Zyvor Fabric
VMs. Networking. Storage. Security. AI. One ~15 MB Rust daemon, deployed in about 5 minutes on any Linux server with KVM. Driven the same way from the CLI, the web console, Kubernetes and Terraform.
Get started · Meet Merion · Documentation · Talk to Zyvor
780+ endpoints. 4 front doors. 1 API.
53 Rust crates · 92 console pages · 31 security audit rounds, 0 outstanding · Apache-2.0, in full
Counted from source. Methodology
One daemon.
Four front doors.
zyvor-fabricd gives you VM lifecycle, software-defined networking, pluggable storage, security policy and OpenAI-compatible AI inference. The CLI, the web console, the Kubernetes operator and Terraform all talk to the same API, so nothing drifts between them.
Fabric does not implement VM execution itself, and that is deliberate: Fabric decides what should exist. FluxVM makes it exist. GuestKit prepares the disk.
Naming: the product is Zyvor Fabric; the daemon, unit and paths stay zyvor-fabricd. Canonical repo: zyvorai/fabric. See docs/NAMING.md.
Merion.
Your agent gets a real computer.You keep the keys.
An open workstation for an AI agent you can't fully trust: a sealed microVM, network rules the host enforces, and approvals only you can give. Run it, read it, take it with you.
Every cluster.
One view.
Register your other Fabric daemons and see their hosts, VMs and health together in the console. A host that is down never breaks the list, and maintenance runs on the target host's own API with your own permissions. Federation guide ›
Get started.
Five minutes. One server.
Requires a Linux server with KVM.
git clone https://github.com/zyvorai/fabric.git && cd fabric
make build && sudo make install
sudo zyvor-fabricd # or: sudo systemctl enable --now zyvor-fabricd
fabricctl create web-01 --image fedora-41 --cpus 2 --memory 4096 --tenant acme
# Web UI → https://localhost:9095 (console at /app)
Default ports: 9095 (API and UI) and 7788 (FluxVM on localhost). The full path table, verification commands and multi-tenant notes are in Getting started; a laptop dev setup is in QUICKSTART.md.
Deploy your way
| |
|---|
| Bare metal | ./scripts/ship USER@HOST ships FluxVM and Fabric in one command. Details |
| Docker / Podman | make docker-up, then http://localhost:9095. Details |
| Kubernetes | ./scripts/deploy k8s USER@HOST for a k3s lab, or Helm from charts/zyvor-fabric. Details · Guide |
| Operator only | CRDs that drive an already-running fabricd, from operator/ |
Who it is for
| If you are… | Use it for | Start here |
|---|
| Building with AI agents | A sealed microVM per agent run, network rules the host sets, approvals you hold | Merion |
| Running a private cloud | VMs, networking, storage and security from one daemon | Quickstart |
| Running Kubernetes | VMs as VirtualMachine resources next to your pods | Kubernetes |
| Managing a Mac fleet | Solvor, the native Mac client for Merion | Solvor |
| Wanting inference near your VMs | OpenAI-compatible endpoints on the same daemon (single-cluster Beta) | AI Workloads |
Is this for you? It fits API-first automation, single-host or small-cluster deployments, security-conscious teams, and private inference next to the VMs. Look elsewhere for large multi-host clusters with mature live migration today, a deep libvirt-XML ecosystem, or first-class Windows guests. The honest version, the comparison matrix and the FAQ.
Fabric vs Proxmox VE
| Zyvor Fabric | Proxmox VE |
|---|
| Hypervisors | QEMU/KVM, Cloud Hypervisor, Firecracker, via FluxVM | QEMU/KVM plus LXC containers |
| Management layer | FluxVM (systemd-free) + one REST API | pvemanager with a Perl backend |
| Automation | 780+-endpoint JSON REST API, SSE events, Kubernetes operator, Terraform provider included | REST API, pvesh, community Terraform providers |
| Cluster model | Single-host or small cluster (multi-host networking available) | Built-in multi-node cluster with its own cluster filesystem (pmxcfs) |
| Live migration | Disk-copy path GA; native FluxVM transport preview; full HA cutover pre-GA | Built-in cluster migration |
| AI inference | OpenAI-compatible inference on the same daemon (Beta) | Not part of the product |
| License | Apache-2.0, in full | AGPL plus an optional subscription |
| Choose Proxmox VE when | | You need large multi-host clusters with mature shared-storage live migration today, or first-class Windows guests |
How it fits together
Maturity
| Area | Status (from the repo's own docs) |
|---|
| VM lifecycle, networking, storage, security, CLI, console, operator, Terraform | Shipped; see FEATURES.md |
| Live migration | Disk-copy path GA; native FluxVM transport preview; full HA cutover pre-GA (comparison matrix) |
| AI Workloads | Single-cluster Beta; multi-site HA store stays Preview; not GA (at a glance) |
| Merion (was Keep) | Evidence class software-test; Merion 0.2 hardware still gated; the Kubernetes chart is rendered and schema-checked but never installed in a cluster (status) |
| Slack/Teams approvals, OpenTelemetry export, federation view, Android app | Merged. Tested against local fakes; not yet against a live Slack workspace, collector, second daemon or Android device |
What's new
| |
|---|
| Timed and counted limits | Auto-approve grants that expire (ttl_minutes), a write limit per session (sequence.max_writes), and model-call caps per run and per goal. All off by default. Grants, writes, budgets |
| MCP gateway | Register tool servers; a cell reaches them only through the broker, which allows listed tools, rate limits, journals names (never arguments) and keeps approvals. Design |
| Signed session recording | A masked, ordered, Ed25519-signed replay bundle of what a session did; content is left out. Design |
| Delegated vs autonomous | Every egress journal row says whether a person's own connection, a host credential or nothing was used. Design |
| Run webhook | One signed run.finished event per run, with no content. Design |
| Approve from Slack or Teams | Requests arrive with the host-rendered preview and its digest. Buttons only when no phone signature is required. Design |
| OpenTelemetry export |
Every release, with the details: CHANGELOG.md.
Documentation
Contributing
Contributions are welcome. See CONTRIBUTING.md for the development setup, code style and PR process.
make build # backend + web
make test # Rust + web tests
make lint && make fmt
docs/ and this README are authoritative; historical build summaries in the repo root are snapshots.
Part of the Zyvor stack
| Product | Role next to Zyvor Fabric |
|---|
| Zyvor Fabric | Private cloud control plane: VMs, networking, storage, security, inference |
| FluxVM | The VM engine Fabric is built on: makes what Fabric decides exist |
| GuestKit | Offline VM disk inspection, repair and customization; prepares the disk |
| hyper2kvm | Multi-cloud VM migration, listed next to Fabric in the platform stack |
→ zyvor.dev
Support
Free under Apache-2.0. If it helps you, you can donate any amount you like: https://rzp.io/rzp/utwdYh3. A donation is voluntary and supports development and maintenance. It is not a purchase: it buys no support, SLA, features, priority or license, and it is not tax-deductible (Zyvor AI Labs Private Limited is a company, not a charity). Zyvor Enterprise (supported releases, SLAs, a named contact and enterprise features) is separate: [email protected].
License and support
Zyvor Fabric is free and open source under the Apache License, Version 2.0, in full — there is no dual-licensing or separately-licensed core component. You may use, modify, and run it for personal, lab, and commercial production use at no charge, subject to Apache-2.0 (preserve notices / NOTICE where required). See NOTICE.
Zyvor Enterprise adds what production teams ask for: supported releases, deployment and upgrade guidance, priority incident triage, a named technical contact and 24x7 critical intake. Plans and terms: docs/SUBSCRIPTION-MODEL.md · Pricing · [email protected].
Report vulnerabilities per SECURITY.md.
Run your private cloud from one daemon
