Fix it, contain it, undo it.
The latest releases, straight from the commit log.
VPC forwarding and ACLs
Peering, internet-gateway and blackhole routes and stateless network ACLs are enforced on the hosts, over the WireGuard overlay between them.
Production profile
A strict, opt-in startup check, key rollover for JWT and master keys, audit retention and a mandatory eBPF datapath.
ARM64 packages
DEB, RPM and tar bundles for amd64 and arm64, built and tested on native runners.
EC2-compatible API
Point awscli, boto3 and Terraform at the controller: 288 actions, each applied, recorded or refused by name.
PostgreSQL controller
Run the controller on PostgreSQL for large fleets or several controllers; one command migrates an SQLite site.
FluxVM backend
FluxVM VMs sit next to libvirt VMs, with eBPF networking, live migration and HA across hosts.
Boot Doctor
A VM that won't boot is diagnosed and repaired offline through GuestKit, after a backup.
VM quarantine
Isolate a suspect VM in the eBPF datapath under a lease that lapses on its own.
Just-in-time access
Open a VM for a set time, with two-person approval and automatic expiry.
Zyra verify and undo
Every AI action is checked afterwards and can be rolled back in one click.
VM flow history
Service map, learn and replay of VM traffic, with lateral-movement alerts.
DNS threat feeds
VM network policy blocks known-bad domains straight from threat feeds.
The cloud you own, without the sprawl.
OpenStack is a six-week project and a full-time team.
One machinactl deploy: a few Rust services, embedded SQLite (PostgreSQL when you outgrow it), a browser UI minutes later.
VMware renewal quotes keep climbing.
Open KVM/libvirt underneath, with HA failover, DRS and live migration on top.
libvirt ops live in a pile of virsh scripts.
One dashboard, a REST API, a CLI and a Terraform provider over the same model.
Every console needs its own gateway.
noVNC, SPICE, serial and SSH built into the daemon, with RBAC and audit.
On-call triages the same incidents at 3 a.m.
Zyra AI diagnoses and proposes the fix, then waits for a human approval.
Network and storage live in other silos.
Native eBPF does load balancing, CNI and isolation with leases that fail open; Atlas puts disks on Ceph, NFS or ZFS.
Run it. Reach it. Scale it. Secure it. Let AI watch it.
Every VM operation, in one place.
Create, clone, snapshot, back up and migrate KVM guests from a UI, a REST API with 1,000+ routes, a CLI or Terraform.
- Cloud-init and golden images (Packer)
- GPU and PCI passthrough
- Networks, storage pools and nwfilters
Consoles in the browser. No gateway to deploy.
noVNC, SPICE, serial and SSH are proxied by machina-daemon itself, behind the same RBAC and audit log as everything else.
- PAM, OIDC, SAML and LDAP sign-in
- Role-based access control
- Audit trail for every change
A fleet, not a host.
A gRPC agent per hypervisor. The controller keeps desired state, fails VMs over when a host dies, balances load with DRS and live-migrates between hosts.
- HA failover and host fencing
- DRS balancing and live migration
- Embedded SQLite, optional NATS
Fleet Cloud: a public-cloud experience on your metal.
Flavors, images, instances, volumes, security groups, keypairs, floating IPs, server groups, stacks, projects and load balancers, all native controller APIs.
- OpenStack-style primitives, no OpenStack
- Load balancers as host rules, no amphora VM
- Cloud-init on every instance
Networking and security, in the kernel.
One eBPF service, machina-bpfd, replaces Cilium, Tetragon, kube-proxy and a separate firewall agent: service load balancing, a Kubernetes CNI, DDoS shield, VM isolation and flow visibility.
- VM network policy: L3-L7, DNS, mTLS, threat feeds
- Quarantine and just-in-time access under a lease
- Maglev service LB and QUIC-LB at XDP
From a BMC address to a joined host.
Discover or import BMCs, commission machines over PXE or BMC virtual media, write a checksum-verified OS image, and let each one join the fleet on first boot. Verified on VMs and BMC emulators; not yet on physical servers.
- Redfish and IPMI power, boot device and virtual media
- Image catalog: Ubuntu, Debian, Rocky, AlmaLinux
- Profiles that keep N machines deployed
Zyra AI: an operator that asks first.
Autonomous diagnostics, incident correlation, rightsizing and natural-language operations, with an approval queue in front of every change.
- Human approval before actions
- Verifies every fix, one-click undo
- Bring your own LLM; keys encrypted at rest
Same private-cloud primitives.
A fraction of the moving parts.
Four Rust services and embedded SQLite (or PostgreSQL) instead of nine-plus services, a Galera cluster and a message bus. Choose OpenStack for thousands of tenants; choose Machina for the fleets you own.
From one command to a fleet.
Start on a single host with embedded SQLite, add hypervisors, move to PostgreSQL when the fleet grows.
Use the tools you already know.
SQLite or PostgreSQLEmbedded SQLite by default. PostgreSQL for hundreds of machines or several controllers, with a one-command migration and a way back.
Read more →
EC2-compatible APIawscli, boto3 and Terraform work against the controller with an endpoint override. Every action is applied, recorded or refused by name.
Read more →Four services. One private cloud.
machina-daemon:5092Single-host REST + WebSocket API, auth, RBAC and console proxies. Serves the web UI.
machina-controller:5093Fleet, HA, DRS, Fleet Cloud and Zyra AI. Embedded SQLite or PostgreSQL, optional NATS.
machina-agent:50051gRPC over TLS on every hypervisor. Executes libvirt and eBPF operations for the fleet.
machina-bpfdunix socketRoot eBPF service on every host: load balancing, CNI datapath, shield, isolation and telemetry.
Source you can read. A license you can understand.
Every source file carries an SPDX header checked in CI, the full git history is scanned for secrets, and the whole stack builds from this repository. Evaluate, develop, test and run your lab for free.
How licensing works →
Ready to run your own cloud?
Non-production use is free. Production runs on an annual enterprise subscription with updates, upgrades and the support level you choose.