Virtualization

One physical server with 64 cores is idle 95% of the time. Electricity is burned, cooling works, and the CPU is almost asleep. Virtualization turns one server into dozens of isolated machines, each with its own OS, running on the same hardware. This is a revolution that changed the industry: from huge data centers to cloud giants like AWS, Google Cloud.

• **AWS EC2 - the foundation of the cloud.** Amazon rents out computing power. On one physical server, VMs of dozens of clients run, isolated and secure. Without virtualization, clouds would be impossible - the economics wouldn't work.
• **Docker changed development.** "It works on my machine!" - the DevOps nightmare. With Docker, the application + dependencies are packaged into a container that runs the same way on a laptop, staging, or production. Netflix deploys thousands of microservices in containers daily.
• **Security through isolation.** Google Chrome runs each tab in an isolated process (sandbox). An exploit in one tab won't affect others. This is process-level virtualization - protection through isolation.

Цели урока

• Distinguish Type 1 (bare-metal: ESXi, Xen, KVM) from Type 2 (hosted: VirtualBox, Parallels)
• Know hardware-assisted virtualization: Intel VT-x and AMD-V for VMexit/VMresume
• Compare VM (full OS) vs container (shared kernel) by cost, isolation, and density
• Understand paravirtualization: guest OS aware of being virtualized (Xen PV)
• Explain live migration: moving a running VM between hosts without downtime

The concept of virtualization

**Virtualization** is a technique for creating a virtual version of a resource: a computer, an operating system, storage device, or network resource. Instead of one physical server, we get several isolated virtual machines (VM).

**Key idea:** a virtual machine thinks it is running on real hardware. In reality, between the VM and the processor is a **hypervisor** - a program that emulates or virtualizes the hardware.

**Why virtualization:** - **Isolation:** a failure in one VM does not affect others - **Utilization:** one server → 10+ VMs instead of idling - **Flexibility:** can run Linux, Windows, BSD on one hardware - **Migration:** VMs are easily transferred between servers - **Savings:** fewer physical servers = less energy, cooling

**History of virtualization:** the idea was born in the 1960s at IBM for mainframes. The goal was to give each user "their own computer" without buying 100 physical machines. The **VM/370** technology (1972) allowed running multiple copies of the OS on one mainframe.

Virtualization was revived in the 2000s with VMware, KVM, Xen. The driver: servers got oversized for any one workload. A 64-core server running a website at 2% CPU is waste - virtualization carves it into many VMs that share the hardware.

Hypervisors: Type 1 vs Type 2

**Hypervisor (hypervisor, VMM - Virtual Machine Monitor)** is a program that creates and manages virtual machines. There are two types of hypervisors with radically different architectures.

**Type 1 (Bare Metal):** - Runs **directly on hardware**, without a host OS - Examples: VMware ESXi, Microsoft Hyper-V, Xen, KVM - Used in data centers, clouds **Type 2 (Hosted):** - Runs **on top of a regular OS** (Windows, macOS, Linux) - Examples: VMware Workstation, VirtualBox, Parallels Desktop - Used by developers, for testing

**Type 1 (Bare Metal) - professional level:** The hypervisor loads as an operating system, gaining full control over the hardware. No intermediate OS - minimal overhead. **VMware ESXi** occupies only ~150 MB, but manages terabytes of RAM and hundreds of cores.

**KVM (Kernel-based Virtual Machine)** - an interesting hybrid. Technically it's Type 1, but it works as a Linux kernel module. Linux turns into a hypervisor! Used in Google Cloud, OpenStack.

**Type 2 (Hosted) - for development and testing:** The hypervisor runs as a regular program in the host OS. Convenient for developers: a Windows VM can run on macOS to test an application. But slower due to double overhead.

**Interesting facts:** - **Xen** was used by Amazon EC2 until 2017, then switched to KVM (Nitro System) - **Hyper-V** is built into Windows 10 Pro/11 Pro - a Linux VM can run without third-party programs - **Apple Hypervisor Framework** - built-in Type 1 hypervisor in macOS (used by Parallels, Docker Desktop)

**Nested virtualization** - VM inside a VM. For example, running VirtualBox inside a VMware VM. Slow, but useful for testing hypervisors themselves. Requires support from the CPU and hypervisor.

Hardware virtualization

In the early 2000s, virtualization was slow - the hypervisor intercepted every guest OS instruction and emulated it. **Intel VT-x (2005)** and **AMD-V (2006)** added hardware support for virtualization in processors, speeding up VMs by 10-100 times.

**Problem without hardware support:** x86 processors have privileged instructions (access to I/O ports, memory management) that can only be executed in kernel mode (Ring 0). But the guest OS in a VM also wants to be in Ring 0! Conflict.

**Binary Translation (old VMware method):** The hypervisor scans the guest OS code, finds privileged instructions, **rewrites them on the fly** into safe calls. Slow, but works without CPU support.

**Paravirtualization (Xen):** The guest OS is **modified** - instead of privileged instructions, it calls hypercalls (similar to syscalls, but to the hypervisor). Faster than binary translation, but requires changes in the guest OS.

**Intel VT-x / AMD-V (Hardware-Assisted Virtualization):** The processor adds a new ring **Ring -1** for the hypervisor. The guest OS operates in true Ring 0, but the processor automatically intercepts critical operations and passes them to the hypervisor. No modifications to the guest OS are required!

**Extended Page Tables (EPT) / Nested Page Tables (NPT):** Before EPT, the hypervisor manually translated addresses: guest virtual → guest physical → host physical. With EPT, the processor does this in hardware, in **one memory access**.

**Hardware Virtualization Technologies:** **Intel:** - VT-x: CPU virtualization - EPT: memory virtualization - VT-d: I/O virtualization (direct VM access to PCI devices) **AMD:** - AMD-V: CPU virtualization - NPT (RVI): memory virtualization - AMD-Vi (IOMMU): I/O virtualization

Hardware virtualization has transformed VMs from a "slow toy" into a production-ready technology. Modern VMs operate with an overhead of only 2-10% compared to a native OS.

Containers vs Virtual Machines

**Containers (Docker, Podman)** - are a lighter form of virtualization. Instead of emulating an entire machine, containers isolate processes at the operating system level, sharing a single kernel.

**Key difference:** VMs emulate hardware (each VM has its own kernel), containers share the host's kernel, isolating processes through **namespaces** and **cgroups**.

**VM vs Containers:** **Virtual Machines:** - ✅ Full isolation (different OS, kernels) - ✅ More secure (hypervisor - additional barrier) - ✅ Can run Windows on a Linux host - ❌ Heavy (gigabytes of disk, hundreds of MB RAM) - ❌ Slow start (minutes) **Containers:** - ✅ Lightweight (megabytes, tens of MB RAM) - ✅ Fast start (milliseconds) - ✅ Portability (one image works everywhere) - ❌ Share host kernel (only Linux containers on Linux) - ❌ Weaker isolation (kernel vulnerability affects all containers)

**Linux Namespaces** - a resource isolation mechanism. Each container gets its own system view:

**Control Groups (cgroups)** - container resource limitation:

**When to use VMs, when containers?**

**Use VMs when:** - Different OS needed (Windows + Linux) - Maximum isolation required (security, compliance) - Legacy applications with kernel dependencies - Long-lived stateful services **Use containers when:** - Microservice architecture - CI/CD - fast deployments - Stateless applications - High density needed (100+ containers on a host)

**Future:** technologies converge. **Kata Containers** run containers in lightweight VMs (microsecond startup). **Firecracker** (AWS) - micro-VM in 125ms. **gVisor** (Google) - userspace kernel for containers. The line between VMs and containers is blurring.

Key ideas

• **Virtualization creates the illusion of multiple computers on one piece of hardware.** VMs think they are running on real CPU/RAM/disk, but the hypervisor divides resources among them. This provides isolation, high utilization, flexibility.
• **Type 1 (bare metal) vs Type 2 (hosted) hypervisors.** Type 1 runs directly on hardware (ESXi, KVM) - maximum performance for production. Type 2 runs on top of a host OS (VirtualBox) - convenient for development, but slower.
• **Hardware virtualization (VT-x/AMD-V) accelerated VMs by 10-100 times.** CPUs added Ring -1 for the hypervisor, EPT/NPT for memory translation. The guest OS runs in the real Ring 0, the processor automatically intercepts critical operations.
• **Containers vs VMs - different goals.** VMs virtualize hardware (full isolation, heavy), containers isolate processes (lightweight, fast, but share the kernel). VMs are for legacy and security, containers are for microservices and CI/CD.

Related topics

Virtualization is related to many areas of Computer Science and systems engineering:

• Memory management — The hypervisor manages physical memory, creating the illusion of independent RAM for each VM. EPT/NPT provide hardware translation of guest physical addresses into host physical ones.
• Processes and scheduling — A hypervisor is a scheduler for VMs: it distributes CPU time among virtual machines, much as an OS does among processes.
• Containers and isolation — Linux namespaces and cgroups are the process-isolation mechanisms underlying Docker. A VM alternative for cloud-native applications.
• Cloud computing — AWS, Google Cloud, and Azure are built on virtualization. IaaS (Infrastructure as a Service) provides VMs on demand.

Вопросы для размышления

• Why are cloud providers migrating from Xen to KVM (AWS Nitro), even though both are Type 1 hypervisors? What advantages does KVM offer?
• A deployment requires running 1000 microservices. Calculate resources: VMs (1 GB RAM each) vs containers (50 MB each). What savings are there?
• Docker containers share the host kernel. What happens if a critical vulnerability is found in the kernel? How does this affect the security of containerized applications?

Связанные уроки

• os-08-virtual-memory — Nested paging is virtualization of virtual memory
• os-02-processes — A VM is to an OS what a process is to a program - an isolated context
• os-19-containers — Containers are a lighter alternative to full virtualization
• arch-10-virtual-memory