novavm

NovaVM runs OCI container images inside real KVM virtual machines with
eBPF observability and OPA policy enforcement.

Features:
- KVM isolation — each sandbox runs in its own VM
- 2s cold boot / 69ms warm boot with L3 snapshots
- OCI images from Docker Hub, GHCR, Quay.io
- 4-level caching (L1 blob, L2 rootfs, L3 snapshot, L4 pool)
- eBPF observability (host + guest kernel probes)
- OPA policy (admission + runtime enforcement)
- REST + gRPC APIs
- Python and TypeScript SDKs (zero dependencies)

Quick start:
sudo nova setup
sudo nova serve --config /etc/nova/nova.toml
nova run nginx:alpine --name web