VelrixIn development

Your cloud ops, in one window.

Velrix is the cloud platform Hypefox builds and operates. Containers and full virtual machines run side by side, every project is its own private network, and the whole estate is administered from a desktop rather than a dashboard.

Velrix. The cloud platform: containers, machines and projects that are their own networks.

Overview

Everything you run, on one board.

Velrix runs OCI containers and full virtual machines on the same board, deployed the same way and watched the same way. Every project is a private network of its own: what is inside it can reach the rest, and nothing else can unless a door is opened. Cockpit shows the estate as a board, with files, terminals, billing and support opening in windows beside it, so looking something up never closes what you were doing.

Several Velrix clouds federate into one desktop, which is what lets an organisation administer its own estate, or a reseller administer its customers', without a second login. It runs on hardware Hypefox owns and networks Hypefox operates, in Malmö. Velrix is in pilot: clouds are set up together with us rather than signed up for.

Containers and machines

OCI containers and full virtual machines on one board, deployed and watched the same way. A machine is not a special case here, it is another card.

Project-based network isolation

Each project is its own private network. Everything inside it reaches each other by name, and nothing outside gets in unless a door is opened.

A desktop, not a dashboard

Cockpit as the board, with files, terminals and billing open in windows beside it, so looking something up never closes what you were doing.

Proprietary real-time federation

Several clouds administered from one desktop, switched between like realms. It is what lets a reseller run every customer's cloud from one pane.

Nothing runs as root

Every workload runs under rootless Podman, and so does our agent. A container that breaks out lands as an unprivileged user, not as root on the host.

Sovereign by construction

Hardware Hypefox owns, in Malmö, on networks Hypefox runs. No hyperscaler underneath and no foreign parent above, so nobody else's terms apply.

Introducing Velrix

There is nothing else quite like it

Containers and virtual machines on one board, every project its own private network, and several clouds run from a single desktop. Everything below is the product itself, photographed as it runs.

Zero install

Everything you run, in a browser tab

Windows, a taskbar, snapping and several things open at once, all in the browser. Nothing is installed and nothing on your own machines changes.

One surface

Containers and machines, on one surface

The customer portal, the database, the cache and the finance system in one project. The finance system is a virtual machine and the rest are containers, sharing a network, a firewall and volumes.

Built-in terminal

A shell into anything, in the browser

The same terminal into a container as into a virtual machine. No SSH key to hand out, no bastion host to keep, and every session goes through your own permissions.

Addresses of your own

A shared address or one of your own

On the shared address the port is allocated, because nobody can have 443 on an address everybody is on. On your own address you choose it. Both keep the firewall and the project network.

Your own registry

Your images, on your own site

A container registry built into every site. You push an image, the nodes pull it over the local network, and a site that loses its uplink can still deploy.

Federation

Proprietary mesh protocol for real-time federation

Several Velrix clouds federate into one desktop over a mesh protocol of Hypefox's own. It carries state the instant it changes, so a realm you are not looking at is still a realm you are running.

One desktop, every realm

Your own cloud, a customer's, a private one on their hardware: each is a realm, and you switch between them like workspaces, with no second login and no second tab.

Windows stay open across realms

Switching realm closes nothing. A terminal into one cloud and the board of another sit side by side, and the taskbar names which realm each window belongs to.

Your desktop, their branding

Open a customer's cloud and the desktop takes on their wallpaper, their colour and their mark. A reseller shows every customer their own cloud, never a generic one.

Technology and security

Built on the newest transport there is

The link between the control plane and the machines running your workloads is WebTransport over QUIC, and it is designed to live inside one private segment. What that buys is not speed for its own sake: it is a node with nothing to attack.

WebTransport over QUIC

One multiplexed connection carries desired state down and observed state up. The control plane says a thing the instant it is true, instead of a node asking every fifteen seconds whether anything happened.

Nodes listen on nothing

The agent dials out and accepts no connections. No inbound port, no inbound auth, and no firewall hole into the machine running everybody's containers. There is nothing on a node for a scanner to find.

One private segment

Control plane and nodes are built to sit on the same VLAN, so the management path between them never crosses the public internet at all. Traffic that never leaves the building is never exposed on the way.

You choose the front door

With the management plane inside the network, what is left facing your users is the part you decide how to harden: zero trust, an identity proxy, a VPN, or your own edge in front of it. One door, your rules.

Typed past the point most stop

TypeScript in strict mode, with the flags most projects leave off: an indexed read is possibly undefined until checked, and an optional property can never quietly become undefined. The compiler argues before the customer does.

Checked again where the data lands

Types are gone at runtime, so every boundary is parsed rather than trusted: API requests, the frames between control plane and agent, configuration at boot. Hundreds of tests cover the paths where being wrong is expensive.

Updates delivered over LAN

Platform updates land in the registry built into your site and reach the nodes over the local network: our registry, your cloud. You choose the policy, apply them automatically or hold each one for approval.

Credentials in the first frame

QUIC has no headers and no cookies, so the first frame on the first stream carries the credential. A session that has not presented one inside the grace window is closed before it reaches a handler.

Storage

Pick how much a machine remembers

Every machine boots an image. What happens to its filesystem afterwards is a choice made per machine, and anything that has to outlive it goes on a volume.

Diskless

Nothing reaches the node. The filesystem lives in RAM, the machine starts clean on every boot, and it leaves no trace behind on the host.

Ephemeral

Writes land on the node's disk and are dropped when the machine stops. Scratch space at disk speed, and a clean start every single time.

Boot disk

A disk of its own, so a stop and a start keep everything. A rebuild starts fresh from the image; keep what must survive on a volume.

Volumes that outlive the machine

Sized, attached and moved between workloads without copying a byte. Ten copy-on-write snapshots each, and quotas the filesystem enforces.

See Velrix against your own workloads

Velrix is in pilot. Tell us what you run and what it has to satisfy, and we will show you the platform against it.