Zyvor · machine control plane

One stable machine API. Real Windows and Linux behind it.

A control plane for Windows and Linux machines. Portals, CI and automation talk to one REST + CloudEvents contract whether the backend is an in-memory demo, real Windows through dockur on a lab host, Linux cloud images on a KVM host through libvirt, or Windows and Linux VMs on KubeVirt.

Run the demo Read the docs Source on GitHub

Apache-2.0
Go 1.27.1+
REST + CloudEvents
OpenAPI
KubeVirt

make demo

# demo provider, auth disabled: evaluation only
$ make demo
# open http://localhost:8080
$ go run ./cmd/krytonctl list
$ go run ./cmd/krytonctl create win-dev-01
$ go run ./cmd/krytonctl doctor

4 providers, 1 contractdemo, dockur, libvirt, kubevirt.

11 Linux templatesUbuntu, Debian, Rocky, AlmaLinux, CentOS Stream, Fedora.

Hashed API keysStored as SHA-256 digests. Auth is never disabled on kubevirt.

2 Go dependenciesgorilla/websocket and golang.org/x/time.

Why a machine API

Each row is a problem the README names and the part of Kryton that answers it.

One contract

REST + CloudEvents with OpenAPI at /openapi.yaml, whatever the backend. Pagination with limit and cursor.

Lab to production, same API

Prototype on demo, move to dockur or libvirt, ship on kubevirt. Callers do not change.

Linux next to Windows

Eleven Linux cloud-image templates with cloud-init, SSH keys and checksum-pinned images, fetched against an approved SHA-256.

Stable identity

A UUID that survives a VM moving namespace or being renamed, independent of the provider's own name.

More than YAML

Machines, lifecycle, snapshots, jobs and an SSE event stream over HTTP, instead of raw KubeVirt custom resources.

Credentials auditors can read

API keys stored as SHA-256 digests, TLS, per-caller rate limits (429 / RATE_LIMITED, off by default).

Is this host ready?

krytonctl doctor checks auth, catalog, namespaces, DataSources, snapshot CRDs and StorageClass to snapshot class.

Browser console

Embedded noVNC console with no CDN dependency, Copy RDP, and a dockur catalog of 12 images.

Snapshots on CSI

Create, list, restore and delete through the API, the UI and krytonctl. Not available on the dockur provider.

Four providers, honest status

The README is explicit about what is production-ready. KubeVirt is the GA path; the checklist is in docs/GA.md.

Provider	What it drives	Status
`kubevirt`	Windows and Linux VMs on KubeVirt, behind Helm, with API keys and TLS	GA path
`dockur`	Real Windows through dockur/windows on a Docker or Podman + KVM host	Lab installer, not GA
`libvirt`	Linux cloud images on a KVM host	Initial host backend, not GA
`demo`	In-memory machines, auth disabled	Evaluation only

What Kryton is not

Not a Windows installer, activation service or media distributor. Microsoft licensing remains the operator's responsibility. Linux images are fetched by the operator against an approved checksum; Kryton ships none.

Out of GA scope

Multiple krytond replicas (single-writer reconciler, in-process event bus; replicaCount: 1) and live migration of the guest VM.

How it fits

Kryton is split at the provider boundary. Callers see one stable machine API; providers translate it into demo state, dockur compose stacks, libvirt domains or KubeVirt VirtualMachines. On KubeVirt it runs on top of it: the question is whether you build the application layer yourself.

One contract on top, interchangeable backends underneath. Source: README and docs/ARCHITECTURE.md.

You are	Do this	Provider	Auth
Trying locally	`make demo` on `:8080`	`demo`	off
Real Windows in a lab	Remote deploy and dockur	`dockur`	API key
Linux VMs on a KVM host	Deploy with `--provider libvirt`	`libvirt`	API key
Production Kubernetes	Golden image, KubeVirt and Helm	`kubevirt`	API key + TLS
Portal or CI	The API with `KRYTON_TOKEN`	any	API key

Quickstart

Requires Go 1.27.1+. The local demo uses the demo provider with auth disabled: evaluation only.

git clone https://github.com/zyvorai/zyvor-kryton.git && cd zyvor-kryton
make demo   # http://localhost:8080

Drive it from the CLI:

go run ./cmd/krytonctl list
go run ./cmd/krytonctl create win-dev-01
go run ./cmd/krytonctl doctor

Install the binaries:

make build
sudo install -m755 bin/krytond bin/krytonctl /usr/local/bin/

Deploy to a KVM host over SSH and create a Linux VM on libvirt:

./scripts/deploy-remote.sh <host> <user> --key --apikey --provider libvirt
bin/kryton-image fetch --image ubuntu-24.04 --dir /var/lib/kryton/images --sha256 "$APPROVED_SHA256"
krytonctl create --image ubuntu-24.04 --cpu 2 --memory 2048 --disk 20 --ssh-key ~/.ssh/id_ed25519.pub linux-dev

Next: the user guide, KubeVirt, dockur, authentication.

License

Kryton is free and open source under the Apache License 2.0 (see NOTICE). Report vulnerabilities per SECURITY.md; contributions are welcome, see CONTRIBUTING.md.

Support the project

Free under Apache-2.0. If it helps you, you can donate any amount you like: https://rzp.io/rzp/utwdYh3. A donation is voluntary and supports development and maintenance. It is not a purchase: it buys no support, SLA, features, priority or license, and it is not tax-deductible (Zyvor AI Labs Private Limited is a company, not a charity). Zyvor Enterprise (supported releases, SLAs, a named contact and enterprise features) is separate: sales@zyvor.dev.

Donate any amount