IMP

Appearance

Architecture ​

IMP uses a split-control model:

  • Operator: cluster-scoped reconciliation, API-state orchestration
  • Agent: node-local runtime operations for Firecracker and VM networking

Core Resources ​

  • ImpVM: lifecycle of VM instances
  • ImpNetwork: NAT, DNS, and integration surface for CNI behavior
  • ImpVMSnapshot: save/restore VM state workflows
  • ImpVMMigration: orchestrate VM movement
  • ImpWarmPool: prewarmed instances from snapshot baselines
  • Runner + RunnerPool: execution pool primitives

Written Architecture Docs ​

Architecture Diagrams ​

System Context (L1) ​

Imp L1 ContextImp L1 Context

Containers (L2) ​

Imp L2 ContainerImp L2 Container

Control Plane (L3) ​

Imp L3 Control PlaneImp L3 Control Plane

Data Plane (L3) ​

Imp L3 Data PlaneImp L3 Data Plane

Kubernetes E2E Sequence (Primary) ​

Imp K8s E2E SequenceImp K8s E2E Sequence

Data Flow Snapshot ​

  1. User applies CRD objects.
  2. Operator reconciles desired state and schedules operations.
  3. Agent executes host/runtime work and publishes status.
  4. Metrics and status fields expose platform health and timing.

Platform Positioning ​

Imp is a Firecracker-on-Kubernetes platform — operator + node agent that turns microVM lifecycle into declarative Kubernetes resources. The core completes without any sandbox component.

imp-sandbox is an optional add-on, not the platform itself. It layers multi-tenant isolation primitives (tenancy tiers, gateway data-plane, per-sandbox tokens) on top of base ImpVM/ImpNetwork. Use base Imp when you need VM orchestration; add sandbox only when you need isolated tenant sandboxes for AI agents or untrusted code.

See Sandbox Overview for when to use base Imp vs. sandbox, and Sandbox Install for the separate chart.

Operational Notes ​

  • Cilium is a first-class networking path.
  • Fallback networking is available for non-Cilium environments.
  • Deployment pinning (image tags/Helm values) is recommended for repeatability.
  • imp-runtime DaemonSet uses updateStrategy: OnDelete — it never rolls automatically. See Manual — Day 0.
  • Practical runbooks and day-to-day guidance are in /manual.