The control plane IS the AI.

BrainstormVM IS the hypervisor, storage engine, network fabric, and reasoning brain — not a management wrapper over someone else's HCI. Cloud Hypervisor + Firecracker + LINSTOR + nftables + WireGuard under a Go control plane that observes, decides, migrates, and recovers.

From bare metal to tenant microVM.

Bare-metal host runs the Linux kernel with KVM + IOMMU groups + vfio passthrough. Cloud Hypervisor spawns full-VM workloads; Firecracker spawns microVMs for ephemeral and edge processes. Per-tenant isolation enforced at the kernel boundary.

Tenant VMs heartbeat on staggered intervals. Drift, OOM, or scheduling pressure surfaces as a signal into the OODA loop above this layer.

CHV / Firecracker processes
KVM kernel · IOMMU groups · vfio passthrough
Bare-metal host (c5.metal / Hetzner AX)/tnt-aweb-01chvworker-02fccache-03fc/tnt-bapi-04chvbatch-05fc/tnt-cdb-06chvrdr-07fcmq-08fccron-09fc
▲ user tenants
▼ hardware

Go
control plane
CHV
full-VM hypervisor
FC
microVM kernel
LINSTOR
storage replication
nftables
tenant overlay
WireGuard
cross-node mesh
OODA
control loop
<1s
microVM boot

LINSTOR + DRBD.

Replication visible to the brain.

Synchronous replication across three nodes with quorum 2/3. Dirty-block state surfaces as live telemetry to the control plane — placement decisions account for storage proximity. CSI driver exposes volumes to Kubernetes workloads riding on top.

NODE-01
primary
NODE-02
replica
NODE-03
replica
dirty (replicating)
in sync

Tenant overlays.

Policy at the host kernel.

Per-tenant network isolation enforced by nftables in the host kernel — not in a vendor-proprietary SDN. Cross-node tenant traffic rides a WireGuard mesh. Rule changes are ChangeSets; drift triggers auto-reconciliation.

host kernel · nftables ruleset/tnt-a4 eps/tnt-b3 eps/tnt-c5 eps/tnt-d2 eps
wireguard mesh · cross-node traffic

IOMMU-aware device routing.

Per-host IOMMU groups enumerated continuously. GPU, NIC, NVMe devices in passthrough-ready groups are scheduled per-tenant by the control plane. AWS c5.metal nodes show ~200 groups; Hetzner AX hosts vary by hardware revision.

/ IOMMU groups · host-1
8 groups · 10 devices

group 00
00:00.0
Host bridge
group 01
01:00.0
NVMe SSD · Samsung PM9A3
01:00.1
NVMe SSD · namespace 2
group 02
03:00.0
NIC · Mellanox CX-6 DX→ tnt-a
group 03
04:00.0
NIC · Mellanox CX-6 DX→ tnt-c
group 04
06:00.0
GPU · NVIDIA A10 24GB
group 05
07:00.0
GPU · NVIDIA A10 24GB→ tnt-b
group 06
0a:00.0
SATA controller
0a:00.1
USB 3.0 hub
group 07
0d:00.0
NIC · Intel X710

Move gradually.

Connectors for Proxmox / VMware / Nutanix let you move workloads onto BrainstormVM gradually. The destination is a new substrate, not a re-skin of the old one — but the path supports cross-stack coexistence during transition.

// Partial = capability available but with operator review per migration. v0.12 closes Nutanix live-migrate via incremental snapshot bridging.

Different substrate. Not different UI.

Control plane
Traditional HCI
Web UI + REST API on top of vendor automation engine.
Brainstorm VM
Go service running OODA loop on every signal. Placement, migration, recovery are evidence-chained ChangeSets, not opaque automation.

Storage
Traditional HCI
Vendor SAN or per-vendor HCI block. Replication policy hidden.
Brainstorm VM
LINSTOR + DRBD with brain-visible replication state. ZFS substrate planned for Phase 2.

Network
Traditional HCI
Vendor overlay (NSX, AHV) with proprietary policy engine.
Brainstorm VM
nftables at the host kernel + WireGuard mesh. Policy is code; rule diff surfaces as evidence record.

Migration path
Traditional HCI
Rip-and-replace via vendor migration tooling.
Brainstorm VM
Connectors for Proxmox / VMware / Nutanix run inside the OODA loop. Move VMs gradually; cross-stack workloads coexist during transition.

Open the control plane.

vm.brainstorm.co serves the operator console. Preview access is invite-only during the access ramp.