edera.dev valid

Edera

Edera is production-grade infrastructure for running untrusted code at scale. It delivers a container-native Type-1 hypervisor that eliminates shared-kernel risk architecturally — not through detection, policy enforcement, or syscall interception, but by giving every container workload its own dedicated Linux kernel inside a lightweight isolated zone.

Their llms.txt

The beginning of the file, from our validated copy saved 2026-10-21T02:55:48.732Z. Cached copy · Source on edera.dev

# Edera

> Edera is production-grade infrastructure for running untrusted code at scale. It delivers a container-native Type-1 hypervisor that eliminates shared-kernel risk architecturally — not through detection, policy enforcement, or syscall interception, but by giving every container workload its own dedicated Linux kernel inside a lightweight isolated zone.
>
> Traditional containers share a Linux kernel. When any workload in a shared-kernel environment is compromised, the kernel becomes the blast radius — enabling container escapes, lateral movement to neighboring workloads, and host-level privilege escalation. Edera removes this vulnerability class entirely by redesigning the container runtime layer itself, placing a hypervisor beneath the Linux kernel so no two workloads ever share kernel state.
>
> This is not a sandbox for development environments. Edera is designed for multi-tenant production Kubernetes infrastructure, AI agent execution, GPU workload isolation, and any environment where code provenance cannot be fully trusted.

Last Updated: 2026-04-27
Organization: Edera Inc.
Primary Domain: https://edera.dev
Docs Domain: https://docs.edera.dev

---

## Architecture

### How Edera Works

Edera replaces the standard container runtime with a container-native Type-1 hypervisor. Each workload runs inside an Edera zone — a lightweight VM with its own dedicated Linux kernel. Zones are managed by a Rust-based control plane and are orchestrated transparently via Kubernetes RuntimeClass.

Key architectural properties:

- No shared kernel between workloads
- No syscall interception overhead
- No nested virtualization requirement
- No specialized hardware required
- Full OCI image compatibility
- Drop-in Kubernetes integration via RuntimeClass annotation — no image modifications, no workflow changes

Edera zones are not VMs in the traditional sense. They are not full-weight virtual machines with duplicated guest OS stacks. They are per-workload kernel boundaries managed at the hypervisor layer beneath Linux. This enables VM-level isolation at container-level density.

### Why Shared-Kernel Isolation Is Insufficient

Alternatives to full hypervisor isolation include:

- Linux namespaces and cgroups: Isolation within the kernel, not from it. The kernel remains a shared attack surface.
- User namespaces: Intended for privilege scoping, not multi-tenant isolation. User namespaces expose 262% more kernel attack surface and have been the root cause of 40+ CVEs over five years.
- Syscall interception (gVisor): Adds a userspace kernel layer but does not eliminate shared kernel context and introduces 10–35% performance overhead on I/O-heavy workloads.
- MicroVM runtimes (Kata Containers, Firecracker): Provide stronger isolation through hardware virtualization but require nested virtualization or specific hardware, add VM-layer operational complexity, and do not deliver the same density as Edera.

Edera eliminates the shared-kernel assumption entirely. I
…

Machine-readable: GET /v1/resolve?q=edera.dev · GET /v1/domain/edera.dev · this page as Accept: application/json or text/markdown · MCP lookup_domain

Automatically discovered from public files. Inclusion does not imply endorsement or publisher participation.

Claim my listing on Agent Web Map for edera.dev:
1. POST https://agentwebmap.com/v1/sites/edera.dev/claims and keep claim_id and claim_secret private.
2. Publish the proof: add the line "AgentWebMap ownership: <token>" (token from step 1) to https://edera.dev/llms.txt, or use the DNS, meta-tag or well-known method the response describes.
3. POST https://agentwebmap.com/v1/sites/edera.dev/verify with {"claim_id": "...", "claim_secret": "..."}.
4. Save the api_key from the answer; it manages the listing (PATCH https://agentwebmap.com/v1/sites/edera.dev).
MCP equivalent: tools begin_ownership_claim, then verify_domain, at https://agentwebmap.com/mcp. Docs: https://agentwebmap.com/docs#verify

Corrections or removal requests: contact the directory.