Cloud Hypervisor
microvmvmmopen sourceA Rust on KVM, more featureful than Firecracker, that confines itself with Landlock as its second wall.
Cloud is a modern Rust built on KVM, in the same lineage as Firecracker but with a richer device model (hotplug, more devices). It is a notable real-world Landlock user: the confines itself with Landlock, the classic 'wall 2' around a userspace that parses hostile guest input. Each guest runs its own kernel behind the hardware boundary. It is one of the backends Kata Containers can run on.
Strengths
- Rust VMM with a richer device model than Firecracker (hotplug, more virtio)
- Can confine itself with Landlock, a real second wall around the VMM, and applies seccomp to its worker threads
- The only microVM VMM in the June 2026 study with an in-tree fuzzer (cargo-fuzz)
- Hardware boundary; usable as a Kata Containers backend
Limitations
- Requires KVM
- Larger surface than Firecracker's deliberately minimal model, and the widest measured in that study: 170 /dev entries with 12 of 14 kernel-LPE primitives reachable
- Its self-confinement is opt-in and was measured as incomplete in a real deployment, the leader thread ran unfiltered
- Took its first escape-class CVE on 2026-05-14 (CVE-2026-45782, CVSS 8.9), alongside CVE-2026-27211 (host leak)
- A VMM building block, not a turnkey dev tool
VMM second wall
VMM second wall: partialsupports Landlock self-confinement, but it is opt-in rather than automatic, and a June 2026 measurement of a Cloud Hypervisor deployment found seccomp applied to 32 of 33 threads with the leader thread left unfiltered at mode 0.
The second wall confines the VMM itself, so a compromised device backend can't own the host. It's separate from the hardware boundary every microVM already has. The two walls, explained.