3.3.1. Virtualization Concepts (Hypervisors, VMs, Containers)

💡 First Principle: A hypervisor is the core software that creates and manages virtual machines, enabling multiple, isolated operating systems to run concurrently on a single physical host.

Scenario: You need to set up a server that will host several production virtual machines for different departments. For maximum performance and stability, you choose a Type 1 (bare-metal) hypervisor like VMware ESXi, which runs directly on the server hardware.

Virtualization allows you to get more value out of your physical hardware.

• Hypervisor: The software that enables virtualization.
  • Type 1 (Bare-metal): Runs directly on the host's hardware. Offers the best performance. Examples: VMware ESXi, Microsoft Hyper-V. Used in data centers.
  • Type 2 (Hosted): Runs as an application on top of an existing OS (like Windows or macOS). Easier to set up and use. Examples: VMware Workstation (Windows and Linux hosts), Oracle VirtualBox (free and open source). Used for desktop virtualization.
• Virtual Machine (VM): A complete, isolated guest operating system running on a hypervisor. Each VM has its own virtualized hardware (CPU, RAM, storage, network).
  • Creating a VM on a Type 2 hypervisor (order matters): (1) install the hypervisor on the host operating system; (2) create the VM definition, choosing CPU count, RAM, and a virtual disk; (3) attach the guest OS installation ISO to the VM's virtual optical drive; (4) power on the VM and complete the guest OS installer.
  • Use Cases: Server consolidation, testing and development, running legacy applications.
• Containers: A more lightweight form of virtualization where the application and its dependencies are packaged together, but they share the host OS kernel.
  • Benefit: Containers are much faster to start and use fewer resources than VMs.
• VDI (Virtual Desktop Infrastructure): Hosting desktop operating systems on a centralized server. Users connect to their virtual desktops from thin clients or other devices.
• Hypervisor Role & Hardware Support: The hypervisor allocates the host's physical CPU, RAM, storage and network to each guest and keeps the guests isolated from one another. The host CPU must support hardware-assisted virtualization (Intel VT-x / AMD-V), which is often disabled by default and has to be enabled in UEFI/BIOS.
• Virtual Network Modes:
  • Bridged: The VM gets its own IP address on the physical network and appears to the router as a separate device.
  • NAT: The VM shares the host's IP address when it reaches the external network.
  • Host-only: The VM can talk to the host and to other VMs on that host, but not to the external network.
  • Isolated (no networking): The VM is cut off from everything, including the host.
• Virtual Disks & Images: A thin-provisioned disk uses physical space only as the VM writes data, up to its maximum size; a thick-provisioned disk reserves its full size up front. A virtual appliance is a pre-built VM image (commonly distributed as an OVA/OVF package) with the operating system, and often an application, already installed and ready to import; an ISO file, by contrast, is an optical-disc image used to install an OS from scratch.
• Snapshots & Clones: A snapshot saves a VM's point-in-time state so you can roll back after a change; it is stored with the original VM's disk files, not as an independent copy. A full clone is a completely independent copy of a VM; a linked clone shares the parent's virtual disk and depends on it (faster and smaller to create, but not independent).
• Device Passthrough: USB passthrough attaches a physical USB device on the host to a guest VM. GPU passthrough gives a VM direct access to the host's physical GPU instead of an emulated display adapter.
• Security Risk: The main hypervisor-specific risk is VM escape, where a guest breaks out of its isolation to reach the host or other guests. Keep the hypervisor patched.

Isolation and performance: Running a legacy OS such as Windows XP in a VM isolates the insecure system from the host, and its virtual network can be restricted (host-only or no network) to keep it off the rest of the network. Virtual disk I/O is limited by the physical drive that holds the virtual disk file, so place it on an SSD; adding vCPUs or changing the virtual network mode does not speed up disk access. A template is a master VM image used to deploy many identical VMs, and neither a template nor a snapshot replaces a backup stored separately.

⚠️ Common Pitfall: Not allocating sufficient physical resources (CPU, RAM, storage) to the host machine. Running multiple VMs can be very resource-intensive, and a lack of resources will lead to poor performance for all of them.

Key Trade-Offs:

• Performance (Type 1) vs. Ease of Use (Type 2): Type 1 hypervisors are for production server environments. Type 2 hypervisors are for individual desktop use cases.

Reflection Question: Why are containers considered more "lightweight" and efficient than traditional virtual machines?