← All tech

Cloud Hypervisor

microvmvmmopen source

A Rust on KVM, more featureful than Firecracker, that confines itself with Landlock as its second wall.

Cloud is a modern Rust built on KVM, in the same lineage as Firecracker but with a richer device model (hotplug, more devices). It is a notable real-world Landlock user: the confines itself with Landlock, the classic 'wall 2' around a userspace that parses hostile guest input. Each guest runs its own kernel behind the hardware boundary. It is one of the backends Kata Containers can run on.

Strengths

  • Rust VMM with a richer device model than Firecracker (hotplug, more virtio)
  • Can confine itself with Landlock, a real second wall around the VMM, and applies seccomp to its worker threads
  • The only microVM VMM in the June 2026 study with an in-tree fuzzer (cargo-fuzz)
  • Hardware boundary; usable as a Kata Containers backend

Limitations

  • Requires KVM
  • Larger surface than Firecracker's deliberately minimal model, and the widest measured in that study: 170 /dev entries with 12 of 14 kernel-LPE primitives reachable
  • Its self-confinement is opt-in and was measured as incomplete in a real deployment, the leader thread ran unfiltered
  • Took its first escape-class CVE on 2026-05-14 (CVE-2026-45782, CVSS 8.9), alongside CVE-2026-27211 (host leak)
  • A VMM building block, not a turnkey dev tool

VMM second wall

VMM second wall: partial

supports Landlock self-confinement, but it is opt-in rather than automatic, and a June 2026 measurement of a Cloud Hypervisor deployment found seccomp applied to 32 of 33 threads with the leader thread left unfiltered at mode 0.

The second wall confines the VMM itself, so a compromised device backend can't own the host. It's separate from the hardware boundary every microVM already has. The two walls, explained.

Sources