Volvisor is the volume virtualization and orchestration layer for O3K and CellHV. It presents one managed block-volume API across three distinct backends, while preserving their real locality, durability, and mobility semantics.
| v2 volume class | What it means | Live migration |
|---|---|---|
native-local |
One or more logical VM volumes provisioned from host-attached local disks/pools; optional independent local mirror | Pinned while attached in v0 |
nearline-replicated |
VM normally reads/writes its serving host's local replica; changes replicate to other hosts asynchronously; optional local mirror | Only after target durable barrier and safe single-writer handoff |
ceph-rbd |
RBD images in an existing or optionally managed Ceph cluster; Ceph OSDs own physical backing disks | Shared-backend migration only after VMM/lock/frontend evidence |
Physical NVMe PCI/VFIO passthrough is an optional exclusive attachment profile, not the same operation as creating a logical native-local volume.
Conventional stacks often tie a VM to one storage implementation. Volvisor separates volume identity, protection policy, placement and lifecycle from the backend. A VM can consume different storage classes using a common management model; it does not mean the classes have the same durability or that Volvisor inserts a proxy into every fast path.
O3K / CellHV (volumes + attachments)
|
Volvisor volume API
+------------------+--------------------+
| | |
native-local nearline-replicated ceph-rbd
| | |
local LV/pool local Storage Cell RBD mappings
| + peer replicas |
attached NVMe attached NVMe Ceph cluster / OSDs
Local SSD protection (e.g. a qualified local mirror) and remote host replication are independent. Planned migration requires a verified storage handoff; unplanned failover can lose the async replication tail.
- ADR-0003 — volume architecture
- ADR-0004 — nearline replication and migration
- ADR-0005 — Ceph RBD versus OSD lifecycle
- ADR-0006 — online resize and live local block relocation
- ADR-0007 — DRBD 9 nearline replication backend
- ADR-0008 — experimental Rook-only hyperconverged cells
- Experimental Rook Cell contract
- Three-host Rook Cell GO/NO-GO POC
- SPEC-0002 — v2 implementation specification
- Volume API contract v2
- Nearline replication contract v2
- 2026-10-09 adversarial design review
- P0 implementation plan
A Rust workspace implements the P0 control plane (stable IDs, device claiming, single-volume API/attachments, provider conformance — SPEC-0002 section 12) plus the native-local LVM slice, the external Ceph RBD adapter slice and the DRBD 9 nearline baseline slice:
crates/volvisor-types typed domain vocabulary (Volume API v2 mirror)
crates/volvisor-journal durable intent journal + idempotency registry
crates/volvisor-provider engine-neutral provider trait, command runner,
fake provider + conformance kit
crates/volvisor-lvm native-local LVM provider (thick LV, P1 slice)
crates/volvisor-ceph ceph-rbd adapter for an existing external Ceph
cluster (P2 slice, ADR-0005 Phase A)
crates/volvisor-drbd DRBD 9 nearline baseline: the local end of a
single-primary replicated resource over an
operator-designated VG (P3 slice, ADR-0007)
crates/volvisor-api HTTP/JSON Volume API v2 server
crates/volvisord daemon binary
Build and test: cargo build, cargo test --workspace,
cargo clippy --all-targets (CI denies warnings). Real-LVM integration tests
run only when VOLVISOR_TEST_LVM=1 and root are available; real-Ceph
integration tests run only when VOLVISOR_TEST_CEPH=1 plus
VOLVISOR_CEPH_* cluster configuration are present; real-DRBD integration
tests run only when VOLVISOR_TEST_DRBD=1 plus VOLVISOR_DRBD_* host/peer
configuration are present (they need the drbd-utils toolchain, the DRBD
kernel module and a provisioned peer). This is prototype software: no
production-support claim is made or implied (AGENTS rule 12).
ADR-0001, ADR-0002, SPEC-0001, provider v1, storage classes v1, replication v1, engineering design, replication research, and prior review.
The v1 drafts remain available for traceability and historical design research. The v2 documents replace conflicting class definitions; v1 cannot be reinterpreted silently. Some historical R&D comparisons remain useful but must be revalidated against the pinned implementation versions.
Design proposal, not implementation. No class is production supported; no durability, performance, zero-RPO failover, or live-migration capability is claimed until exact-SHA real-host conformance and fault-injection evidence passes. The first recommended implementations are a host-native logical-volume provider and an adapter to an existing Ceph RBD cluster. Nearline distributed authority is the highest-risk R&D area.
Online growth of a local LV is distinct from same-host live relocation of its backing storage, which is itself distinct from cross-host live VM migration. See ADR-0006 for native Cloud Hypervisor resize, same-VG LVM pvmove, and optional QEMU Storage Daemon + vhost-user-blk block mirroring.
For nearline, DRBD 9 is the first replication-engine prototype candidate, operating directly above LVM logical volumes (host-kernel path) or from an isolated Storage Cell (via qualified host-to-cell block frontend). Protocol A provides local-first asynchronous replication; Protocol C is an explicit optional synchronous-protection profile. The difficult cross-host Cloud Hypervisor migration handoff is not considered solved merely by using DRBD; see ADR-0007.
Optional experimental managed-Ceph mode: Volvisor boots fixed-resource Cloud Hypervisor volvisor-cell infrastructure VMs with exclusively VFIO-assigned NVMe, joins them as dedicated Kubernetes worker Nodes and permits only Rook/Ceph plus essential node-system workloads. Rook operator/control plane remain independent. This mode is disabled by default and NOT production supported; three physical host Rook/Ceph failure and performance tests are required. No Rook fork is presumed.