Datacenter as an Application™

Mixed x86 and ARM - One Unified Fabric

Mixed architecture becomes one fabric.

STRATUM brings x86 and ARM infrastructure together in a single virtual machine fabric-not just a container platform. Workloads can run natively on either architecture or be emulated across architectures, giving organizations the freedom to balance performance, power efficiency, cost, and hardware availability without creating separate infrastructure silos. It is a game changer because mixed-architecture computing becomes flexible, portable, and practical across both datacenter and edge environments.

Intelligent Memory Deduplication

Run 10 VMs in the same footprint as 1 VM's memory!

Most VM fleets repeat huge amounts of the same RAM. Ten Windows or Linux VMs may load the same operating system, libraries, services, and application binaries into memory again and again while only their live data differs. Without deduplication, the host can store those identical pages 10, 20, or 30 times. STRATUMvisor makes memory deduplication a core platform capability: when eligible VMs contain identical memory pages, STRATUM keeps one shared copy and maps it into every VM that needs it. That can turn repeated gigabytes of identical RAM into a single shared memory footprint, freeing enormous capacity for more workloads. The more similar the VMs, the more dramatic the savings.

STRATUMvisor

The Hypervisor Built Into the Virtual Datacenter

Traditional hypervisors virtualize servers. STRATUMvisor virtualizes everything those servers depend on.

What it is

STRATUMvisor is STRATUM's integrated virtualization engine, delivered in the same portable OCI container image, without a separate hypervisor product, licensing tier, or management stack.

Under the hood

It uses KVM, when available, on Linux across x86 and Arm, with Hyper-V acceleration on supported Windows hosts. STRATUM adds its own orchestration, device models, storage fabric, networking, and virtual datacenter controls.

What makes it different

STRATUMvisor goes beyond VMs. Images are accessed directly through the integrated storage fabric, without host mounts, manual LUN mapping, or separate storage clients. Ports, cables, switches, and connections are first-class virtual objects. Instead of assigning a VM to an abstract network, you wire specific VM ports to specific ports on switches, routers, firewalls, and other systems.

The Network Becomes Part of the Virtual Datacenter

Ports, links, switching, and policy become first-class infrastructure.

STRATUM can run familiar virtual network appliances from Cisco, Palo Alto, Arista, and other vendors-but it also includes its own purpose-built Layer 2 switch, engineered from the ground up for the STRATUM fabric. Every interface is a first-class object on the canvas. Drag a wire from a VM into a specific switch port, configure that port, inspect its state, mirror its traffic, or capture packets directly. The topology is no longer documentation sitting beside the infrastructure. It is the infrastructure-a living network diagram that can be deployed, operated, and versioned. Real Switching Without the Appliance Weight STRATUM Switch delivers VLAN-aware forwarding, trunking 802.1Q access and trunk ports, true 802.1ad/Q-in-Q support, private VLANs, protected ports,VLAN-aware MAC learning, RSTP, BPDU Guard, LLDP, LACP port channels, IGMP and MLD snooping, SPAN, direct PCAP capture, port security, impairment controls, and deep operational visibility. It provides the switching capabilities needed for real datacenter, test bays, and laboratory networks without carrying the operational weight of a full network operating system. The hardened static binary is approximately one megabyte, yet still exposes the forwarding state, topology, counters, neighbors, captures, fabric endpoints, and diagnostic information operators expect.

Distributed by Design

One logical switch can span workers, sites, clouds, and edge systems.

STRATUM Switch is not restricted to one host. Its native execution path places switches on the right worker, creates local TAPs and bridges, establishes VXLAN connectivity, integrates with STRATUM Continuum (network mesh), and cleans up the complete runtime when the workload ends. A switch can span workers, sites, clouds, and edge systems while remaining one logical object on the canvas. STRATUM does not merely virtualize network appliances. It virtualizes the ports, links, policies, and physical relationships that make the network real.

Connect Infrastructure Without Inheriting Its Boundaries

Continuum extends the virtual datacenter across physical boundaries.

Draw the network once. Run it across everything. STRATUM Continuum turns datacenters, clouds, remote sites, and edge systems into one encrypted virtual network mesh. Your physical network provides reachability. STRATUM extends Layer 2 connectivity with VXLAN, making VMs, switches, routers, firewalls, and networks behave as one datacenter across dissimilar infrastructure. STRATUM Connect uses the Go FIPS cryptographic module and STRATUM’s tunnel protocol to protect control traffic, orchestration, consoles, and inter-node communication. VXLAN carries the virtual Ethernet fabric above it. Existing networks and site addressing remain untouched. Overlapping networks coexist inside isolated virtual segments. VM port → STRATUM bridge → VXLAN → encrypted STRATUM Connect → any datacenter, cloud, or edge site STRATUM automates identity, keys, enrollment, addressing, and mesh connectivity. Your physical network provides reachability. STRATUM provides the datacenter.

Storage-as-a-Service, Built into the Fabric

Network storage is built into the infrastructure model.

STRATUM eliminates the need to engineer, deploy, and manage a separate SAN or NAS. Every STRATUM instance shares storage through a standards-based fabric protocol built directly into the hypervisor requiring no guest OS configuration, storage accounts, or additional management layer. Virtual machines boot directly from images stored across the network, without host-side mounts, manual LUN mapping, or a separately provisioned shared-block layer. STRATUMvisor accesses each VM image in place and presents it directly to the workload. Because the fabric is based on industry-standard iSCSI protocol, organizations gain established security controls and a cleaner path through STIG and NIST RMF assessment. Storage stops being another infrastructure project and becomes an integrated service available wherever STRATUM runs.

VM Storage, Reimagined for Hyper-Scale

Immutable bases and writable children reduce duplication and speed deployment.

To build a truly modern, hyper-scaling infrastructure platform, STRATUM had to change how virtual machines access storage. Every VM begins with an immutable, read-only template, while each individual workload stores only its unique changes in a lightweight child image. The common operating system and application base is stored once and shared across many VMs-eliminating massive amounts of redundant data without sacrificing isolation. Backing files, copy-on-write, compression, and space-efficient snapshots are not optional add-ons; they are fundamental to the STRATUM architecture. The result is faster VM creation, dramatically lower storage consumption, simpler recovery, and infrastructure that can scale far beyond traditional one-disk-per-VM designs.

The GPU is a first-class citizen.

GPU-backed workloads are infrastructure, not an add-on.

STRATUM treats GPU-backed workloads as native infrastructure from the ground up, not as a fragile add-on to a legacy virtual stack.

GPU and Storage Fabrics, Built Into STRATUM

Remote capacity can be presented as local to the workload.

Storage over the network. GPUs over the network. Both presented as though they were local. STRATUM turns local disks, mounted filesystems, Kubernetes storage, cloud volumes, and enterprise storage into one distributed virtual storage fabric. VMs access that capacity across the cluster as though their disks were local. The same philosophy applies to GPUs. Traditional GPU-over-IP requires separate services, endpoints, firewall rules, remote-server tracking, and software inside every workload. STRATUM replaces that complexity with a purpose-built paravirtual GPU device presented directly to the VM. To the guest, it behaves like attached hardware. Behind the scenes, STRATUM selects an available GPU, routes CUDA and management calls, and handles transport automatically. Other platforms : Deploy and manage GPU-over-IP. STRATUM : Attach a GPU device and let the platform handle the rest. The GPU may be local, in another rack, at a remote site, or in the cloud. The VM does not need to know its address, endpoint, or transport path. Traditional PCI passthrough remains available for workloads requiring direct ownership. The GPU fabric goes further, turning GPUs across the environment into shared, schedulable resources.

Shared 3D Acceleration, Built Into STRATUM

Virtualized graphics can be shared across workloads.

Shared host graphics. Virtualized for every workload that needs it. STRATUM gives virtual machines accelerated 3D graphics through its integrated virtio-gpu-gl stack. Guest graphics commands pass through the virtual GPU to VirGL, which translates them into host OpenGL calls-allowing multiple VMs to share graphics acceleration without dedicating a physical GPU to each workload. Designed for graphical desktop VMs, visualization, Android environments, engineering tools, and other OpenGL workloads-not CUDA compute. Available capabilities depend on the STRATUM host GPU and driver stack. If STRATUM runs inside another hypervisor, the outer platform must expose a capable virtual 3D device and OpenGL implementation.

Bring the Hypervisor to the Compute. Bring the GPU to the VM

Compute and accelerator placement no longer have to be the same physical place.

STRATUM runs across AWS, Google Cloud, Oracle Cloud, Azure, and Kubernetes-native AI neo-clouds such as CoreWeave-using the cloud as interchangeable compute beneath one consistent virtual datacenter. Because STRATUM is delivered as a container, deploying it into cloud and Kubernetes environments is a natural extension of the platform rather than a separate product architecture. CoreWeave, for example, exposes its GPU infrastructure through a managed Kubernetes service running on bare metal. The disruptive shift is GPU placement. Your STRATUM VMs do not need to run on the same expensive cloud host that owns the GPU. Standard KVM-capable workers (STRATUMvisor also works without KVM!) can run the virtual machines while smaller, purpose-selected GPU cloud-instances provide acceleration through the STRATUM GPU Fabric. AWS now supports nested KVM on selected virtual EC2 instances, while major clouds offer dedicated, full, and fractional GPU options. Run compute where it is economical. Acquire GPUs where they are available. STRATUM makes them operate as one infrastructure fabric.

What OCI is

OCI means Open Container Initiative. It defines open standards for container images, runtimes, and distribution. STRATUM uses OCI as the delivery envelope for the complete virtual datacenter runtime and its reproducible definitions. Open Container Initiative ↗

Why a Container?

The host becomes the commodity. STRATUM becomes the datacenter.

The host becomes the commodity. STRATUM becomes the datacenter. Building a new hypervisor is difficult. Getting one approved for enterprise, government, and regulated environments is harder. A traditional virtualization platform often brings its own operating system, hardening baseline, patch cycle, configuration model, and security boundary. That means another platform to certify against GDPR, NIST RMF, SOC 2, DoW requirements, and internal corporate policy. In many environments, obtaining a new Authority to Operate (ATO) can take months-or longer. STRATUM takes a different path. You bring the host operating system your organization already trusts: a hardened Linux golden image, an approved enterprise build, or a platform that already holds an ATO. STRATUM is delivered above that foundation as a containerized application rather than another operating system you must adopt, secure, and maintain. That changes the accreditation equation. STRATUM can move through the same trusted software supply chain as other mission and enterprise applications: built as an OCI image, scanned for vulnerabilities, accompanied by an SBOM, identified by immutable digests, and promoted through established registry and DevSecOps pipelines. Iron Bank-aligned base images and industry-standard container security practices provide a familiar path for review, evidence generation, and rapid adoption. The result is not simply a hypervisor inside a container. It is the enterprise virtualization layer-compute, storage, networking, security, and infrastructure control-delivered as software. Virtualization once turned physical hardware into a commodity. STRATUM goes further: it turns hypervisors, clouds, host platforms, and infrastructure environments into interchangeable foundations beneath one consistent operational layer.

The Datacenter, Delivered Like Software

Content-addressed OCI delivery changes how infrastructure is released.

STRATUM replaces the monolithic hypervisor release with a content-addressed OCI infrastructure platform. The hypervisor, storage fabric, encrypted networking, virtual switches, routers, firewalls, orchestration, and logical wiring are packaged and distributed through the same registry model enterprises already use for applications. Each manifest references immutable layers by SHA256 digest. When a new STRATUM release is published, unchanged layers are reused and only new or modified layers need to be fetched. The result is faster distribution, smaller updates, verifiable releases, and infrastructure that can move through modern DevSecOps pipelines instead of being installed and maintained like it was twenty years ago.

Turn Infrastructure into a Rapid-ATO Software Release

Existing hardened Linux and software assurance reduce new platform surface.

STRATUM changes the compliance equation. Instead of introducing another massive bare-metal platform that must be hardened, documented, and assessed from the ground up, STRATUM builds on what organizations already trust: an existing hardened Linux host and a pre-vetted Iron Bank OCI image moving through established DevSecOps pipelines. What remains is a remarkably small assessment surface-a focused set of STRATUM binaries and configuration files that deliver far more than a hypervisor. When built and operated in FIPS mode, STRATUM uses FIPS-approved cryptographic algorithms through the Go FIPS 140-3 Cryptographic Module, aligning its cryptographic foundation with modern federal security expectations. STRATUM packages the storage fabric, encrypted network fabric, virtual switches, routers, firewalls, and even the logical wiring of the datacenter as software. The result is infrastructure that can be scanned, versioned, promoted, and continuously updated like an application-opening a practical path to Rapid ATO and Continuous ATO instead of another years-long certification effort.

BUILT FOR MODERN INFRASTRUCTURE, NOT LEGACY VIRTUALIZATION ASSUMPTIONS

Runtime and persistent state are separated deliberately.

STRATUM borrows the discipline of modern software delivery and applies it to virtual systems. Runtime is stateless. Persistent configuration and virtual machine data live outside the runtime layer. Updates move as image changes and deltas, not patch weekends and brittle runbooks. STRATUM started from the drawing board Instead of virtualizing only the server, STRATUM virtualizes the datacenter at the ground level: compute, storage, switching, routing, firewalls, GPUs, firmware, physical locations, port connections, and the wiring between them. The interface becomes a living network diagram-not a list of unrelated VMs hidden behind layers of configuration. Plug a virtual wire from port 2 on a server into port 13 on a switch. Apply your site policy to that switch port. Attach a disk image that resides across the network. Assign GPUs from another rack, another building, or another cloud. Connect another datacenter by running a small STRATUM component at the remote site. That is next-generation virtualization: not merely virtual machines, but the datacenter itself delivered as software. A Datacenter in a Container Yes, it is. STRATUM manages storage across hundreds or thousands of hosts and virtual machines. It connects STRATUM systems across a datacenter, across multiple physical sites, and into cloud and edge environments. It delivers switching, routing, firewalls, encrypted fabrics, operations, orchestration, and even the logical wiring and cabling between systems. It also creates a shared GPU fabric where CPU-only servers can access compute located elsewhere in the rack, elsewhere in the datacenter, at a remote physical location, or in the cloud. And it does all of that as a portable OCI-delivered infrastructure engine. Can you say that about your own datacenter?

Hardware-Backed Memory Encryption

Protect sensitive workload memory while it is being processed.

STRATUM protects virtual machine memory with hardware-backed encryption, keeping sensitive workloads isolated-even from the host and other tenants. By supporting confidential-computing technologies across modern x86 platforms, STRATUM helps secure data while it is actively being processed, not only when stored or transmitted.

Encrypted Virtual Disks

Protect operating systems, applications, and data at rest.

STRATUM protects virtual machine storage with strong encryption, securing operating systems, applications, and data at rest. Each virtual disk remains protected from unauthorized access, helping safeguard sensitive workloads across datacenter, cloud, and edge environments.

STRATUM Security Imperative

Isolation applies to the infrastructure engine itself.

STRATUM can run inside a gVisor sandbox, adding a powerful isolation boundary between the STRATUM container and the Linux host beneath it. That extra layer helps reduce the risk of container escapes, privilege escalation, and multi-tenant exposure while preserving the efficiency and portability of a containerized platform. The result is defense in depth for the entire STRATUM infrastructure engine-hypervisor, storage, networking, and orchestration-not just for an individual application. With secure-by-default execution, runtime monitoring, broad x86 and Arm support, cloud-native deployment, and GPU/CUDA compatibility, STRATUM can bring stronger isolation to security-critical, AI, edge, and regulated environments without giving up the operational simplicity of containers.

Zero Trust, Built Into the Virtual Datacenter

Every workload, session, and connection is an explicit security boundary.

STRATUM treats every workload, session, and connection as an explicit security boundary-not as trusted simply because it sits inside the network. Server isolation, encrypted inter-site fabrics, segmented virtual networks, and tightly controlled console access reduce broad network exposure while keeping each virtual datacenter separated by design. No implicit trust. No flat network. Access only to the infrastructure and sessions that are actually authorized.

Orchestration at Supercomputer Scale

The native Execution Fabric places workloads across heterogeneous infrastructure.

STRATUM builds orchestration directly into its native Execution Fabric. It places compute, memory, GPUs, priorities, resource constraints, accounting, and workload execution across heterogeneous infrastructure without relying on an external scheduler. Workers advertise architecture, CPU, memory, acceleration, site, and other capabilities. STRATUM matches workloads to those resources, maintains execution state and accounting, and continuously reconciles the fabric as infrastructure changes.Workloads can run across mixed x86 and Arm systems, CPU-only nodes, local GPUs, and GPUs delivered through the STRATUM Accelerator Fabric. Architecture and accelerator requirements become placement choices instead of separate infrastructure islands. Authenticated execution channels, health monitoring, worker timeouts, placement constraints, reconciliation, and recovery are built into the platform. The result is resilient orchestration that places each workload on the right resource and scales from a small edge deployment to a distributed compute fabric. STRATUM provides the virtual datacenter-and the execution fabric that operates it at scale.

Federation-ready

Cloud, on-prem, and remote sites stay part of one operating model.

Run across cloud, on-prem, and remote sites without splitting the platform into disconnected islands of control.

Multi-Site Quick Connect

Distributed sites become one virtual infrastructure without a separate control island.

STRATUM connects datacenter, cloud, remote, and edge environments into one unified virtual infrastructure-without the complexity of traditional mesh networking. A lightweight deployment model brings distributed sites together as a single virtual datacenter, making expansion, workload mobility, and remote operations dramatically simpler.

INFRASTRUCTURE IS NO LONGER BACKGROUND

The substrate becomes something operators can see and control.

Missions do not run on intent alone. They run on systems, dependencies, and environments that must be built, understood, and controlled before anything above them can succeed. STRATUM turns that hidden substrate into an operational surface.

The network is the container.

A complete virtual infrastructure, including machines, switches, routers, wiring, and segmentation, can be delivered and scaled through the same operational model as modern software.

Operational visualization before execution.

See the deployment before it ships. Validate topology, templates, and segmentation in an environment built to be understood before it is launched.

The GPU is a first-class citizen.

STRATUM treats GPU-backed workloads as native infrastructure from the ground up, not as a fragile add-on to a legacy virtual stack.

Federation-ready

Run across cloud, on-prem, and remote sites without splitting the platform into disconnected islands of control.

STRATUMOPS: See the Mission, Not Just the Machines

Topology, lineage, health, history, mission context, and blast radius become one operational graph.

STRATUMOPS is infrastructure operations as a living, temporal mission model, not another dashboard full of disconnected metrics. STRATUM scheduler tells STRATUMOPS where computation is running. STRATUMOPS tells it what that computation means. STRATUMOPS fuses scheduler data, VM state, tenants, virtual datacenters (VDC), networks, distributed GPU leases, remote sites, and dependencies into a live operational graph. It does not just show systems connected by lines-it shows ownership, lineage, health, history, mission context, and blast radius. With real-time graph updates, historical topology, mission replay, alerts, workflow automation, and failure-impact analysis, STRATUMOPS can answer the questions traditional infrastructure tools cannot: What is running? Where is it running? What does it depend on? Operational lineage? Who owns it? And what breaks when this asset fails? What systems are affected by this template?