Skip to content

nether

the layer below

A type-2 hypervisor in pure Zig. Modern guests only: no SeaBIOS, no IDE, no legacy chipset emulation. Runs beneath the guest on hardware-assisted virtualization (Apple Hypervisor.framework on aarch64, KVM on Linux/x86-64).

swerver (one binary, embeds nether) ──► HVF / KVM ──► microVM
              │
              ├── egress firewall + budgets (when net enabled)
              ├── control plane + virtio-vsock
              └── snapshot → COW fork (HVF + KVM)

The standalone nether executable in this repo is a dev/bringup wrapper around the embeddable core (src/root.zig). Production is swerver importing that library.

Building

nether is past Phase 3 on both backends. Apple Silicon / HVF is the lead path (Linux boots, virtio works, snapshots fork, GPU). The x86/KVM reference backend has reached parity for the platform primitive, run-verified on bare metal: PVH boot, virtio-blk/net, SMP, the control plane over vsock, and the cross-process snapshot fork (COW restore, __snapshot__/__park__, vmgenid CRNG reseed). The one remaining KVM gap is virtio-gpu. See Roadmap and Limitations.

What it does today

Backend Status
HVF / aarch64 (lead) Boots Alpine Linux to shell; full platform layer including snapshot-fork, egress firewall, control plane, metering, SMP, GPU
KVM / x86-64 (reference) PVH-boots Linux 6.12 to an interactive shell; virtio-blk R/W; virtio-net over slirp + egress firewall (net=1); SMP (cpus=N); userspace IOAPIC; control plane, vsock, metering; cross-process snapshot fork with COW restore, __snapshot__/__park__, and vmgenid CRNG reseed. No GPU yet

Without a kernel in the working directory, the binary runs a comptime smoke-test guest that prints over serial and shuts down cleanly. The message depends on the backend:

  • KVM (x86 real-mode blob): Nether lives. Phase 0: real-mode guest over COM1.
  • HVF (aarch64 MMIO UART): Nether lives. Phase 0: aarch64 guest over MMIO UART.

Smoke test

zig build test

On a host that can run the built binary (Linux + KVM, or macOS + signed HVF build):

zig build run          # Linux/KVM (default x86_64-linux target)
# or on Apple Silicon:
DEVELOPER_DIR=/Library/Developer/CommandLineTools zig build -Dtarget=native run
codesign --sign - --entitlements nether.entitlements --force zig-out/bin/nether

KVM host with no vmlinux present:

Nether lives. Phase 0: real-mode guest over COM1.
[nether] guest shutdown.

Where to next