KLYRN VM private beta

Your hypervisors answer to nothing.

Every other panel reaches in. A port is opened toward the hypervisor, a credential sits somewhere that can use it, and the blast radius of the control plane is every machine it can touch. KLYRN reverses the arrow: the node dials the controller, and nothing dials the node.

See the installone command, signed Runs beside SolusVM 2

Connection direction node to controller, always

Controller vm-test.klyrn.com :8444 listening

kvm-lon-01 3 guests managed no port open
kvm-fra-01 7 guests managed no port open
kvm-gra-01 8 guests observe no port open

Ask the controller to open a connection toward a node, the way every other panel does.

Measurements

0of 1,995: probes interrupted while a node agent replaced itself. Five vantage points, 250 ms apart, across the whole update.
314ms: from a customer pressing create to a task accepted. Address already reserved at that moment, not after.
4s: from a signed controller update to serving again. Database migrated inside that window.
43rules: authorisation rules, each broken on purpose. A rule with no test that notices is not a rule.

A bandwidth limit that is a limit.

A plan took a 1 GiB outbound allowance and a 1 Mbit/s throttle. A guest on that plan sent 1.3 GiB to its host at roughly two gigabits a second. The sweep moved it to throttled inside a minute, and the same transfer down the same path then measured one megabit.

The two guests either side of it were untouched, still on plain fq_codel. The event log holds one row naming the figures, the reason and the task that did it.

Inbound traffic was counted and correctly not charged against an outbound allowance, which is the half that is usually wrong.

Same guest, same path, four minutes apart

before

2,070 Mbit/s

after

1.0 Mbit/s

1.3 GiB in 5.4 s, then 3 MiB in 27.1 s. The bar is to scale, which is why the second one is a line.

Three things worth reading before you trust it with a customer.

The install, and the signature under it One command on a clean Ubuntu 24.04. The installer verifies the release manifest against a key compiled into it, runs the candidate and makes it state its own version before replacing anything, and keeps the outgoing binary. A licence that cannot switch a machine off There is no function in the licence code that returns "stop this machine", so no future caller can find one. An expired licence keeps every guest you run, keeps its free node, and tells you what is wrong. Put it on the box SolusVM already runs on Observe mode is read-only by construction: external commands, hypervisor calls and every file write pass a fail-closed guard. Twenty-one host artefacts were snapshotted around an install and nothing moved that was not KLYRN's own.

What it does not do yet.

KLYRN VM is in private beta and this list is the real one. It is here because a provider deciding where to put customer machines is owed the gaps as plainly as the features, and because a page with no gaps on it is a page nobody should believe.

Windows guests are built and have never booted. The driver disc, the config drive, the firmware and the password path all exist and are tested against what the renderer emits. No Windows machine has started on a hypervisor, so it is not a thing you can sell yet.
Private networks between a customer's machines are one node only. Crossing nodes needs an overlay the agent cannot build yet, and it is refused with that reason rather than half performed.
Bridged and VLAN topology are not advertised. Implemented, never accepted on a real provider VLAN, which is not the same claim.
A machine restored as a copy needs the console to get back on the network. The path itself works: a full copy of a running guest, an increment 99.8% smaller, both links checked, and a restore that boots. Nothing is written into the restored guest, on purpose, because re-running cloud-init would undo whatever the customer configured. The cost is that its new address is not configured inside it and you reach it through the console once to set that. Incremental backups also do not work on thin storage, and never will: the bitmap lives inside a qcow2 and a thin volume is raw.
OpenVZ is out of scope. It is detected in a source estate and reported, never counted as adoptable.