SECURITY-FIRST MICROVMS

A platform you can host yourself,
on a single node.

Describe your app in a short manifest and TinyPlatforms does the rest: Nucleus schedules it, Cytoplasm runs it in its own hardware-isolated microVM, and the Membrane gateway routes traffic to it. Every boundary ships locked down.

one app per microVM · nothing insecure to turn on

THE COMPONENTS → Nucleus control plane Cytoplasm app runtime Membrane gateway Ribosome hypervisor driver Osmosis state Capsid secrets

// ARCHITECTURE

Everything a platform needs, in six parts.

NUCLEUS

One control plane

Nucleus is the single source of truth. It owns the API, scheduling, identity, and the audit log, so every component reads the same state and every change is recorded.

CYTOPLASM · RIBOSOME

A microVM per app

Cytoplasm pulls your container image, verifies it, and hands it to the Ribosome driver, which boots it as a hardware-isolated microVM. Your app gets its own kernel, not just a namespace.

MEMBRANE

One gateway in front

All inbound HTTP and gRPC terminates at Membrane. It enforces the policy Nucleus defines and never invents its own, so routing and security can't drift apart.

SECURE BY DEFAULT

Locked down from the start

Apps are treated as untrusted: no host filesystem, no open egress, no shared kernel. There is no insecure mode to switch on, and nothing to remember to harden.

SIMPLE TO OPERATE

One box, few moving parts

A cell is one self-contained VM that bundles the control plane, runtime, and gateway. Manage a single cell or a whole cluster with the same API and CLI tools.

SCALES ORGANICALLY

Grow without migrating

Need more capacity? Cluster multiple cells together to run more workloads without having to change your operational lifecycle.

PLUGGABLE BY DESIGN → Hypervisor Gateway State store Secrets vault swap any backend with a manifest change, no lock-in

// HOW IT WORKS

Three steps to a running app.

Boot a microVM

Cytoplasm boots a hardware-isolated microVM for your app, with networking closed by default.

Submit an app manifest

Describe your app in a few lines of YAML and run tp apply app.yaml. Nucleus validates it and schedules the app.

Receive traffic

Membrane routes each request to your app and applies your policy on every single one.

Ready to deploy your first node?

Join the waitlist and we'll email you when the hosted service and commercial add-ons are ready.

A platform you can host yourself,on a single node.