OCI compatibility, clustering, snapshots, and a dashboard.
Fast Boot (~250ms)
cloud-hypervisor's lean VMM boots a real kernel in about 250ms — comparable to a container start. Measured, not marketed.
OCI Image Compatible
Use any OCI image from Docker Hub or your private registry. No conversion, no new tooling, no new image format.
Hardware Isolation
Each VM gets its own kernel via KVM. CPU-enforced memory isolation. Not a namespace — a hardware guarantee.
Machine-State Snapshots
Capture CPU registers, all RAM, disk state. Restore to the exact microsecond. Structurally impossible with containers.
Built-in Clustering
Vyoma Swarm: VXLAN mesh networking, deterministic subnets. One command to init, one to join.
Compose Support
Multi-VM stacks from a single YAML file. Works with Docker Compose v3 syntax. Zero migration cost.
Tiny Overhead
Each MicroVM adds about 30MB of overhead (kernel + virtio). Run dozens on a single host.
Built-in Dashboard
Web dashboard served by the daemon at localhost:8080. Live VM status, metrics, and management. No install needed.
20+ CLI Commands
run, ps, stop, exec, logs, stats, inspect, snapshot, restore, teleport and more. Complete VM lifecycle from your terminal.
Beyond Docker
Things containers
can never do.
Real VMs enable capabilities that are structurally impossible with containers. This is Vyoma's permanent moat.
Teleport — Live Migration
<1 second downtime. Any host.
Move a running VM between physical hosts with near-zero downtime. Pre-copy memory via KVM dirty page tracking. TCP connections survive. The service moves, not restarts.
⚡ Migration complete in ~480ms. TCP connections intact.
TimeMachine — Git for Runtime
Keep snapshot, history, time‑travelling superpowers.
Take snapshots, inspect history, and roll back to any snapshot. CoW delta layers store only what changed. Impossible with containers because they can't capture CPU state or in-memory data. Perfect for safe experimentation and debugging.
$ vyoma branch my-db --from snap:6 experiment
$ vyoma time-travel my-db --to snap:3
Hibernation — Zero Idle Cost
Scale to zero with full state.
Write complete VM state to disk. Release vCPUs, memory, everything. Resume in <200ms with the exact state preserved. Run 100 dev VMs at zero cost when idle.
💤 0 vCPUs, 0 MB — state saved
$ vyoma start staging-env
⚡ Resumed in 180ms
vk8s — Kubernetes CRI
Pods as MicroVMs (experimental)
Kubernetes can use Vyoma for pod isolation via the CRI shim. Pod = MicroVM. Under active development. Not production ready yet, but early adopters can apply to test it out.
unix:///var/run/vyoma-cri.sock
runtimeClassName: vyoma-microvm
Security
7 layers of defense.
Each independent.
An attacker must break every single layer to compromise a host. Three are enforced by hardware. The rest are defense-in-depth.
~50k lines of Rust VMM
vs millions in QEMU
KVM Hardware Isolation
ActiveCPU-enforced memory boundaries. Not policy — physics.
cloud-hypervisor Isolation
ActiveRust VMM with minimal attack surface. ~50k lines vs millions in QEMU.
Minimal Device Model
ActiveOnly virtio-net/blk/vsock + serial. No USB, BIOS, or legacy PCI attack surface.
Least-Privilege Daemon
ShippedDedicated vyoma user. Only CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_NET_RAW, and others. No root runtime.
WireGuard Mesh Encryption
v1.5All cluster traffic inside WireGuard tunnels. Zero config. Always-on.
Image Signing (Ed25519)
ShippedCryptographic verification before boot. Only signed OCI images can run.
Capability-Based API Auth
v2.0Token‑based auth today; scoped tokens planned.
Comparison
Docker vs Vyoma.
Honest comparison.
Vyoma isn't replacing containers for everything. It's for when isolation actually matters.
| Feature | Docker | Vyoma 🌐 |
|---|---|---|
| Isolation model | Namespaces (kernel shared) | KVM (own kernel per VM) |
| Cold start | ~100ms | ~250ms |
| Memory overhead | ~2MB | ~30MB |
| Image format | OCI | OCI (same images) |
| CLI familiarity | docker run/ps/stop | vyoma run/ps/stop (superset) |
| VMM backend | runc / containerd | cloud-hypervisor (Rust) |
| Hardware snapshots | ❌ Not possible | ✅ CPU + RAM + disk |
| Live migration | ❌ Not possible | ✅ <1 second downtime |
| Machine-state snapshots | ❌ Not possible | ✅ Restore any snapshot |
| Hibernate to zero | ❌ Loses state | ✅ Full state preserved |
| Kernel customization | ❌ Host kernel | ✅ Per-VM kernel |
| Security layers | 2–3 | 7 independent layers |
| Compose support | docker-compose.yml | Same file, vm: extensions |
Get Started
From zero to MicroVM
in 60 seconds.
Install
Installs with a single .deb/.rpm. Requires KVM, cgroups v2, and a Linux kernel 5.10+.
sudo dpkg -i vyoma_2.7.0_amd64.deb
# Verify everything works
vyoma doctor
✓ KVM Device Access (/dev/kvm)
✓ Cgroups v2 (/sys/fs/cgroup)
✓ Cloud Hypervisor Binary
✓ Virtiofsd Binary
⚠ Vyoma Bridge (vyoma0)
✓ debugfs (e2fsprogs)
Run your first VM
Pull any OCI image. Boot it as an isolated MicroVM in milliseconds.
vyoma run ubuntu:latest --vcpu 2 --memory 512M
# List running VMs
vyoma ps
# Follow VM logs
vyoma logs my-vm -f
Deploy a full stack
Use your existing docker-compose.yml. Add VM superpowers.
vyoma up -d
# Add VM-specific config (optional)
services:
api:
image: myapp:latest
deploy:
resources:
limits:
cpus: "4"
memory: "1G"
Ecosystem
Not just a runtime.
A complete platform.
CLI, dashboard, compose, clustering, SDK, registry — all built-in or coming soon.
CLI
Web UI at localhost:8080. Real-time status. UI overhaul planned.
Dashboard
Web UI at localhost:8080. Live metrics, VM management.
Compose
Multi-VM stacks. Docker Compose v3 compatible. Zero migration.
Swarm
VXLAN mesh clustering. Deterministic subnets. One command setup.
SDK
Go, Rust, Python. Programmatic VM management APIs.
VS Code
Extension for managing VMs from VS Code. On roadmap.
Vyoma Hub
OCI registry + Docker Hub bridge. Curated base images.
Studio
Visual compose editor + network topology visualizer.
Open Source
Built in public.
By developers, for developers.
Vyoma is Apache 2.0 licensed. The entire codebase is Rust + Go + TypeScript, powered by cloud-hypervisor. Contributions welcome — from bug fixes to building the features Docker can never have.
├── crates/ # Rust workspace (14+ crates)
├── ui/ # TypeScript dashboard
├── tests/ # Integration + chaos + compat
├── packaging/ # .deb/.rpm + systemd
└── vk8s/ # Go Kubernetes integration
Ready to run VMs
pervasive as the sky?
One binary. Under 1 second boot. Your OCI images. Your muscle memory.
But with real isolation, real snapshots, and real migration.
Free & open source · Apache 2.0 · cloud-hypervisor + KVM · Works on any Linux