WINDOWS AND LINUX MACHINE CONTROL PLANE

Kryton

One stable REST + CloudEvents machine API in front of interchangeable backends — demo, dockur, libvirt, and KubeVirt stay behind the provider boundary.

REST + CloudEvents Go 1.27.1+ Apache-2.0

Get the highlights.

• 41
  Interchangeable providers behind one machine API — demo, dockur, libvirt, KubeVirt
• 12
  krytond replica supported today — single-writer TTL reconciler and in-process event bus
• 33
  RBAC roles — viewer, operator, admin — always scoped to project
• Apache-2.0
  Open-source license — no Windows media or keys shipped

• ❓

  FAQ

  Questions people evaluating Kryton actually ask, before they've decided to adopt it.

  →
• 📘

  User guide

  Pick the path that matches your role — evaluator, lab operator, production operator, or integrator.

  →
• 🪟

  KubeVirt Windows VMs

  Provision Windows 11 on Kubernetes via KubeVirt — callers never touch VirtualMachine YAML.

  →
• 🐧

  Linux VMs

  Eleven Linux cloud-image templates with cloud-init and SSH keys, on a libvirt KVM host or KubeVirt.

  →
• 🧩

  Architecture

  One stable machine API; providers translate it into demo state, dockur compose stacks, libvirt domains, or KubeVirt VirtualMachines.

  →
• ✅

  GA path

  The KubeVirt provider is the GA path; dockur remains a lab installer and libvirt an initial host backend, not GA.

  →

Kryton is a small, open-source (Apache-2.0) control-plane API for Windows and Linux machines — one stable REST+CloudEvents contract in front of interchangeable backends (demo, dockur, libvirt, KubeVirt). It is not a Windows installer or activation service, not a raw KubeVirt YAML factory, and not a full desktop virtualization/VDI product in its own right.

For the full project overview — quick start, install, project layout, and the "how to use Kryton" walkthrough — see the README on GitHub.

What's included today

• 🆔 Stable UUIDs, independent of namespace or provider name
• 🔐 API keys or trusted reverse-proxy auth, secure by default
• ♻️ Day-2 ops: start / stop / snapshot / TTL expiry, SSE + webhooks
• 🩺 krytonctl doctor + /api/v1/doctor diagnostics
• 🖥️ Operator dashboard with collapsible rail (light/dark)
• 📜 Apache-2.0 — no Windows media or keys shipped

• Documentation index — the full "I want to… → read" map, plus scripts reference
• Authentication — get and use the API key

Troubleshooting is covered inline in the relevant guide rather than a separate document — see the "Troubleshooting" sections of User guide, Authentication, and KubeVirt.

1. Four providers translate one contract: demo (in-memory), dockur (real Windows via dockur/windows), libvirt (Linux cloud images on a KVM host), and kubevirt (production Windows and Linux VMs via operator-managed images and cloud-init). See Architecture — Take a closer look. ↩
2. internal/reconciler/ttl.go has no leader election and internal/events' history/SSE bus is in-process, so only one krytond replica is safe today; the Helm chart pins replicaCount: 1. See Architecture — Single-replica today. ↩
3. Roles viewer/operator/admin are always intersected with project membership. See Architecture — Projects. ↩