An agent proposes. A person decides. A real run: the Keep runtime and a real FluxVM microVM on KVM, on a shared lab host. The waits are trimmed; the printed times (75 s to speculate, 118 s to apply) are what that loaded host took, not a benchmark. How these are made
Private cloud control plane for Linux. VMs, networking, storage, security and AI inference from one daemon: one ~15MB Rust daemon that deploys in about 5 minutes on any Linux server with KVM, driven the same way from the CLI, the web console, the Kubernetes operator and Terraform.
780+ REST endpoints · 53 Rust crates · 4 front doors, one API · 92-page web console · Built on FluxVM + GuestKit
Quickstart · Keep · AI Workloads · Deploy · Docs · Talk to Zyvor
| Release | What landed |
|---|---|
| Keep | Speculative execution: POST /v1/sessions/{id}/speculate runs a command in an isolated copy of the cell and holds the file changes behind a changeset approval. A person's approve applies them on FluxVM; a deny rejects them. The agent cannot approve |
| Keep | FluxVM credential grants through /v1/sessions/{id}/grants, only for credentials whose Keep limits a grant can keep (no approval, method, path or per-user limits) |
| FluxVM | fluxvm-client gains fork, snapshot, restore, ?ready=exec, Idempotency-Key on create and delete, guest exec policy, balloon and PSS memory (fabricctl live-fork, fabricctl memory, fabricctl balloon; balloon is Beta), CD-ROM eject and the vz backend. Fork, snapshot, restore, idempotency and Keep speculate/approve/deny were run against a real FluxVM on KVM; see the boundary doc for what was and was not |
| Keep | Credential secrets from a file or from HashiCorp Vault (source vault), with Vault AppRole and Kubernetes login and chart values |
| Keep | The runtime rejects policy fields it does not enforce |
| 0.3.0 | POST /v1/agui: an AG-UI endpoint over Keep sessions, validated against the official @ag-ui/core 1.0.0 schemas; it cannot approve anything |
| 0.3.0 | Solvor, a native SwiftUI Mac client for Keep (integrations/macos-keep), plus keepctl init to scaffold a new use-case pack |
| 0.3.0 | OCR for photos and screenshots inside the cell, six bank operations packs, and more everyday use cases |
| 0.3.0 | zyvorctl is now fabricctl, and it finds a TLS daemon on localhost:9095 without --server |
| 0.3.0 | Fixed: use-case cells now get a host-applied deny-all policy and fail closed; finished runs delete their cell at once |
Full history: CHANGELOG.md.
| If you are… | Use it for | Start here |
|---|---|---|
| Building with AI agents | A sealed microVM per agent run, network rules the host sets, approvals you hold | Keep |
| Running a private cloud | VMs, networking, storage and security from one daemon on any Linux server with KVM | Quickstart |
| Running Kubernetes | VMs as VirtualMachine resources next to your pods |
Kubernetes |
| Managing a Mac fleet | Solvor, the native Mac client for Keep | Solvor |
| Wanting inference near your VMs | OpenAI-compatible endpoints on the same daemon (single-cluster Beta) | AI Workloads |
| When this happens… | Zyvor Fabric gives you… |
|---|---|
| The CLI, the console and your Terraform each drift from one another | One REST API with 780+ endpoints behind the CLI, the web console, the Kubernetes operator and Terraform |
| VM lifecycle is tied to libvirt XML or systemd units | FluxVM supervises each VM's hypervisor process directly, and host networking uses direct netlink calls |
| Auth, RBAC and audit are a separate project | PAM/LDAP/OIDC sign-in, JWT auth, 3-tier RBAC, audit export and encryption at rest, built in, with a 31-round security audit report |
| You want private inference next to your VMs, not in someone else's cloud | OpenAI-compatible inference on the same daemon: models, Maglev-weighted backends and API keys (single-cluster Beta) |
| You want to give an AI agent a computer without giving it your network | Keep: a sealed microVM whose network policy the host sets, with approvals you hold |
| Deploying a private cloud is a multi-week project | One daemon on any Linux server with KVM: bare metal, Docker, Kubernetes or Operator only |
zyvor-fabricd gives you VM lifecycle, software-defined networking, pluggable storage, security policy and OpenAI-compatible AI inference. The CLI, the web console, the Kubernetes operator and Terraform all talk to the same API, so nothing drifts between them.
Fabric does not implement VM execution itself. That is a deliberate design choice, not a gap: Fabric decides what should exist; FluxVM makes it exist; GuestKit prepares the disk.
Naming: the product is Zyvor Fabric; the daemon, unit and paths stay
zyvor-fabricd. Canonical repo: zyvorai/fabric. See docs/NAMING.md.
|
VMs and networking VM lifecycle, software-defined networking and a TC/eBPF VM-edge dataplane with per-VM policy and rate limits, on top of FluxVM. Network Fabric |
Storage and security Pluggable storage. PAM/LDAP/OIDC sign-in, JWT auth, 3-tier RBAC, audit export and encryption at rest, built in. Security |
AI inference Beta OpenAI-compatible inference on the same daemon: models, Maglev-weighted backends and API keys. Single-cluster Beta, not GA. AI Workloads |
|
Keep An open agent workstation: drop a file, get answers, in a sealed microVM whose network policy the host sets. The docs say exactly what its evidence class does not prove. Keep |
Kubernetes, Operator, Terraform Run fabricd and FluxVM in a cluster with Helm or manifests; the operator turns VirtualMachine CRs into API calls; a Terraform provider is included.Kubernetes |
Console and CLI A 92-page web console and fabricctl, both first-class against the same 780+-endpoint REST API.Web console |
| Zyvor Fabric | Proxmox VE | |
|---|---|---|
| Hypervisors | QEMU/KVM, Cloud Hypervisor, Firecracker, via FluxVM | QEMU/KVM plus LXC containers |
| Management layer | FluxVM (systemd-free) + one REST API | pvemanager with a Perl backend |
| Automation | 780+-endpoint JSON REST API, SSE events, Kubernetes operator, Terraform provider included | REST API, pvesh, community Terraform providers |
| Cluster model | Single-host or small cluster (multi-host networking available) | Built-in multi-node cluster with its own cluster filesystem (pmxcfs) |
| Live migration | Disk-copy path GA; native FluxVM transport preview; full HA cutover pre-GA | Built-in cluster migration |
| AI inference | OpenAI-compatible inference on the same daemon (Beta) | Not part of the product |
| License | Apache-2.0, in full | AGPL plus an optional subscription |
| Choose Proxmox VE when | You need large multi-host clusters with mature shared-storage live migration today, or first-class Windows guests |
Is this for you? It fits API-first automation, single-host or small-cluster deployments, security-conscious teams, and private inference next to the VMs. Look elsewhere for large multi-host clusters with mature live migration today, a deep libvirt-XML ecosystem, or first-class Windows guests. The honest version, the comparison matrix and the FAQ.
The console dashboard — fleet health, capability status and live VM metrics at a glance.
Keep it yours. Keep is the sealed agent runtime you run, read and take with you. Muse column from its public announcement; evidence class today is software-test.
Solvor, the native Mac client for Keep: pick a use case, then read the result of a run in a sealed cell.
- Architecture: how Fabric composes FluxVM and GuestKit — docs/architecture-fluxvm-guestkit.md.
- Zyvor platform stack: where Fabric sits among the Zyvor products — docs/platform-stack.md.
Requires a Linux server with KVM.
git clone https://github.com/zyvorai/zyvorai-fabric.git && cd fabric
make build && sudo make install
sudo zyvor-fabricd # or: sudo systemctl enable --now zyvor-fabricd
fabricctl create web-01 --image fedora-41 --cpus 2 --memory 4096 --tenant acme
# Web UI → https://localhost:9095 (console at /app)Default ports: 9095 (API + UI) and 7788 (FluxVM on localhost). The full path table, verification commands and multi-tenant notes are in Getting started; a laptop dev setup is in QUICKSTART.md.
| Metric | Value |
|---|---|
| Rust crates | 53 |
| REST endpoints | 780+ (main API) — 824 combined with the OpenStack-compatibility layer |
| LOC | ~87K (60K Rust + 27K TS) |
| Web stack | React 19.2 · Vite · Tailwind |
| Interfaces | 4 (CLI, Web, Operator, Terraform) + Fabric Doctor |
| Web pages | 92 (87 console + 5 marketing) |
| Security | 31-round audit, 194 issues found and fixed, 0 outstanding (report) |
| Deploy modes | Bare metal · Docker · Kubernetes · Operator |
All figures above are counted directly from source (route definitions, router config, crate manifest, audit report) — see docs/PRODUCT_OVERVIEW.md for the methodology.
Four first-class ways to run Fabric. Pick one; the full guide is docs/deploy.md.
- Bare metal (systemd), easiest path:
./scripts/ship USER@HOSTships FluxVM and Fabric in one command. Details. - Docker / Podman:
make docker-up, thenhttp://localhost:9095. Details. - Kubernetes:
./scripts/deploy k8s USER@HOSTfor a k3s lab, or Helm fromcharts/zyvor-fabric. Details and docs/KUBERNETES.md. - Operator only: CRDs that drive an already-running fabricd, from
operator/.
| Topic | Doc |
|---|---|
| Every document, by area | docs/index.md · docs/documentation-map.md |
| Getting started and deploy | docs/getting-started.md · docs/deploy.md · QUICKSTART.md |
| Positioning, overview and every feature | docs/POSITIONING.md · docs/PRODUCT_OVERVIEW.md · FEATURES.md |
| Architecture | docs/architecture.md · docs/architecture-fluxvm-guestkit.md |
| REST API, OIDC/SSO and networking | docs/api.md · docs/oidc.md · docs/networking.md |
| AI Workloads (Beta) | docs/ai-workloads.md · Tutorial 15 |
| Keep (open agent workstation) | docs/keep/README.md · docs/keep/at-a-glance.md |
| Tutorials and user manuals | docs/tutorials/README.md · docs/user/README.md |
Contributions are welcome. See CONTRIBUTING.md for the development setup, code style and PR process.
make build # backend + web
make test # Rust + web tests
make lint && make fmtdocs/ and this README are authoritative; historical build summaries in the repo root are snapshots.
| Area | Status (from the repo's own docs) |
|---|---|
| VM lifecycle, networking, storage, security, CLI, console, operator, Terraform | Shipped; see FEATURES.md |
| Live migration | Disk-copy path GA; native FluxVM transport preview; full HA cutover pre-GA (comparison matrix) |
| AI Workloads | Single-cluster Beta; multi-site HA store stays Preview; not GA (at a glance) |
| Keep | Evidence class software-test; Keep 0.2 hardware still gated; the Kubernetes chart is rendered and schema-checked but never installed in a cluster (status) |
| Product | Role next to Zyvor Fabric |
|---|---|
| Zyvor Fabric | Private cloud control plane: VMs, networking, storage, security, inference |
| FluxVM | The VM engine Fabric is built on: makes what Fabric decides exist |
| GuestKit | Offline VM disk inspection, repair and customization; prepares the disk |
| hyper2kvm | Multi-cloud VM migration, listed next to Fabric in the platform stack |
Zyvor Fabric is free and open source under the Apache License, Version 2.0, in full — there is no dual-licensing or separately-licensed core component. You may use, modify, and run it for personal, lab, and commercial production use at no charge, subject to Apache-2.0 (preserve notices / NOTICE where required). See NOTICE.
Zyvor Enterprise adds what production teams ask for: supported releases, deployment and upgrade guidance, priority incident triage, a named technical contact and 24x7 critical intake. Plans and terms: docs/SUBSCRIPTION-MODEL.md · Pricing · [email protected].
Report vulnerabilities per SECURITY.md.
