OXware Hypervisor

The open-source KVM/QEMU hypervisor with vCenter-class management.

🌐 Website · 📚 Documentation · 💰 Pricing · 🛒 Marketplace · 🤝 Partners · 🎓 Certification · 🐛 Bug Bounty · 📡 Status

OXware replaces VMware vSphere — without the licence. Confidential VMs (SEV/TDX) · DRS · HA · live migration · cluster federation · 6-language web UI · SOC 2 in progress · MIT licensed · save 90%+ vs vSphere.

⭐ Why OXware?

	OXware	VMware vSphere	Proxmox VE
Open source (MIT)	✅	❌	✅ (GPL)
Per-CPU socket tax	❌ none	💸 yes	❌ none
Confidential VMs (SEV/TDX)	✅	✅	partial
vTPM 2.0 per VM	✅	✅	partial
Cluster federation API	✅ v2	✅ vCenter	❌
Live migration	✅	✅	✅
Runbook auto-remediation	✅	partial	❌
GitOps (ArgoCD/Flux)	✅	❌	❌
Kubernetes CSI driver	✅	✅	community
KubeVirt bridge	🟡 beta	❌	❌
Built-in compliance scanner	✅	partial	❌
3-year cost (32 cores, 50 VMs)	~$2,250	~$200,000	~$5,000

✅ Is it real? — build maturity, no marketing

We hate "✅" tables that lie. Here is exactly what is production-grade, what is usable-but-young, and what is honestly not finished yet. CI runs the real test suite on every push (badge above is live).

Area	Status	What that means
VM lifecycle (create/start/stop/snapshot/clone/migrate)	🟢 Stable	Core path, covered by the test suite + daily use
Networking (bridges, NAT, IPAM, nftables, port-forward)	🟢 Stable	Real libvirt + nftables, SSRF-guarded outbound
Storage (qcow2, LVM, NFS, snapshots, 3-2-1 backup)	🟢 Stable	Backup verified with mount + boot check
Auth / RBAC / JWT (HS256-locked, CSRF, audit log)	🟢 Stable	Algorithm allowlist enforced + tested
Confidential VMs (SEV/TDX), vTPM 2.0	🟡 Beta	Works on supported hardware; needs host firmware
Ceph storage backend	🟡 Community	Functional, community-tested, not first-class yet
AI planner / NL commands	🟡 Optional	With AI key = AI; without a key it tells you so and falls back to transparent heuristics (`source: "heuristic"`) — no fake "AI" output
KubeVirt bridge	🟡 Beta	Cluster registration, VMI→OXware translation, and a polling reconcile loop that creates missing VMs. Needs `pip install kubernetes pyyaml`; degrades honestly (reports the reason) if absent or a cluster is unreachable. Streaming Watch + orphan auto-delete are opt-in/roadmap
Bare-metal autoinstall	🟢 Stable	Per-install random password hash, SSH-key-only login
VM I/O perf (iothreads/io_uring/multiqueue/vhost)	🟢 Stable	libvirt XML, Proxmox-parity; most changes need VM restart
Host kernel ops (zram/zswap/governor/turbo)	🟢 Stable	sysfs-backed, root-gated
eBPF observability (syscall/latency/XDP)	🟡 Beta	Real bpftrace/XDP; needs the toolchain + root, else reports disabled
Kernel livepatch	🟡 Optional	Wraps canonical-livepatch / kpatch when installed
OXware LKMs (oxware_audit / oxware_guard)	🟡 Beta	Real kprobe modules; build + load on the host to activate
Desktop (Electron) app	🟠 Early	Wraps the web UI; some links still placeholder
Egress lockdown + Dark Site (offline)	🟢 Stable	Socket-level egress guard + audit. Default `monitor` (observe, non-breaking); opt-in `enforce` or Dark Site for full deny-by-default air-gap. Unit-tested (policy, allowlist, dark-site override)
ISO Library (catalog + SHA256 + mirror)	🟡 Beta	Curated catalog, streamed download with % + mirror fallback; honest checksums (no fabricated hashes). Needs network + disk
GPU passthrough wizard (VFIO/IOMMU/ACS)	🟡 Beta	Auto-detect + preflight + generated remediation plan + live bind/attach. Needs a KVM host with root; safe/empty elsewhere
Ansible collection (`oxware.kvm`)	🟡 Beta	7 modules (vm/network/disk/snapshot/template/firewall/user), idempotent, matched to real REST paths; validate against staging before prod
Billing modules (WHMCS/WiseCP/HostBill/Blesta)	🟡 Beta	WHMCS/WiseCP proven; HostBill/Blesta ports lint-clean but need e2e on a real panel
ESXi / Proxmox VM import	🟡 Beta	Panel wizard: scan the source, batch-import up to 20 VMs, disks pulled over SSH and converted to qcow2, NICs/firmware rebuilt. Shipped since 2.7 but was buried in Settings — now has its own nav entry
Cloud image catalog (32 images)	🟢 Stable	Ubuntu/Debian/Rocky/Alma/CentOS/Fedora/Oracle/Alpine/Arch/Flatcar/MicroOS incl. 5 ARM64 builds. Every URL HEAD-verified against upstream; broken ones removed rather than shipped
Metered / hourly billing	🟡 Beta	Built-in usage meter + itemised invoices (no external panel needed). Stopped VMs bill storage only. Idempotent per hour
DRS auto-balance	🟡 Beta	Now actually performs live migrations — it previously only ever produced suggestions. Brake: 1 move/run by default, stops the run on the first failure
Cross-cluster live migration	🟡 Beta	Plan (read-only feasibility) + migrate across federated OXware clusters. Defaults to dry-run; offline mode still goes through the import wizard
Instant Clone (memory-fork)	🟠 Experimental	virsh save-image fork — clones resume from RAM in seconds; source pauses briefly. Needs real KVM host; not vmfork-live

Legend: 🟢 stable · 🟡 beta/optional · 🟠 partial/early. If something here drifts from reality, open an issue — honesty in this table is a feature.

🚀 Quick Install

curl -sSL https://oxware.top/install.sh | sudo bash

Ubuntu 22.04+ / Debian 12+ • x86_64 with VT-x or AMD-V • 4 GB RAM minimum Installation takes ~3 minutes. Panel listens on https://<host-ip>:8006.

Prefer not to pipe curl into bash?

git clone https://github.com/ShinnAsukha/oxware-hypervisor.git /opt/oxware-src
cd /opt/oxware-src
sudo bash install.sh

🔑 First login — the setup token

The first-run wizard creates the admin account. On a box with a public IP that window is a hijack risk: whoever reaches port 8006 first would own the panel. So remote first-install is gated by a one-time setup token.

Where you open the wizard	What you need
From the server itself (`localhost`)	Nothing — just fill in the form
From your laptop/phone (public IP)	The setup token

sudo cat /etc/oxware/setup-token       # or: journalctl -u oxware | grep "KURULUM TOKEN"

Paste it into the Setup token field that appears on the wizard, then create your admin user. The token is single-use — it is deleted the moment setup succeeds.

Prefer the shell? This works with no token because it comes from loopback:

curl -k -X POST https://127.0.0.1:8006/api/setup/init \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"<min-8-chars>"}'

🚚 Coming from VMware or Proxmox?

OXware imports your existing VMs — no manual disk juggling.

Panel → Migration → pick source → scan → select VMs → import

Source	What it does
VMware ESXi	Connects over SSH, pulls the VMDK, converts to qcow2, rebuilds the domain (BIOS/UEFI, NICs, CPU/RAM)
Proxmox VE	Talks the Proxmox API with an API token, reads the VM config, exports the disks over SSH/SFTP, maps `vmbrX` bridges to libvirt networks

Batch import (up to 20 VMs per job), live progress, and a job list you can cancel from. OVA and raw qcow2 import are available too.

Windows guests: install VirtIO drivers before or right after the move. Powered-off VMs import cleanest; snapshots on the source slow it down.

📦 What's in the box

🖥️ VMs & lifecycle

Create / start / stop / pause / clone / snapshot / migrate
Disk hot-extend, SMART, qcow2 + raw
noVNC + SPICE + xterm.js console
Import: OVA / OVF / VMDK / VHD / VHDX / raw
Cloud-init first-boot
Live migration between OXware nodes
Bulk operations w/ HMAC-bound confirm tokens

🌐 Networking

libvirt bridges, NAT, isolated, routed
IPAM with CIDR pools + DHCP static leases
Per-VM nftables firewall, port-forward DNAT
HAProxy + WireGuard helpers
BGP peering (FRR), DNS manager
Subnet calculator
v2.7.2 SSRF guards on every outbound call

💾 Storage

qcow2, LVM, NFS, Ceph (community), MinIO/S3
Snapshots: live + scheduled + app-consistent
3-2-1 backup automation, mount + boot verify
SFTP, MinIO, S3 backup targets
Cross-site disk replication
Kubernetes CSI driver (v2.7.2)

🔐 Security

RBAC: administrator / operator / viewer / vm-user
TOTP 2FA + single-use recovery codes
SAML 2.0 + OIDC SSO (Okta, Entra, Google, Keycloak)
OAuth2 one-click presets (v2.7.2)
LDAP / AD with group-to-role mapping
API keys with scopes
Hash-chained audit log (SHA-256)
SSH known-hosts + first-contact approval (v2.7.2)
Bug bounty: $50–$5000 per finding

🛡️ Confidential computing

AMD SEV / SEV-ES / SEV-SNP
Intel TDX
vTPM 2.0 per VM
UEFI Secure Boot
Launch attestation report capture

🤖 AI + automation

OXY — natural-language ops copilot
Anomaly detector (z-score per metric)
Auto-remediation runbooks (notify / shell / api_call / vm_action)
Capacity forecasting
Right-sizing recommendations
GitOps manager (ArgoCD/Flux dirs)

🌍 Cloud-native (v2.7.2)

Kubernetes CSI driver
KubeVirt bridge
Firecracker microVM runtime (<125 ms boot)
PWA offline mode (read-only fallback)
CycloneDX SBOM per release

⚙️ Kernel-level pack (v2.8.2)

VM I/O perf: iothreads, disk io_uring/native, virtio multiqueue, vhost
eBPF observability: per-VM syscall profile + block-latency (bpftrace), XDP
Host kernel ops: zram/zswap, CPU governor + turbo, kernel livepatch
OXware LKMs: oxware_audit (kprobe KVM audit) + oxware_guard (anti-tamper)

🌍 Six interface languages

Full parity, 2400+ entries per language. CI gate blocks any merge that introduces an untranslated Turkish string.

🇹🇷 Türkçe · 🇬🇧 English · 🇪🇸 Español · 🇩🇪 Deutsch · 🇨🇳 中文 · 🇫🇷 Français

🛠️ Tech stack

┌─────────────────────────────────────────────────────────────┐
│  Web UI (HTML/JS, no build step)        REST API + WebSocket │
│         ↕                                       ↕            │
│                    Flask 3.x backend                          │
│         ↕                                       ↕            │
│   libvirt / QEMU              nftables / iptables             │
│         ↕                                                     │
│   KVM (Linux kernel)                                          │
└─────────────────────────────────────────────────────────────┘

Backend — Python 3.11+, Flask, Flask-SocketIO, libvirt-python
Frontend — Single-page HTML + vanilla JS (no React/Vue/Webpack)
Reverse proxy — nginx + Let's Encrypt
Process supervision — systemd
Storage — qcow2 default, plus LVM / ZFS / Ceph / NFS / MinIO / S3
Networking — libvirt bridges, nftables firewall, optional Open vSwitch

📚 Resources

Where	What
oxware.top	Marketing site + live demo + cost calculator
oxware.top/docs/	Full installation + admin guide
oxware.top/pricing/	Pricing — Standard $35/mo · Pro $250/yr · Lifetime $2000
oxware.top/marketplace/	Curated plugin + template registry
oxware.top/partners/	Reseller program — 30% recurring commission
oxware.top/certification/	OXware Certified Administrator ($99 exam)
oxware.top/compliance/	SOC 2 / ISO 27001 / CIS / NIST / PCI / HIPAA
oxware.top/status/	Live SaaS uptime + incident history
oxware.top/security/bug-bounty/	Bug bounty program (up to $5,000 / bug)
Discord	Community chat — questions, plugin showcase, alpha-test announcements
SECURITY.md	Vulnerability disclosure policy + SEC-001..033 history
CHANGELOG.md	Per-release feature + security changelog
MODULARIZATION_PLAN.md	v2.8 app.py → blueprints migration plan
CONTRIBUTING.md	Dev setup + PR guidelines + commit format

⚡ What's new in v2.8.1

VM boot health-check, per-VM disk I/O QoS, AI Ops Insights with role-gated tools, carbon/energy report, snapshot-chain analysis, Vault→VM secret injection, attestation dashboard, federation mTLS, SDN VXLAN overlays, built-in L4 load balancer, golden-image marketplace, OVA export, vApp boot orchestration, scheduled reports, live VM thumbnails, 14 panel themes, onboarding tour, firmware boot splash. Full i18n parity across EN/ES/DE/ZH/FR. See CHANGELOG.md.

⚡ v2.8.0 — Modularization

Modularization seed: app.py split into 5 domain blueprints. New /api/v2/ endpoints under auth, vms, networks, storage, monitoring. Legacy /api/* untouched. See MODULARIZATION_PLAN.md.

⚡ What shipped in v2.7.2

Security (SEC-029..033) — Safe archive extraction, DNS rebinding mitigation, FTP backup deprecated, SSH known-hosts + first-contact approval, Bandit + pip-audit in CI.

8 new feature modules — Kubernetes CSI driver, KubeVirt bridge, GitOps manager, Firecracker microVM runtime, OAuth2 provider presets, audit-log retention policy, CycloneDX SBOM generator, PWA offline mode.

i18n parity — French (FR) added; 6 languages with CI gate.

See CHANGELOG.md for the full list.

🛡️ Security

OXware ships with security_utils.py carrying validated helpers for SSRF blocking (validate_external_url), shell argv injection guards (validate_vm_id, safe_subprocess_arg), safe archive extraction (safe_tar_extract, safe_zip_extract), and DNS rebinding mitigation (resolve_safe_host).

33 SEC-tracked patches to date (SEC-001 through SEC-033) across auth, federation, runbook executor, plugin SDK, and bulk operations. Full history in SECURITY.md.

Found a vulnerability? Report via GitHub Security Advisories or email root@oxware.top. Bounties up to $5,000 / bug — see the Bug Bounty program.

⚙️ API

# Get a JWT token
curl -k -X POST https://host:8006/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"yourpass"}'

# Use it
curl -k https://host:8006/api/vms -H "Authorization: Bearer $TOKEN"

Swagger UI lives at https://<host>:8006/api/docs. Full OpenAPI 3 spec at /api/openapi. ~290 endpoints across VM management, networking, storage, RBAC, monitoring, CSI, KubeVirt, GitOps, Firecracker, runbooks, federation, OAuth2, SBOM, PWA, and the new v2.8 /api/v2/* blueprint routes.

A Terraform provider ships with oxware_vm, oxware_network, oxware_storage_pool resources.

🤝 Contributing

PRs welcome. Please read CONTRIBUTING.md first:

Run make i18n-check before pushing if you touched index.html
Run make security to fire Bandit + pip-audit
Run make test — the SEC-017..033 regression suite must stay green
New features need an entry in CHANGELOG.md
Don't add new routes to app.py — use a blueprint under oxware/backend/blueprints/. See MODULARIZATION_PLAN.md.

By the way — a quick ⭐ star is the cheapest way to say thanks and helps OXware appear in GitHub trending. It takes a second.

📈 Star history

💬 Community

Discord — discord.gg/c6yHhKrQs5
GitHub Discussions — github.com/ShinnAsukha/oxware-hypervisor/discussions
Issues — github.com/ShinnAsukha/oxware-hypervisor/issues
Security — GitHub Security Advisories or root@oxware.top

📄 Licence

OXware is released under the MIT License. Use it commercially, fork it, embed it, sell support around it — go ahead. Just keep the copyright notice.

A Pro / Lifetime plan unlocks priority issue triage, all v2.x updates, and partner perks. Source remains MIT regardless. See pricing for details. Pricing is symbolic; the code is and will remain free.

Built with ❤️ for operators who think VMware should not charge per CPU socket.

⭐ Star this repo · 💬 Join Discord · ⬇️ Get OXware · 🌐 oxware.top

Name		Name	Last commit message	Last commit date
.git-hooks		.git-hooks
.github		.github
ansible-collection-oxware		ansible-collection-oxware
build		build
electron-app		electron-app
kernel		kernel
modules		modules
oxware		oxware
scripts		scripts
telemetry		telemetry
terraform-provider-oxware		terraform-provider-oxware
tests		tests
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
CNAME		CNAME
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
DARKSITE.md		DARKSITE.md
EGRESS.md		EGRESS.md
GPU-PASSTHROUGH.md		GPU-PASSTHROUGH.md
HETZNER-NETWORKING.md		HETZNER-NETWORKING.md
INSTANT-CLONE.md		INSTANT-CLONE.md
ISO-LIBRARY.md		ISO-LIBRARY.md
LICENSE		LICENSE
MODULARIZATION_PLAN.md		MODULARIZATION_PLAN.md
Makefile		Makefile
NOTICE		NOTICE
PROVISION-TENANT-ISOLATION.md		PROVISION-TENANT-ISOLATION.md
README.md		README.md
SECURITY.md		SECURITY.md
THREAT_MODEL.md		THREAT_MODEL.md
install.sh		install.sh
repair.sh		repair.sh
uninstall.sh		uninstall.sh

Navigation Menu

Repository navigation

About

Repository files navigation

OXware Hypervisor

The open-source KVM/QEMU hypervisor with vCenter-class management.

⭐ Why OXware?

✅ Is it real? — build maturity, no marketing

🚀 Quick Install

🔑 First login — the setup token

🚚 Coming from VMware or Proxmox?

📦 What's in the box

🖥️ VMs & lifecycle

🌐 Networking

💾 Storage

🔐 Security

🛡️ Confidential computing

🤖 AI + automation

🌍 Cloud-native (v2.7.2)

⚙️ Kernel-level pack (v2.8.2)

🌍 Six interface languages

🛠️ Tech stack

📚 Resources

⚡ What's new in v2.8.1

⚡ v2.8.0 — Modularization

⚡ What shipped in v2.7.2

🛡️ Security

⚙️ API

🤝 Contributing

📈 Star history

💬 Community

📄 Licence

About

Releases

Sponsor this project

Packages

Used by

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

OXware Hypervisor

The open-source KVM/QEMU hypervisor with vCenter-class management.

⭐ Why OXware?

✅ Is it real? — build maturity, no marketing

🚀 Quick Install

🔑 First login — the setup token

🚚 Coming from VMware or Proxmox?

📦 What's in the box

🖥️ VMs & lifecycle

🌐 Networking

💾 Storage

🔐 Security

🛡️ Confidential computing

🤖 AI + automation

🌍 Cloud-native (v2.7.2)

⚙️ Kernel-level pack (v2.8.2)

🌍 Six interface languages

🛠️ Tech stack

📚 Resources

⚡ What's new in v2.8.1

⚡ v2.8.0 — Modularization

⚡ What shipped in v2.7.2

🛡️ Security

⚙️ API

🤝 Contributing

📈 Star history

💬 Community

📄 Licence

About

Topics

Resources

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Releases

Sponsor this project

Packages

Used by

Contributors

Languages