Liquid Metal

Experimental — work in progress. Built to learn by doing. Not production-ready.

Bare-metal hosting platform. No Kubernetes. No managed cloud. Two products built on proven isolation primitives.

---

Products

Metal — Firecracker MicroVMs

Run any Linux binary in a hardware-isolated VM. KVM-backed, dedicated rootfs, TAP networking. Ship a Go binary, an HTMX app, anything that compiles.

• Isolation: AWS Firecracker + KVM
• Cold start: ~100–250ms
• Networking: TAP device → br0 bridge → Pingora proxy
• Storage: Dedicated ext4 rootfs per service

# liquid-metal.toml
[service]
name   = "my-app"
engine = "metal"
port   = 8080

[metal]
vcpu      = 1
memory_mb = 128

Liquid — WebAssembly

Run Wasm modules via Wasmtime/WASI. Sub-millisecond cold starts, in-process execution, memory-only. No disk, no TAP, no VM overhead.

• Isolation: Wasmtime Wasm sandbox
• Cold start: <1ms
• Execution: In-process, WASI VFS

# liquid-metal.toml
[service]
name   = "my-fn"
engine = "liquid"

[build]
command = "GOOS=wasip1 GOARCH=wasm go build -o main.wasm ."
output  = "main.wasm"

---

Getting Started

flux login      # authenticate via browser (WorkOS)
flux init       # create project + write liquid-metal.toml
flux deploy     # build locally → upload → provision
flux status     # list your services
# → live at <name>.liquidmetal.dev

---

Local Dev

# Start infrastructure
task up            # Postgres + NATS + RustFS (docker compose)
task dev:api       # Rust API on :7070
task dev:proxy     # Pingora on :8080
task dev:daemon    # NATS consumer (Firecracker skipped on macOS)

# Install the CLI once — then use flux from any directory
task install:cli   # go install → flux lands in $GOPATH/bin
flux login
flux init          # run from your service directory
flux deploy
flux status

Linux (bare metal, one-time setup)

task metal:setup     # br0 bridge, /run/firecracker, Firecracker binary
task security:setup  # jailer user, cgroup v2 controllers, eBPF policy

---

What We Don't Use

• No Kubernetes, K3s, or any orchestrator
• No AWS, GCP, Azure, Vercel, or Heroku
• No ORMs (raw SQL everywhere)
• No SPA frameworks (HTMX + Templ only)
• No container registry (Object Storage is the registry)

For deep-dives into infrastructure topology, eBPF tenant isolation, HA strategy, and data flow see ARCHITECTURE.md. For codebase layout, dev setup, and contribution rules see CONTRIBUTING.md. For step-by-step local dev and deployment see RUNBOOK.md.