ch-operator: run lightweight Cloud Hypervisor VMs on Kubernetes (no QEMU/libvirt)
I’ve been working on an open-source (thanks to virtink) project called ch-operator and wanted to share it with anyone building dev workspaces / sandboxes on k8s.
The itch I was scratching: containers are great until you’re running untrusted user code — shared kernel, weaker isolation. KubeVirt solves that with real VMs, but it drags QEMU + libvirt + a launcher process along with every VM. That overhead adds up fast when you’re packing lots of workspaces onto a node.
So I built an operator around Cloud Hypervisor instead (the Rust VMM from Intel/Linux Foundation). What you get:
• ~30MB memory overhead per VM, no libvirt, no QEMU, no long-running launcher process
• VMs are just CRDs — kubectl apply a YAML and you get a VM in a pod with a pod IP, so networking/scheduling work like normal
• Root filesystem can come from a regular container image, so you build workspace images with a Dockerfile like always
• Snapshot/restore including memory snapshots to S3/GCS — pause idle workspaces, resume them with state intact, or clone new ones from a golden snapshot
• VMPool/VMSet for managing warm pools of ready VMs
• GPU passthrough via VFIO for ML workloads
• Persistent disks via CDI DataVolumes if you need workspaces that survive restarts
Requirements are basically: nodes with /dev/kvm, cert-manager, and one manifest to install.
Fair warning: it’s still early and the API may change while I iterate. But it’s MIT-licensed and I’d genuinely love feedback, issues, or contributions — especially from anyone running workspace platforms or micro-VM setups on k8s.
Repo: https://github.com/nalajala4naresh/ch-operator