One command.Either runtime.
Containers for speed. VMs for isolation.
Isolated, reproducible, portable.
Hardware isolation without the weight, zero-drift builds, and one path to prod.
Hardware microVMs
KVM + Cloud Hypervisor. Sub-2s boot, virtio-fs, TAP networking, hardware page-table isolation.
Deterministic builds
Content-addressed closures — bit-for-bit reproducible. Binary cache, hermetic sandbox, no host mutation.
Dual-engine switching
One flag switches runtime. Rootless Podman ↔ microVM via live socket handover. Zero downtime.
Self-hosted · Apache 2.0
Bare metal, edge, or cloud you own. No external APIs. TOML-declared, fully local.
Source to serving, one graph.
Parse the manifest, build a closure, dispatch to a microVM or a container, then publish a route.
Isolation costs — measured.
Spawn-to-ready on bare metal. Compare KVM microVMs against rootless Podman.
Go server · standard HTTP baseline
Totals are spawn-to-ready. microVM includes Cloud Hypervisor init, virtiofs, and guest kernel boot. Container is a direct rootfs bind. Lower is better.
One surface, both runtimes.
Declarative Russelfile.toml or imperative russel-cli. Same control plane for containers and microVMs.