Explain
Design notes — architecture, agent vs SSH, readiness, security, and hypervisor parity.
Why grain works the way it does: control plane, guest agent, readiness, security boundaries, and hypervisor support. Use Get started for install and first sandbox, and Guides for day-to-day ops.
- Agent vs SSH — When grain uses the guest agent, when it falls back to SSH, and why both exist.
- Architecture (daemon, hypervisor, guest agent) — How the grain daemon, hypervisor, guest agent, and CLI fit together.
- Hypervisor matrix (QEMU vs Firecracker) — Capability matrix: QEMU (default) vs Firecracker today, and production-track target phases (vFC-1 agent, vFC-2 net/mounts).
- Images and boot (golden vs cloud) — Why base images matter, how golden boots differ from cloud images, and how to think about speed.
- Product surface — What grain implements for local Linux microVM sandboxes.
- Readiness protocol (custom images & bootstrap) — Full contract: guest readiness files, agent health fields, wait=bootstrap, and when a sandbox is considered ready.
- Security model (trust, proxy, secrets) — What grain isolates, what it trusts, and how proxy and secrets fit.