NEST
git ↗ Explore NEST
OPEN-SOURCE MICROVM INFRASTRUCTURE v0.1 / SINGLE-HOST FIRST

YOUR CLOUD.
YOUR HARDWARE.

NEST is an open-source infrastructure layer for creating isolated Linux microVMs on machines you control. Think cloud primitives, without handing the machine to a cloud provider.

View source ↗ See how it works ↓
KERNEL KVM
VMM FIRECRACKER
CONTROL NODE + PYTHON
01

FROM API CALL
TO RUNNING MACHINE.

01 REQUEST CPU · RAM · DISK · NETWORK
→
02 CONTROL PLANE AUTH · STATE · SCHEDULING
→
03 HOST AGENT TAP · STORAGE · LIFECYCLE
→
04 MICROVM FIRECRACKER · KVM · LINUX
THE POINT

STOP BUILDING
AROUND THE MACHINE.

NEST gives software a predictable place to run. Small Linux guests, isolated from each other, provisioned through an API and connected through explicit networking rules.

The first target is deliberately narrow: make one host behave like a tiny private cloud, then earn the complexity of multi-host infrastructure later.

01 / PROVISION

Spin up
isolated compute.

Describe the machine you need. NEST turns that intent into a Firecracker microVM with CPU, memory, disk and network state.

02 / NETWORK

Give every guest
its own boundary.

Private IPv4, TAP-backed networking, controlled egress and explicit inbound port mappings live in the Linux dataplane.

03 / RECOVER

Make failure
boring.

The system is designed around desired state, so a crashed process or rebooted host can be reconciled instead of becoming tribal knowledge.

02 / UNDER THE HOOD

THE API IS
THE EASY PART.

NEST is an orchestrator over battle-tested Linux primitives. Node.js owns the control plane. Python owns the privileged host work. Firecracker owns the VM boundary. Linux owns the dataplane.

DESIGN RULE FAIL
CLOSED. Security-sensitive failures should remove connectivity, not accidentally grant it.
01 CLIENT HTTPS + API KEY
02 CONTROL PLANE NODE.JS + POSTGRES
03 HOST AGENT PYTHON · PRIVILEGED SYSTEMS OPS
04 JAILER SECCOMP · NS · CGROUPS
05 FIRECRACKER KVM MICROVM
NETWORK DATAPLANE
INTERNET NFTABLES 10.42.0.0/24 TAP GUEST
03 / DEVELOPER EXPERIENCE

A MACHINE
AS AN API.

The abstraction should be boring. Request an instance, wait for it to become healthy, then treat it like infrastructure instead of a pet server.

Read the repository ↗
POST /v1/instances 
{
  "image": "ubuntu-24.04",
  "cpu": 1,
  "memory_mib": 512,
  "disk_gib": 4
}
desired state accepted → guest health checked
04 / OPEN SOURCE

THE MACHINE
STAYS YOURS.

No hosted control plane required. No opaque runtime. No “trust us” layer between your workload and your hardware. NEST is built in the open, with the control plane and host runtime designed as separate pieces from day one.

git.zerofucks.io/kstyagi/nest ↗ Read the roadmap ↓
05 / ROADMAP

DO THE HARD
PARTS FIRST.

v0.1 is not trying to become Azure overnight. Reliability, isolation and deterministic recovery come first. Scale comes after the single host deserves it.

00
HOST VALIDATIONKVM · Firecracker · one booting microVM
NOW
01
SINGLE VM ENGINELifecycle · images · runtime directories
BUILD
02
NETWORKINGTAP · bridge · IPAM · NAT · port mappings
BUILD
03
CONTROL PLANEAPI · PostgreSQL · auth · scheduling
NEXT
04
RECONCILIATION + HARDENINGRecovery · Jailer · cgroups · seccomp
NEXT
05+
MULTI-HOSTScheduling · distributed IPAM · snapshots · storage · more
LATER
BUILD SOMETHING.

YOUR
HARDWARE.

Clone the repo. Boot a microVM. Then make it better.

Open NEST on Gitea ↗