Part I · How it works
7.4 Virtual machines and hypervisors
alsovirtual machinevirtual machinesvmvmshypervisorkvmqemuvirtualboxvmwarevirtiowslwsl2nested virtualizationhardware virtualizationvt-xamd-v
TL;DR
- A virtual machine runs a whole operating system, kernel included, on virtual hardware. The hypervisor shares the real CPUs, RAM and devices between machines.
- CPUs help directly (Intel VT-x, AMD-V, ARM's EL2): guest code runs at full speed, and only some operations go to the hypervisor.
- On Linux, KVM turns the kernel into a hypervisor; QEMU provides the virtual devices around it.
systemd-detect-virt # none, kvm, vmware, docker…
grep -cw -E 'vmx|svm' /proc/cpuinfo # 0: no hardware virtualization
ls -l /dev/kvm # exists: this machine can run KVM guests
On your machine
$ atfq 7.4 Here no container or virtual machine detected Isolated none: the host's namespaces (pid, user, uts, ipc, cgroup, time) Can run VMs with KVM (/dev/kvm) · containers with Docker Overlays 1 overlay mount: container layers, usually Arch x86_64, made by Intel Level x86-64-v4: programs built for this level or below run here Has SSE 4.2, AVX2 (256-bit vectors), AVX-512, AES instructions, SHA instructions, virtualization (Intel VT-x) Flags 145 in all, in /proc/cpuinfo
An example: Alice's laptop, one of the test machines. In your terminal, this block shows your own machine, read live.
Pitfalls
- No
/dev/kvm: virtualization is off in the firmware settings, or you're already in a VM without nested virtualization. - Emulated disks and network cards are slow; virtio devices, designed for VMs, are what to pick.
- A guest's clock and CPU numbers are what the hypervisor shows: CPU
"steal" time in
top(st) is time the host gave to others. - WSL 2, Docker Desktop and OrbStack are Linux virtual machines; files shared with the host cross a slower boundary.
Deep dive 2 questions
How does a CPU run a guest kernel safely?
Hardware virtualization adds a mode below the guest kernel. The guest runs its own kernel code natively, but chosen events (touching certain registers, some instructions, device access) exit to the hypervisor, which handles them and resumes the guest. A second level of page tables translates guest memory to host memory in hardware, so guest page tables work untouched.
Type 1 or type 2?
Type 1 hypervisors run on the bare machine (Xen, VMware ESXi, Hyper-V);
type 2 run as programs on an operating system (VirtualBox). KVM blurs it:
a module of an ordinary Linux kernel, with each VM an ordinary QEMU
process you can see in top.