About VMVM

VMVM is a self-contained 32-bit Linux computer that runs entirely in your browser. It boots a real Alpine Linux guest inside a JavaScript x86 emulator, with optional full IPv4 networking, on-device AI inference, browser automation, voice input, and a public web IDE with live preview.

Executive summary

VMVM delivers a full Linux development environment with zero installation. No OS, browser extension, or cloud backend is required for the core experience: the disk image, emulator, and tools are all served as static files and execute in the browser tab. The page also ships three optional integrations — full IP networking through a WebSocket gateway, on-device large-language-model inference through WebGPU, and browser automation through an extension — each of which can be used alone or together.

The project includes a public Dev IDE at /ide/: a browsercode-style editor with a Monaco code editor, file tree, console, and live preview that runs a scaffolded app inside the guest and reverse-proxies it through nginx. Projects can be written, saved, and recompiled with native esbuild running inside the guest, and the preview hot-reloads on save.

Key highlights:

• Everything static. The browser fetches firmware, kernel, disk image, and libraries over HTTPS; no server-side runtime is needed to boot and use the VM.
• Private by default. AI inference (LiteRT-LM + Gemma on WebGPU), voice transcription (Moonshine), and file operations stay in the browser; no prompts, audio, or files are sent to a cloud service.
• Three coding-agent tiers. The guest exposes vmlang (Deep Agents), rig (a lightweight Rust loop), and vmmastra (Mastra), each tuned for different round-trip and prompt budgets against the emulated i686 CPU.
• Optional IPv4 networking. A Go gateway carries raw Ethernet frames over an authenticated WebSocket, giving the guest DHCP, DNS, TCP, UDP, HTTPS, SSH, and package-manager traffic through ordinary host sockets.
• Portable Windows release. An offline ZIP bundles Chrome, the VM, Moonshine, LiteRT-LM, the Gemma model, and gateway binaries for machines without a live connection.

Technical summary

The guest is a fixed-size Alpine Linux i386 ext4 image (64–104 MiB across six cumulative tiers) booted by a Linux 6.6 i386 kernel in the v86 JavaScript emulator. v86 provides a serial console (primary), emulated IDE/ATA disk, NE2000 or VirtIO NIC, and optional VGA; the page renders the terminal with xterm.js.

Hosting. The deployed site is a purely static bundle behind nginx (fapstaff.com). The disk images are loaded with HTTP Range requests (206), with a compatibility fallback that downloads the whole image and forces libata.force=pio4 when DMA interrupts fail. A service worker caches static assets but always revalidates the VM manifest so image updates reach users promptly.

Networking. network/cmd/v86net-gateway is a Go binary WebSocket-to-TAP gateway. Each WebSocket message carries exactly one Ethernet frame. The default userspace backend uses a gVisor TCP/IP stack for DHCP/DNS/NAT through ordinary sockets with no elevation; an optional native backend uses a TAP adapter (Linux) or Wintun (Windows) for maximum throughput. Sessions are origin-bound, short-lived, and authenticated with a token carried in Sec-WebSocket-Protocol. Guest egress to loopback, RFC1918, link-local, and cloud-metadata addresses is blocked by default.

On-device AI. llm/vendor/litert-lm bundles LiteRT-LM 0.14.0 (Apache-2.0), a WebGPU inference runtime that executes a selected Gemma model in the browser's GPU; the guest reaches it through a serial RPC bridge (vmllm). No API key or extension is required.

Browser bridge. Guest commands such as vmfetch, vmclip, vmexport, vmgithub, and vmai call browser APIs through a host-side RPC layer instead of a NIC, keeping those capabilities available without the gateway.

Dev IDE. The Dev tier image runs vmbro-httpd, a Chi-based Go supervisor on guest port 3000. It scaffolds a project from one of seven templates, compiles TypeScript/Astro with native esbuild and QuickJS inside the guest, and streams a live preview on port 3100. nginx reverse-proxies /ide/ to 3000 and /preview/ to 3100, and HMR pushes reload events over SSE so the preview updates on save.

High-level implementation details

Runtime architecture

Browser tab
 ├── v86 (libv86-network.js + v86-network.wasm)
 │    ├── SeaBIOS → kernel (bzImage-network) → Alpine ext4 disk image
 │    ├── serial console → xterm.js
 │    └── NIC → V86WebSocketNetwork → wss://…/v1/ethernet
 ├── LiteRT-LM (WebGPU) ← Gemma 4 E2B model ← OPFS
 ├── MoonshineJS (ONNX/WASM) ← microphone → text
 ├── Agent bundles (Deep Agents / Mastra / Rig) ← guest RPC
 └── Service worker (network-first static cache)

Host / server
 ├── v86net-gateway (Go): WSS ↔ gVisor userspace NAT | TAP/Wintun native
 ├── PeerJS signaling server (private) for WebRTC remote chat
 └── nginx: static files + /ide/, /preview/, /v1/sessions, /peerjs/

Guest (Alpine i386)
 ├── vmbro-httpd (Go/Chi): port 3000 — Dev IDE shell + project server
 ├── vmbro-dev: preview server on port 3100
 ├── esbuild (ia32), QuickJS: native compile + render
 └── vm* RPC commands, vmlang / rig / vmmastra agents, tmux, git…

Data paths

• Networking: guest TCP/IP → v86 NIC → net0-send → WSS → gateway → host sockets, and back through net0-receive.
• LLM: guest vmllm → UART RPC → browser LiteRtLmClient → WebGPU inference in the page.
• Agents: guest terminal → vmlang/rig/ vmmastra → host bundle → guest filesystem and shell over a hidden second UART, with per-operation browser approval.
• Dev IDE: browser /ide/ → nginx → guest port 3000; save → watcher → SSE reload → browser reloads the cache-busted /preview/ iframe.

Security and privacy posture

• AI prompts, transcripts, audio, and project files never leave the browser unless the user explicitly enables network features.
• Gateway sessions are origin-bound, expire, are revocable, and cap traffic (1 GiB by default); admin tokens are server-side only.
• Guest egress is restricted by default; port forwards are explicit opt-ins.
• The service worker refuses to serve stale disk images, so manifest and image updates take effect on reload.

Components and licenses

VMVM is assembled from the following components. Bundled third-party notices travel with the distribution; the Gemma model and Moonshine models carry their own upstream terms.

This table lists direct dependencies. Transitive Go and npm dependencies inherit their own licenses, and the distribution ships their notices where required. The Gemma 4 E2B weights are not committed to this repository and remain subject to Google’s model terms.