vmm runs lightweight Firecracker microVMs and whole Kubernetes clusters on a single bare-metal host, from one CLI and a browser console. Each VM boots in seconds with its own kernel, IP address and SSH access.
$ sudo vmm create dev-box --cpus 2 --memory 2048
$ sudo vmm start dev-box
$ sudo vmm list
NAME ID STATE CPUs MEMORY IP ADDRESS
dev-box 1e2e5700 running 2 2048 MB 172.16.0.2
$ sudo vmm ssh dev-box
root@vmm-guest:~# 
Personal software. vmm was built, mostly with Claude Code, to scratch its author's own itch. It is tested on Ubuntu 24.04 and works well there, but there are no guarantees on other setups. Caveat user.
Somewhere between Docker and a full hypervisor: real kernels and real isolation, with container-like speed and a command line that stays out of your way.
Each VM is a single Firecracker process with its own kernel, ext4 rootfs, TAP device and IP. Set vCPUs, memory and disk per VM, or set defaults once in config.json. VMs can start automatically at boot through a systemd unit, and vmm console shows the serial output for debugging boots and kernel panics.
vmm generates and manages its own Ed25519 key and injects it into every VM, so --ssh-key is optional. Your own keys are added alongside it.
Turn any Docker image into a bootable rootfs, or pull ready-made Ubuntu 24.04, Kubernetes, security and dev images from GitHub releases.
$sudo vmm image import ubuntu:22.04 --name baseCapture a running VM's memory, device state and disks, then roll it back in place later. Useful before risky upgrades, or for replaying an exploit from a known state.
$sudo vmm snapshot create myvm cleanA Linux bridge, TAP devices, IP allocation and NAT are set up automatically, and VMs are reachable from the host by default. Started a new service on a running VM? Forward a TCP or UDP port to it and it's live straight away. Forwards follow the VM through stops, starts and restores, and work alongside Docker.
$sudo vmm port-forward add myvm 8080:80Build multi-node clusters from microVMs with kubeadm, using Cilium (with kube-proxy replacement) or Calico. Pick the Kubernetes version by choosing a rootfs image, add worker nodes, and optionally add an admin workstation with kubectl already configured. The cluster context is merged into your kubeconfig, so you can use kubectl from the host straight away.
Run an OpenShift-derived cluster with upstream MicroShift on OKD payload images. No Red Hat subscription is needed.
$sudo vmm cluster create ocp --type openshiftNeed a VM that runs VMs of its own, for Kata, KubeVirt, a hypervisor lab or vmm itself? --nested runs it under Cloud Hypervisor with VT-x/AMD-V exposed, so the guest gets /dev/kvm. It boots the same images, joins the same bridge and works with SSH, mounts and port forwards, right alongside your Firecracker VMs.
Pre-built kernels for general use, nested VMs (KVM), Kubernetes (BTF, eBPF, tracing), and security research across the 5.10–6.18 LTS series, including KASAN builds. You can also build your own with a profile.
$sudo vmm kernel pull kasan-kernelShare host directories with a VM as ext4 block devices at /mnt/<tag>, read-only or read-write, and sync them back when you're done.
An optional browser console for VMs, clusters and images, with live state updates, an in-browser SSH terminal, a file browser for copying files in and out of VMs, a port forwards page and a Bearer-token REST API.
$VMM_WEB_PASSWORD=… sudo -E vmm-webOne command moves the host to the latest release. vmm upgrade checks the download against the release checksums, swaps vmm and vmm-web in place and upgrades Firecracker (and Cloud Hypervisor, if you use it) when a release needs it. It then restarts only the web console. Running VMs keep running, the previous binaries are kept for --rollback, and the web console tells you when a new version is out.
$ vmm upgrade --check
installed: 0.14.0
latest: 0.15.0
$ sudo vmm upgrade
[ok] vmm 0.15.0
[ok] vmm-web 0.15.0
[ok] vmm-web.service restarted
# running VMs were not stoppedvmm-web is a separate, optional binary. It gives you a dashboard for every VM and cluster, live state updates, a terminal that runs in the browser, and one place to see and manage every port forward on the host.
Binds to localhost unless you say otherwise. It enforces a password, CSRF protection, a strict CSP and rate-limited login.
The JSON API under /api/v1 can list, create, start, stop and delete VMs and clusters, and add or remove port forwards, using a Bearer token.
A systemd unit reads its password from /etc/vmm-web/environment, so the console is available as soon as the host boots. It also flags new releases, which sudo vmm upgrade installs.
No daemon to babysit. vmm uses Firecracker (or Cloud Hypervisor for nested VMs), TAP devices, a bridge and iptables directly, and keeps its state in JSON files you can read.
/var/lib/vmm, written atomically. Change the location with vmm config set data_dir.vmm upgrade verifies a release against its checksums, then swaps binaries by atomic rename, keeping .prev copies. Firecracker and Cloud Hypervisor processes that are already running are untouched, so VMs keep running through an upgrade.No clone and no build step. The installer fetches a verified release, Firecracker and the default images. After that, vmm upgrade keeps the host current without stopping your VMs.
Check that virtualisation is enabled (/dev/kvm should exist), then install. Add --with-services to also set up VM auto-start and the web console.
$ curl -fsSL https://raesene.github.io/baremetalvmm/install.sh \
| sudo bashOptions go after bash -s --: --with-services, --with-cloud-hypervisor, --version 0.14.0, --no-images. Re-running the installer is safe. You can read the script first.
VMs are reachable from the host straight away. Use vmm port-forward to expose services elsewhere.
$ sudo vmm create myvm --cpus 2 --memory 1024
$ sudo vmm start myvm
$ sudo vmm ssh myvmOptional: sudo vmm config init writes /etc/vmm/config.json for VM defaults, or a different data directory with --data-dir.
vmm uses the Kubernetes kernel and a k8s-<version> rootfs when they are installed, and merges a vmm-<name> context into your kubeconfig.
$ sudo vmm cluster create lab --workers 2
$ kubectl --context vmm-lab get nodesUpgrades are checksum-verified and swap the binaries in place. Running VMs keep running, and only the web console restarts. The console also tells you when a new release is out.
$ vmm upgrade --check
$ sudo vmm upgradeUndo with sudo vmm upgrade --rollback. Don't stop vmm.service to upgrade: stopping it stops every running VM. vmm upgrade ships from v0.14.0; re-run the installer to upgrade older versions.
The uninstaller is idempotent and removes binaries, services, data and NAT rules. Add --yes to skip the prompt.
$ sudo /usr/local/share/vmm/uninstall.shThe full guides live in the repository alongside the code.
| Guide | Covers | File |
|---|---|---|
| CLI reference | Every command, flag and option | docs/commands.md |
| Configuration | Config file, VM defaults, data directory, shell completion | docs/configuration.md |
| Images & kernels | Available images, Docker import, custom kernels, snapshots | docs/images-and-kernels.md |
| Networking & mounts | Network layout, port forwarding, DNS, SSH keys, host mounts | docs/networking.md |
| Kubernetes clusters | kubeadm with Cilium or Calico, workers, admin workstation | docs/kubernetes.md |
| OpenShift clusters | Single-node MicroShift on OKD payload images | docs/openshift.md |
| Web UI | Dashboard, web terminal and JSON API | docs/web-ui.md |
| Nested virtualization | VMs that run their own VMs, on the Cloud Hypervisor backend | docs/nested-virtualization.md |
| Security testing | Security and KASAN kernels for vulnerability research | docs/security-testing.md |
| Development | Building from source, project layout, systemd services | docs/development.md |
| Troubleshooting | Common problems and how to debug them | docs/troubleshooting.md |