mvm

mvm runs workloads in microVMs on macOS and Linux. Each workload gets its own Linux kernel under a hypervisor: the in-house HVF backend on macOS 26+ Apple Silicon, the bundled libkrun preview on macOS 13–25 Apple Silicon, and Firecracker on Linux with /dev/kvm. You can start one from an OCI image, a Nix flake, or a decorated Python or TypeScript function. The CLI is mvmctl. Python, TypeScript and Rust libraries drive the same operations from code.

It is built for running code you don’t fully trust, such as agent tool calls, user-submitted scripts or third-party builds, on a laptop or a single host. Fleet orchestration lives in a separate project, mvmd.

Workload VMs have no network device. Everything the guest sends goes over vsock to a per-VM process on the host, and that process opens any outbound connection itself. This gives the host one place to enforce default-deny egress and to swap secret placeholders for real credentials, so the guest never holds them. Every launch is described by an execution plan that mvmctl signs, checks and records in a hash-chained audit log before the VM boots. There is no SSH server in any guest.…