cocoonstack

A Kubernetes-native MicroVM platform. Run Linux, Windows, Android, and macOS guests as pods — booted, cloned, and snapshotted in tens of milliseconds by Cloud Hypervisor and Firecracker.

kubectl ──► Kubernetes API
              │   CocoonSet / CocoonHibernation (CRDs)
              ▼
        cocoon-operator ──► schedules pods, drives hibernate / wake
        cocoon-webhook  ──► admission: sticky scheduling, validation
              │
              ▼   (one virtual kubelet per node)
        vk-cocoon ──► CreatePod / DeletePod ── cocoon CLI
              │                                    │
              ├─ cocoon ───────► MicroVM (CH / FC), snapshots, images
              ├─ cocoon-agent ─► in-guest vsock exec / logs / reseed
              └─ cocoon-net ───► per-host VPC networking (DHCP, GKE, Volcengine)

Projects

Runtime

• cocoon — the MicroVM engine: Cloud Hypervisor and Firecracker backends, a Docker-like CLI, one hypervisor process per VM, and snapshots that clone into new identities in tens of milliseconds.
• cocoon-agent — the in-guest vsock agent behind cocoon vm exec / logs and per-clone identity reseed, with no SSH or network dependency.
• cocoon-macos — boot macOS guests via QEMU + OpenCore + OVMF, reusing cocoon’s cloudimg store and clone/snapshot model.
• windows — automated Windows 11 qcow2 image builder, packaged as OCI artifacts on GHCR (repo).

Kubernetes

• vk-cocoon — the virtual-kubelet provider, one per node, mapping pods to cocoon MicroVMs and pushing per-VM status back to the kubelet.
• cocoon-operator — the CocoonSet and CocoonHibernation reconcilers: pod scheduling, generation lifecycle, and registry-backed hibernate / wake.
• cocoon-webhook — the admission webhook for sticky scheduling and CocoonSet validation.
• cocoon-common — shared CRD types, the annotation contract, and the OCI registry + snapshot / cloud-image packages every service imports (repo).

Networking

• cocoon-net — per-host VPC-native networking: an embedded DHCP server plus GKE and Volcengine platform provisioning, so VM pods are directly routable in the cloud VPC.

Services

• gateway — single-binary LLM gateway (gw) in Rust: OpenAI/Anthropic-compatible APIs, multi-provider routing, per-key auth / quotas / rate-limits, failover, streaming, and a billing ledger.

Sandbox

• sandbox — a fast cold-boot AI-agent sandbox built on cocoon.

Source

Everything lives under github.com/cocoonstack.