Firecracker is a lightweight virtual machine monitor (VMM) designed for secure, multi-tenant cloud workloads. It creates microVMs using hardware virtualization (KVM) combined with container-like speed, primarily targeting serverless and container runtime environments. The system exposes a RESTful API for VM lifecycle management, configuration, and snapshotting, with a strong emphasis on security through seccomp filtering and process isolation via a dedicated jailer binary. The architecture consists of a core VMM binary written in Rust, handling device emulation (VirtIO), memory management, and KVM integration. It supports both x86_64 and aarch64 architectures, with significant conditional compilation to manage hardware-specific differences. The project includes a comprehensive testing framework using Python for integration, functional, and security validation, alongside formal verification proofs (Kani) for critical paths like network packet parsing. While the core VMM logic is highly optimized and production-grade, the codebase exhibits medium technical drift due to tight coupling with specific Linux kernel versions and features (e.g., io_uring, userfaultfd). The Rust toolchain configuration also shows experimental flags (edition 2024), indicating ongoing adaptation to newer compiler standards. Despite this, the project remains actively maintained with a robust CI/CD pipeline and regular security updates.
uStreamer is a lightweight, high-performance MJPEG-HTTP video streaming server designed primarily for PiKVM (IP-KVM over HDMI). It captures video from V4L2 devices (USB cameras, HDMI capture cards) and streams it as MJPEG over HTTP with sub-second latency, while also supporting H.264 streaming via WebRTC through a Janus plugin. The system is a single, multithreaded C daemon with pluggable JPEG encoders (CPU via libjpeg-turbo, hardware passthrough, and V4L2 M2M acceleration) and includes a worker pool for parallel encoding. It integrates tightly with Linux multimedia subsystems (V4L2, ALSA, DRM) and provides additional features like audio capture/playback with Opus encoding, GPIO control, systemd socket activation, and shared memory IPC for zero-copy frame access by other processes (e.g., Janus, Python bindings, dump tool). The codebase is production-grade, extensively tested in the PiKVM ecosystem, and packaged for multiple Linux distributions and container environments. The architecture separates concerns into clean modules: capture (V4L2 buffer management with DMA export), encoding (abstraction over CPU/HW/M2M), HTTP server (libevent-based, serving MJPEG streams, snapshots, and static assets), and a generic worker thread pool for parallel JPEG compression. Shared memory sinks (memsink) enable efficient frame transfer to external consumers like the Janus WebRTC plugin or the standalone dump utility. The project also includes a full-featured Janus plugin for H.264/Opus streaming with NTP timestamping and PLI handling, a Python C extension for shared memory client access, and a separate V4 passthrough tool for the PiKVM V4 Plus hardware. Build configuration uses Makefiles with numerous feature flags (WITH_GPIO, WITH_JANUS, WITH_SYSTEMD, etc.), permitting a modular build. Overall, uStreamer exemplifies careful engineering of real-time video pipelines on embedded Linux, with a focus on minimal latency, hardware offload, and robust IPC.
This repository provides a Docker container that runs a fully functional Windows virtual machine inside a Docker environment using KVM/QEMU hardware acceleration. It automates the entire lifecycle of a Windows VM, from downloading the correct ISO from Microsoft or mirror sources, performing an unattended installation using dynamically generated answer files, injecting optimized VirtIO drivers, to configuring remote access via a web-based noVNC interface or RDP. The architecture is a monolithic Docker container orchestrated by a series of modular Bash scripts sourced from a main entry point (`/run/entry.sh`). Key modules handle specific concerns: `mido.sh` scrapes Microsoft's ESD download portal, `image.sh` manipulates WIM/ISO images, `answer.sh` generates XML configuration, `display.sh` configures GPU acceleration, and `power.sh` manages graceful shutdown. This modularity, while in Bash, demonstrates strong systems engineering principles. The project supports an extensive range of Windows versions from Windows 95 to Windows Server 2025, including specialized editions like LTSC and IoT. It features robust error handling, checksum verification, state persistence across container restarts, and a comprehensive CI/CD pipeline that validates installations across multiple versions. The `assets/` directory contains per-version unattended answer files and post-install scripts that apply registry tweaks, disable unnecessary features, and install drivers. While the codebase exhibits high craftsmanship in its specialized modules, it faces medium technical drift risk due to its heavy reliance on hardcoded download URLs, SHA256 checksums, and specific external tool versions. The `mido.sh` scraping logic is particularly fragile against changes to Microsoft's infrastructure. Despite this, the project is actively maintained and represents a highly sophisticated piece of systems automation engineering.
Hyperlight is a production-grade library for safely executing untrusted code inside hypervisor-isolated micro virtual machines. It spins up lightweight VMs in milliseconds without requiring a guest kernel or operating system, making it suitable for sandboxing plugins, serverless functions, and other untrusted workloads. The system supports multiple hypervisor backends (KVM on Linux, MSHV on Windows, WHP on Windows, HVF on macOS) and architectures (x86_64, aarch64), with guest binaries compiled as no_std Rust or C ELF files using a custom libc (picolibc). Communication between host and guest is performed via typed function calls serialized with FlatBuffers over VM exits, and the library provides snapshot/restore capabilities using an OCI-compatible image layout for state persistence. The architecture is centered around a host-side Rust library (`hyperlight_host`) that exposes a builder pattern (`SandboxBuilder`) to configure and create sandboxes. The guest runtime (`hyperlight_guest_bin`) handles initialization, page tables, exception handling, and function dispatch. A component model integration (`hyperlight_component_util`) generates Rust bindings from WIT (WebAssembly Interface Types) for higher-level interfaces. The system also includes guest tracing with OpenTelemetry, metrics collection, crash dump generation, and GDB debugging support. External dependencies include hypervisor-specific APIs (KVM ioctls, WHP, HVF), the FlatBuffers serialization library, and the OCI image layout specification for snapshot storage. Key data flows involve the host loading a guest binary, setting up memory regions (code, heap, stack, scratch), registering host functions, and then executing guest functions via VM entries. The guest can call back into the host through registered host functions. Snapshots capture the full guest state (memory, registers, MSRs) and can be saved to disk as OCI-compatible blobs, then restored to create new sandboxes or recover from failures. The library is extensively tested with unit tests, integration tests, fuzz targets, and concurrency stress tests, and is maintained as a CNCF sandbox project with active development and frequent releases.
virt-v2v is a production-grade virtual machine conversion tool that converts guests from foreign hypervisors (VMware vSphere/ESXi, Xen, Hyper-V, OVA, disk images) to run on KVM/libvirt. It supports multiple input sources (local disk, libvirt-managed guests, OVA archives, VMware VMX, vCenter HTTPS, VDDK, NFC, Xen over SSH) and output targets (local disk, libvirt, QEMU, oVirt/RHV, OpenStack, KubeVirt, VDSM, Glance, null). The conversion process inspects the guest OS (Linux, Windows) using libguestfs, injects virtio drivers for Windows, adjusts boot configuration, remaps block devices and network interfaces, and generates appropriate metadata (OVF, libvirt XML, KubeVirt YAML). It uses nbdkit as a universal disk access layer, enabling parallel copy via nbdcopy and efficient sparse allocation. The codebase is written primarily in OCaml with C stubs and embedded Python scripts for oVirt API interactions. It features a modular architecture with well-defined input/output module signatures, shared library components (NBD_URI, nbdkit wrapper, OVF generation, YAML emitter), and an extensive test suite covering real and phony guest conversions. The project is part of the libguestfs ecosystem and is actively maintained with recent commits, CI/CD via GitHub Actions, and internationalization support.
Deskflow is a free and open-source keyboard and mouse sharing utility (software KVM without video) that allows one computer's keyboard, mouse, and trackpad to control multiple computers over a network. It uses a client-server architecture with a core process handling input forwarding and network protocol, a daemon for Windows service/UAC support, and a Qt-based GUI for configuration. The system supports TLS encryption, clipboard sharing, and multiple platforms including Windows, macOS, Linux (X11 and Wayland). It implements a custom binary protocol with version negotiation (1.0-1.8) and provides platform-specific backends for input capture and injection. The codebase is well-structured with clean abstractions, extensive unit tests, and CI/CD pipelines, though it carries some legacy code from its Synergy/Barrier origins.
This repository is Xilinx's fork of QEMU, a full-system and user-mode emulator/virtualizer. It provides machine emulation via dynamic binary translation (TCG) and hardware acceleration through KVM, Xen, HVF, and other accelerators. The codebase includes a vast array of device models (CPUs, interrupt controllers, storage, network, graphics, timers, etc.), a block layer for storage backends, live migration for VM state transfer, and QMP/HMP monitoring interfaces. The architecture is highly modular with the QEMU Object Model (QOM), coroutine-based async I/O, and a plugin API. It also supports user-mode emulation for Linux and BSD syscalls. This is purely an application repo; there is no data science or research code. The Xilinx fork adds extensive device models for Xilinx FPGAs and SoCs (Versal, ZynqMP, etc.), making it especially relevant for embedded developers. The code is actively maintained with recent commits and issue triage, and while the sheer size introduces some technical debt, the overall engineering quality is high.
JetKVM is an open-source KVM-over-IP device firmware that enables remote keyboard, video, and mouse control over a network. The system is built as a full-stack embedded application: a Go backend orchestrates hardware interfaces (USB gadget emulation for HID, mass storage, audio, serial console), video capture and encoding (H.264/H.265 via Rockchip MPP), WebRTC streaming, OTA updates, MQTT integration, and network management. A React/TypeScript single-page application provides the web-based KVM console with real-time video, keyboard/mouse input, virtual media mounting, serial terminal, and device settings. The architecture separates a native C/C++ layer (LVGL UI, video pipeline) from the Go application via gRPC and a Unix socket, enabling failsafe mode and modularity. The codebase demonstrates strong engineering practices: extensive E2E tests against real hardware, a comprehensive OTA update system with GPG signature verification, a custom HID RPC protocol over WebRTC data channels, and a transactional USB gadget configuration system. While tightly coupled to Linux and Rockchip hardware, many internal packages (sync wrappers, confparser, changeset, playout delay interceptor) are well-isolated and could be reused in other Go projects.
Solo5 is a sandboxed execution environment for unikernels, providing a minimal, legacy-free interface between unikernel applications and host systems. It supports multiple backends: hvt (hardware virtualization via KVM, FreeBSD/OpenBSD/DragonFly vmm), spt (Linux seccomp sandbox), virtio (QEMU/bhyve), Xen, and Muen. The architecture consists of guest-side bindings (implementing the solo5_* API) and host-side tenders (loaders/runtime components). Key entry points include the guest's _start() in each binding's start.c and the tender's main (e.g., hvt_main.c, spt_main.c). Data flows are synchronous: unikernels communicate via hypercalls (hvt), seccomp-allowed syscalls (spt), or Xen hypercalls, with shared-memory ring buffers for I/O. External dependencies include libseccomp (spt), KVM/BSD hypervisor APIs, and vendored Xen public headers. The project originated from IBM Research and is used by MirageOS and other unikernel frameworks.
Kata Containers is an open-source secure container runtime that runs each container inside a lightweight virtual machine (microVM), providing strong workload isolation while maintaining container-like performance and orchestration. The project provides a containerd shim-v2 implementation, a guest-side agent, and supports multiple hypervisors including QEMU, Cloud Hypervisor, Firecracker, and its own built-in VMM (Dragonball). It integrates deeply with Kubernetes (runtime classes, CSI, mutating webhooks, policy generation via Rego) and supports confidential computing features (TDX, SEV-SNP, IBM Secure Execution, ARM CCA). The codebase is dual-language: the primary runtime is written in Go, with a newer Rust rewrite (runtime-rs) that shares core libraries with the agent and Dragonball VMM. The project is actively maintained with extensive CI, multi-architecture support, and a large ecosystem of tools (agent-ctl, kata-ctl, log-parser, trace-forwarder, genpolicy). While the architecture is modular and many components (e.g., safe-path, dbs-allocator, retry library) are independently reusable, the coexistence of two runtime implementations, generated API clients, and architecture-specific code introduce some technical drift and maintenance overhead.
PVE-Tools is a comprehensive, interactive Bash administration toolkit for Proxmox VE 9.x (Debian 13 Trixie). It provides a menu-driven CLI that wraps native PVE commands (qm, pct, pvesm, etc.) to automate common hypervisor management tasks: system optimization, APT mirror switching, kernel/GRUB management, GPU passthrough (NVIDIA, AMD, Intel SR-IOV/GVT-g), VM/container backup/restore/clone/migration, host networking (bridge, bond, VLAN, IPv6, firewall), storage (Ceph, LVM, mount), security auditing and CVE mitigation, and third-party tool integration (FastPVE, CoolerControl, IT87 drivers). The tool is distributed as a single assembled script built from modular source files (lib/ + src/modules/) via build.sh, and can be installed as a system command or run directly. It features a two-tier confirmation system for high-risk actions, marker-based config block management for idempotent edits, and automatic backups under /var/backups/pve-tools/. The UI is primarily Chinese with a branded ASCII banner and community channels built in.
This repository provides a comprehensive set of scripts, configuration files, and precompiled bootloader components to run macOS as a guest operating system on Linux hosts using QEMU/KVM and the OpenCore bootloader. It is not a traditional application but rather an infrastructure-as-code project that automates the creation of a virtual Hackintosh environment. The codebase includes a Python script (`fetch-macOS-v2.py`) to download macOS recovery images from Apple's servers with cryptographic verification, shell scripts to launch QEMU with the appropriate CPU flags, firmware, and device emulation, and a set of OpenCore EFI binaries (kexts, drivers, ACPI tables, icons) tailored for macOS compatibility. The project also documents GPU passthrough, USB passthrough, kernel debugging, and reverse engineering of macOS VM detection. While the repository is highly popular and actively maintained, the code quality is uneven: many shell scripts are boilerplate-heavy with hardcoded paths, and the prebuilt binaries are opaque, making the project more of a curated recipe collection than a polished software product. The most reusable components are the macOS downloader script and the OpenCore disk image builder, which can be extracted and adapted for other virtualization workflows.