Data plane

The data plane runs the workloads and serves user traffic. It is driven by the control plane but handles requests on its own.

mikrom-agent

The worker daemon. One runs on every worker node.

• MicroVM lifecycle: creates, boots, pauses, resumes, stops, and snapshots microVMs on Firecracker or Cloud Hypervisor. One microVM per deployment.
• Host coordination: pulls images, attaches volumes, wires guest networking.
• Observability: collects and streams logs and metrics from workloads and the host over NATS.
• NAT64: starts a host-wide NAT64 translator so guest IPv4 egress works over the IPv6-first platform network.
• eBPF: loads mikrom-agent-ebpf (shared types in mikrom-agent-ebpf-common) for host-side network handling and metrics.

mikrom-router

The ingress and traffic plane, built on Pingora.

• Terminates TLS and routes requests by hostname to an app’s active deployment.
• Runs health checks and shifts traffic on activate/rollback.
• Owns the persisted routing table and ACME/TLS state in its own PostgreSQL (separate from mikrom-api).
• Wakes scaled-to-zero apps on the first incoming request.
• Consumes route and certificate updates over NATS.

mikrom-network

Maintains the platform mesh: WireGuard peer state, host identity, and route synchronization between workers. IPv6-first addressing.

mikrom-dns

Internal DNS for services, workers, and tenant resources. Synthesizes DNS64 answers so IPv6-only workloads can resolve and reach IPv4-only destinations (paired with the agent’s NAT64 translator).

mikrom-init

A small Zig binary that runs as the init process inside each microVM. It bootstraps the guest environment and starts the workload.

Path of a request

Client ──HTTPS──► mikrom-router ──(route by hostname)──► [app microVM :port]
                       │                                       ▲
                       │ health checks, TLS, wake-from-zero     │ managed by
                       └───────────────────────────────────────  mikrom-agent

mikrom-api is not on this path.