MicroVM platform for AI sandboxing, cloud desktops, and ephemeral dev environments. Built on Cloud Hypervisor / Firecracker and Kubernetes.
Documentation: cocoonstack.github.io
| Repository | Description | Docs |
|---|---|---|
| cocoon | Lightweight MicroVM engine — OCI/cloud images, instant snapshot & clone, Windows 11 support, CNI networking, Docker-like CLI | docs |
| cocoon-agent | In-VM exec agent — vsock command channel behind cocoon vm exec / logs and per-clone identity reseed, no SSH | docs |
| cocoon-macos | macOS guests via QEMU + OpenCore + OVMF, reusing cocoon's cloudimg store and clone/snapshot model | docs |
| cloud-hypervisor | Patched Cloud Hypervisor fork — DISCARD fix, virtio-net ctrl_queue tolerance, upstream cherry-picks | — |
| rust-hypervisor-firmware | Patched UEFI firmware — ACPI ResetSystem fix for Windows graceful shutdown | — |
| windows | Windows 11 25H2 image factory — unattended QEMU build, Cloud Hypervisor validation (DHCP, RDP, SAC, ACPI shutdown), published to GHCR as OCI artifacts | — |
| Repository | Description | Docs |
|---|---|---|
| vk-cocoon | Virtual Kubelet provider — maps pod lifecycle to VM operations (run, clone, snapshot, hibernate) | docs |
| cocoon-operator | Kubernetes operator — CocoonSet and CocoonHibernation CRDs for stateful VM workflows | docs |
| cocoon-webhook | Admission webhook — sticky scheduling plus CocoonSet and CocoonHibernation validation | docs |
| cocoon-net | VPC-native networking — embedded DHCP plus alias IPs (GKE) or ENI secondary IPs (Volcengine) for direct VM DHCP | docs |
| cocoon-common | Shared Go library — CRD types, annotation contract, Kubernetes helpers, OCI registry + snapshot packages | — |
| Repository | Description | Docs |
|---|---|---|
| sandbox | Fast cold-boot AI-agent sandbox on cocoon — warm pools, in-guest daemon, per-node control plane, Go SDK | docs |
| sandbox-operator | Kubernetes operator and aggregated apiserver for the agents.x-k8s.io agent-sandbox API — warm microVM pools, claims through any Kubernetes SDK, etcd off the claim path | docs |
| vk-sandbox | Virtual Kubelet provider for sandbox-operator — serves runtime: sandboxd claims from node-local hot pools and publishes NodeInventory | docs |
Pinned Loading
Repositories
- firecracker Public Forked from firecracker-microvm/firecracker
Secure and fast microVMs for serverless computing.
- cloud-hypervisor Public Forked from cloud-hypervisor/cloud-hypervisor
A Virtual Machine Monitor for modern Cloud workloads. Features include CPU, memory and device hotplug, support for running Windows and Linux guests, device offload with vhost-user and a minimal compact footprint. Written in Rust with a strong focus on security.
- sandbox-operator Public
Kubernetes operator and aggregated apiserver implementing the agent-sandbox standard: warm microVM pools, ~33 ms claims through the Kubernetes API, and fleet scale with etcd off the claim path.
- cocoon Public
Lightweight MicroVM engine built on Cloud Hypervisor. Features include OCI and cloud image support, instant snapshot and clone via reflink, Windows 11 guest support, CNI networking with TC redirect, memory balloon, hugepages, and a Docker-like CLI. Designed for AI sandboxing, cloud desktops, and ephemeral dev environments.
- cocoon-operator Public
Kubernetes operator for stateful VM-backed pod workflows. Provides Hibernation CRD to suspend and wake VMs without pod deletion, and CocoonSet CRD to manage groups of related VM-backed pods with stable slot identities. Keeps stateful VM workloads inside native Kubernetes APIs.
- vk-cocoon Public
Virtual Kubelet provider that runs Kubernetes pods as Cocoon MicroVMs. Maps full pod lifecycle to VM operations including run, clone, restore, snapshot, and hibernate. Supports Windows and Linux guests, kubectl exec/logs/attach/port-forward, and integrates with Epoch for remote snapshot pulls.
- vk-sandbox Public
Virtual-kubelet provider for sandbox-operator — serves runtime: sandboxd claims from node-local sandboxd hot pools and publishes NodeInventory for the aggregated claim path.
- gateway Public
Single-binary LLM gateway (gw) in Rust — OpenAI/Anthropic-compatible APIs, multi-provider routing, per-key auth/quotas/rate-limits, failover, streaming, and a billing ledger
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…