From bare metal to vmx
Download one file, write it to a USB stick, boot it and answer six pages. The installer takes the disks you point at, whole, and nothing else.
Download, verify, write
Download
One file for a USB stick or a disc. It installs with no network.
Download vmx 0.54.0 · 891 MBVerify
Beside it: SHA256SUMS, its signature by the release key, and the key.
openssl pkeyutl -verify -pubin \ -inkey release.pem -rawin \ -in SHA256SUMS -sigfile SHA256SUMS.sig sha256sum -c SHA256SUMS --ignore-missing
Write to USB
sudo dd if=zettarack-vmx-0.54.0.iso of=/dev/sdX \ bs=4M status=progress conv=fsync
On Windows, Rufus in DD mode or balenaEtcher.
Boot it
Choose the stick in the firmware's boot menu. With Secure Boot on, the first boot queues two certificates and restarts into the firmware's key manager, a blue screen: Enroll MOK, Continue, Yes, the password vmx, Reboot. The stick starts again and installs.
Six pages, then Erase and install
One window, Back and Next at the foot of each page. Next stays dimmed, with the reason beside it, until the page is complete. Every answer shown is the installer daemon's: which disks it will use, which it will not, and why.
- SystemThe image to install: vmx.
- DisksClick the tiles of the disks the system goes on. Single disk, mirror, raidz1 or raidz2. A disk the installer will not use is dimmed with its reason: the stick you booted from, a disk in use. Encryption is off unless you choose it.
- NetworkDHCP, or a fixed address on one card.
- ZoneType part of a city's name and pick the time zone.
- AccessThe machine's name, an ssh key, and a user who logs in at the screen with a password. The key opens root over ssh, and that user too.
- ReviewThe daemon's own plan: every step it will take, and in red what each erases. Nothing has changed yet. Erase and install starts it; the steps run in view, the one running marked, and it ends with Restart.
If Secure Boot would refuse the installed system, the Review page says so and offers Repair Secure Boot instead, with what it changes. On a machine with no screen, the stick's boot menu offers the same install as text on the first serial port.
The desktop is the console
The machine starts locked: the password of the user from the Access page opens it. Behind the lock is its own desktop: a bar along the top, and under it the console, full screen, every machine at keyboard speed, which is none yet. Each menu on the bar has one letter lit; Super and that letter opens it. Super+a is the console from anywhere. Super tapped alone shows every machine. Super+/ shows every key.
In the console, w on a machine shows its screen full size, with its sound, and Super+a brings the console back. Everything below is typed there, or over ssh with the key from the Access page. The appliance's own manual is under System, Manual, one page per screen.
ssh root@vmx1 vmx health vmx list
Build the golden set, then anything
A template's disk carries a golden snapshot, and a new machine is a ZFS clone of it: made in under a second, taking no space until it writes. So the first thing to do on a new vmx is build the goldens. Every machine after that is one command.
Build every golden
Create, Golden, Golden set, Build Super+c
Ten goldens: Debian 13, Ubuntu 24.04, Fedora 44, Rocky 10 and CentOS Stream 10, each as a server and as a GNOME desktop; the whole set is forty-two, every base as a server, a GNOME and a KDE desktop. Build makes the ones ticked, one after another: the vendor's image is fetched and checked against the vendor's own digest, the machine is built, proven through its guest agent, sealed, and kept as a template to clone from. Tick one to build just that.
vmx goldens build debian-13-server debian-13-desktop --ssh-key ~/.ssh/id_ed25519.pub vmx goldens
Named, it builds those; with no names it builds every golden of the set, which is most of a day.
Each golden takes minutes: the packages install inside it from that distribution's mirrors. Leave it running; the list says which are built, and one that fails is said with why while the rest go on.
Just one template, in one go
vmx image known vmx template import debian-13 --fetch debian-13
The catalogue, and one image fetched, checked against the vendor's published digest, and kept as a template. Debian, Ubuntu, Fedora, Rocky, AlmaLinux, CentOS Stream and Arch are known.
A machine in under a second
Create, Machine, from a Template Super+c
Pick the template on the left; on the right its name, CPUs, memory, a login, its network. Show plan prints what will happen. New machine does it, follows the job, and opens the machine's screen when it is up.
vmx clone debian-13-server web1 --ssh-key ~/.ssh/id_ed25519.pub vmx start web1 vmx list
A ZFS clone of the template's disks, a seed with the name and your key, and a domain with UEFI Secure Boot, two CPUs and 2G. The list shows its address once it has one; its screen is under Machines on the bar, and vmx console web1 is its serial line.
A fixed address, and more of them
vmx clone debian-13-server db1 --address 10.0.0.50/24 --gateway 10.0.0.1 --dns 10.0.0.1 vmx set web1 --cpus 4 --memory 8G vmx clone web1 web1-test
An address from the first boot, refused if another machine has it. A stopped machine clones as a template does; a running one clones from one of its snapshots with --at.
Each one command
A desktop machine
vmx build desk1 --base debian-13 --desktop kde vmx desktops
Built and checked until its user is logged in on its own screen. KDE, GNOME, Xfce, i3, sway, Hyprland, bspwm and awesome, on the bases each has been proven on; the second line lists them. On the desktop, the same is the Machine window with a desktop picked.
An app
vmx recipes vmx build dns1 --recipe adguard
A working service from a recipe: AdGuard Home, Jellyfin, Plex, Syncthing, a LAMP stack, an RDP desktop and more. Cloned, grown, started, and its health page read every five seconds until it answers; its name and address are printed when it passes. The desktop's Create, Machine, from an App fills a recipe's fields in.
Windows
printf 'a password\n' | vmx windows win11 --edition 11 --login me
Windows 11 or Windows Server 2025, installed with nothing asked. Microsoft's evaluation ISO and the driver disc are downloaded the first time; Setup is answered from start to finish; the job ends with Windows at its logon screen. Every machine boots UEFI with Secure Boot and a TPM.
Your own golden
vmx build base1 --base ubuntu-24.04 --script ./setup.sh --golden
A blank base with your script run once at the first boot, then sealed and saved as a template: machine-id, host keys and logins removed, so every clone's first boot is a first boot.
Snapshots, backups, undo
A machine
vmx snapshot web1 before-upgrade vmx rollback web1 before-upgrade vmx schedule web1 --every 1h --keep 24 vmx backup web1 --to tank/backups vmx power web1 on
Every disk snapshotted under a label; put back to it, stopped; every hour, keeping a day; sent to another pool, only what changed after the first time; started with the host.
The appliance
vmx health bootmass upgrade --check bootmass be list
Health answers ok, failed or did not run, each check with what it expected, found and what to do. A release is a signed image in a new boot environment beside the old one; the bar says update vmx-N when one is ready, and going back is choosing the one before at boot. Nothing is ever installed on the appliance itself.