Weft

A microVM cloud platform,
in one pure-Go binary.

Without the weft, the warp is just parallel threads.

Weft is a HashiCorp-style cloud platform: one CGO-free Go binary that is control plane, node agent, and CLI. It boots real microVMs over a cgo-free QEMU driver, admits nodes by TPM 2.0 attestation, and segments every workload with WireGuard. Self-hosted, open source.

Get started View on GitHub
Distributed by design

Three datacenters, one platform

Each datacenter sits on its own ground plane — racks of physical hosts, each running a stack of microVMs. The dashed cyan threads are the WireGuard overlay: every microVM peers with every other across the WAN, so tenant workloads, infrastructure microVMs (etcd, nats, dex, weft, weft-network), and storage microVMs share one flat address space regardless of which availability zone they land in.

Isometric view of three datacenters connected by a WireGuard mesh
🐹

Pure Go, zero cgo

Built with CGO_ENABLED=0 — one static binary that is control plane, node agent, and CLI. Trivial cross-compilation, no C toolchain, no shared-library drift.

📦

microVMs, real isolation

A cgo-free QEMU/TCG driver plus a darwin Virtualization.framework driver boot true VMs in milliseconds — hardware-grade isolation, container-grade ergonomics.

🔏

Attested admission

Nodes join only after a TPM 2.0 EK→AK→Quote handshake the control plane verifies. Each admitted node gets freshly minted WireGuard peer keys.

🧩

Self-hosted & open

etcd-backed KV state, gRPC API, HCL config. BSD-3-Clause, no SaaS, no lock-in, no telemetry. Runs on a laptop ; scales to a 3-DC cluster.

🕸️

Multi-tenant, meshed

Every resource is UUID-keyed and owned by a project and user. Each workload joins one flat WireGuard overlay mesh — peering across datacenters in a single address space, segmented by policy.

👥

Delegated administration

Hand each tenant to its own admins: scoped RBAC lets them manage their projects, members, images, and VMs — with no reach into other tenants or the cluster itself.

How it works

  1. Enroll. A node boots and presents its TPM 2.0 evidence — an Endorsement Key, an Attestation Key bound to it, and a signed Quote of its boot measurements.
  2. Verify & admit. The control plane validates the EK→AK chain and the Quote, admits the node, and mints its WireGuard peer keys.
  3. Schedule. A microVM is placed on the node ; the CGO-free QEMU/TCG driver (or the darwin vz driver) boots it.
  4. Connect. The workload joins the WireGuard-segmented network, reachable only across its authorized peers.

Open components

weft

The binary: control plane, node agent, and CLI in one. HashiCorp-style `weft agent` daemon + `weft <noun> <verb>` client RPCs.

weft-proto

The gRPC service definitions and generated Go stubs shared by the agent, CLI, web UI, and Terraform provider.

weft-microvm

microVM runtime behind `weft microvm`: OCI rootfs over virtio-fs, booted on a shared init kernel — no per-VM boot ISO.

weft-driver-qemu

The CGO-free QEMU/TCG hypervisor driver (go-plugin). Boots real VMs with no C bindings on any host.

weft-network

WireGuard segmentation: per-node peer minting, scoped routes, and the encrypted mesh that connects microVMs across DCs.

weft-etcd

The etcd-backed KV datastore for cluster state — control-plane source of truth for the production 3-DC topology.

weft-hcl

HCL configuration: declare clusters, hosts, images, and VMs ; `weft up` converges them in dependency order.

terraform-provider-weft

The Terraform provider: manage weft clusters, hosts, images, and microVMs as infrastructure-as-code over the same gRPC API.

weft-webui

The web dashboard for the cluster — instances, images, and hosts — driven by the same gRPC API as the CLI.