mvm

How a workload reaches a microVM

mvm is a Rust command line tool called mvmctl plus a set of language SDKs for running workloads in fast, hardware isolated microVMs. It can boot a workload from an OCI image, a Nix flake, or a decorated function, on macOS and Linux. The security model is enforced by continuous integration rather than by documentation. Every machine boots its own Linux kernel under a real hypervisor. There is no Docker on the runtime path, no SSH in any guest, and no guest network device at all on any backend. Because the guest has no network interface, every byte it sends crosses a vsock channel where the host can audit flows, substitute secrets so the workload never sees raw credentials, detect and replace secrets and structured personal data on owned cleartext paths, and enforce default deny egress from a signed execution plan. The host originates every outbound connection, which makes default deny egress and secret substitution mechanically enforceable. The macOS 26 or newer Apple Silicon backend uses an in house HVF virtual machine monitor with no extra dependencies. macOS 13 through 25 uses libkrun from Homebrew. Linux with /dev/kvm uses Firecracker. A transient machine boots, runs one command, and is torn down on exit. A persistent machine has a name and an on disk spec that you create, start, stop, and remove.

Defining a workload three ways

A workload can be defined in three ways and all three compile to the same artifact, a signed image plus a launch plan, and they boot identically on every backend. The first path is an OCI image, which is the fastest route with no flake and no host Nix. Provenance such as the registry, repo, resolved digest, layer list, and cosign verdict is recorded in a chain signed audit log, and the --prod flag refuses mutable tags before any network fetch. The second path is a Nix flake using the mkGuest helper, which builds reproducible minimal guests that carry only what you declare. Builds run nix build inside a builder VM, so host Nix is never used, and the same mvmctl produces byte identical artifacts on every host. Sealed images are dm verity verified and refuse interactive access, while the dev form keeps a console. The third path is a decorated function written in Python, TypeScript, or Rust. The mvmctl build compile command reads the file statically without executing it on the host and emits a flake plus launch plan. At build time the decorator and the mvm import are stripped from the bundled source, so the guest runs your plain function with no SDK dependency inside the microVM.

Installing and driving the CLI

The quickest install is a pre built release for macOS Apple Silicon and Linux x86 64 or aarch64 using the install script. From source you clone the repo, run cargo build --release, and copy the mvmctl binary into your path. Language SDKs install with pip install mvm for Python or npm install @runmvm/mvm for TypeScript. A host prerequisite check runs with mvmctl doctor, which diagnoses your machine and prints exact install hints. The basic run command is mvmctl machine run with an image and a command, and network access is off by default. Filesystem sharing, egress, and secrets are explicit launch decisions recorded in the signed execution plan. There is no SSH session, no daemon to operate, and no container fallback behind the command. The SDK story has two families. The decorator SDK declares a workload where it lives, and the runtime SDK drives machines imperatively through a Sandbox object or the MvmClient facade in Rust. The same MvmClient trait is what the CLI, the desktop studio GUI, and the fleet orchestrator called mvmd all consume, so one surface drives a local host or a remote fleet. Interactive surfaces such as exec and console are dev tier only and refuse with a SandboxDevOnly error on a restricted production grant.

Editorial conclusion

mvm is a Rust CLI called mvmctl with Python, TypeScript, and Rust SDKs, licensed under Apache 2.0. It boots workloads from OCI images, Nix flakes, or decorated functions into hardware isolated microVMs with a host brokered, default deny network path.