Virtualization and Containers
Virtualization is the process of presenting a set of computing resources (such as hardware, storage, or operating systems) via a logical abstraction layer, allowing multiple isolated virtual systems to execute on a single physical host.
The Hypervisor: The OS for OSs
To run multiple guest operating systems, we use a Hypervisor (also known as a Virtual Machine Monitor or VMM). The VMM abstracts the physical hardware and coordinates access to resources like CPU cycles, memory blocks, and network interfaces.
Type 1: Bare-Metal Hypervisors
A Type-1 hypervisor runs directly on the bare metal host hardware without an underlying host operating system. It possesses the highest privilege level and directly manages resources.
- Examples: VMware ESXi, Microsoft Hyper-V, and Xen.
- Performance: Highly efficient due to the lack of an intermediate host OS layer.
Type 2: Hosted Hypervisors
A Type-2 hypervisor runs as an application process inside a standard host operating system. Hardware access is translated through the host OS’s kernel.
- Examples: Oracle VirtualBox, VMware Workstation, and QEMU.
- Performance: Overhead is higher because every instruction virtualized must go through both the VMM and the host OS.
For example, a developer running QEMU to emulate an x86 guest OS on an ARM host uses a command block to initiate the virtual hardware loop:
# Example CLI: Booting a guest OS VM using QEMU with KVM hardware-acceleration
qemu-system-x86_64 \
-enable-kvm \
-m 2048 \
-smp 2 \
-drive file=ubuntu_guest.qcow2,media=disk,format=qcow2 \
-net nic -net user
The -enable-kvm flag directs QEMU to leverage the Linux Kernel-based Virtual Machine module, bypassing software emulation in favor of direct hardware execution where possible.
Virtual Machines vs. Containers
Operating system virtualization can occur at the hardware level (Virtual Machines) or the operating system level (Containers).
Virtual Machines (VM)
A VM virtualizes the underlying physical hardware. Every VM requires a complete guest operating system, including its own kernel, device drivers, and system libraries.
- Isolation: High. The guest OS runs in its own address space, isolated by the hardware boundary.
- Overhead: High footprint. Allocates dedicated memory blocks and disk space.
Containers
A container virtualizes the operating system. All containers run on a single host machine and share the host operating system’s kernel. Isolation is achieved via host kernel features: namespaces (isolating process trees, network adapters, and mounts) and control groups (cgroups) (limiting resources like RAM and CPU usage).
- Isolation: Moderate. Kernel sharing means kernel vulnerabilities can compromise the host.
- Overhead: Low. Startup times are measured in milliseconds rather than minutes.
For example, a developer packages a container using a Dockerfile that specifies only the dependencies needed for the application, sharing the host Linux kernel:
# Example: Dockerfile demonstrating OS-level virtualization configuration
FROM alpine:3.19
RUN apk add --no-cache python3
WORKDIR /app
COPY server.py /app/
EXPOSE 8080
CMD ["python3", "server.py"]
Build and execute the isolated application using Docker commands:
# Build the container image representing the user-space environment
docker build -t micro-service:v1 .
# Execute the container using resource limits enforced by cgroups
docker run -d --name my-app -p 8080:8080 --memory="512m" --cpus="1.0" micro-service:v1
WSL2: The Best of Both Worlds
Windows Subsystem for Linux 2 (WSL2) changes the approach to running Linux on Windows by shifting from system call translation to direct execution.
WSL2 runs a real Linux kernel inside a lightweight virtual machine. This VM is managed by a subset of the Type-1 Hyper-V hypervisor.
- Filesystem Performance: Managed via a virtual disk (ext4 inside a VHDX file).
- Integration: System startup is optimized to boot in under a second, dynamically reclaiming host RAM when idle.
For example, checking the operational state of WSL2 instances from the Windows terminal:
# Example: Query WSL2 status and running distributions from Windows CLI
wsl --list --verbose
# Accessing files inside the guest Linux system using the 9P protocol mount
cd \\wsl$\Ubuntu-22.04\home\developer\projects
The Cloud Revolution
Cloud computing relies on hypervisors to achieve multi-tenancy: running workloads for different customers on the same physical processor without cross-contamination.
Serverless Computing (FaaS)
In a Function-as-a-Service (FaaS) model, such as AWS Lambda, virtual instances are transient. The host infrastructure utilizes microVMs (e.g., AWS Firecracker) that leverage KVM to start execution in under 5 milliseconds. The function executes, responds, and the container is immediately torn down.
For example, a stateless calculation function is executed inside a serverless environment:
# Example: Stateless serverless handler executed within a transient microVM
def lambda_handler(event, context):
principal = float(event.get("principal", 1000.0))
rate = float(event.get("rate", 0.05))
periods = int(event.get("periods", 12))
# Calculate simple compound interest without storing state
accrued_value = principal * ((1.0 + rate) ** periods)
return {
"statusCode": 200,
"body": {
"result": accrued_value
}
}
Why is it so fast now?
Early virtualization (such as binary translation) was slow because the guest OS was unaware it was virtualized. Standard CPU architectures did not allow intercepting sensitive kernel operations without major performance penalties.
Hardware-Assisted Virtualization
Modern CPUs feature instruction set extensions (Intel VT-x and AMD-V) designed to handle virtualization in hardware. The CPU introduces a new execution state: Guest Mode. When the guest OS executes a sensitive instruction (e.g., changing page tables), the CPU traps the action and performs a VM-Exit, returning control back to the hypervisor in Host Mode.
The state of a guest execution thread is managed through a memory block called the Virtual Machine Control Structure (VMCS) in Intel architectures, or the Virtual Machine Control Block (VMCB) in AMD architectures.
// Example: Conceptual structure of Intel VT-x Virtual Machine Control Structure (VMCS)
struct vmcs_layout {
uint32_t revision_id;
uint32_t abort_indicator;
/* Guest-State Area */
uint64_t guest_cr3; // Guest page directory address
uint64_t guest_rip; // Guest instruction pointer
uint64_t guest_rsp; // Guest stack pointer
uint16_t guest_cs_selector;
/* Host-State Area */
uint64_t host_cr3; // Host page directory address
uint64_t host_rip; // Host handler entry point
uint64_t host_rsp; // Host stack pointer
};
Developers can check if their processor supports hardware virtualization by inspecting CPU flags:
# Example: Query CPU flags for Intel VT-x (vmx) or AMD-V (svm)
grep -E --color=always "(vmx|svm)" /proc/cpuinfo
If the command returns output, the hardware supports hardware-assisted virtualization.
Which of the following describes a Type-1 hypervisor?
Which kernel features are primarily responsible for resource restriction and namespace isolation in containers?
CPU Virtualization Detection
# Query CPU information flags to detect Intel virtualization support grep -E "" /proc/cpuinfo
References & Further Reading
- Silberschatz, A., Galvin, P. B., & Gagne, G. (2018). Operating System Concepts (10th ed.). Wiley. (Chapter 16: Virtual Machines).
- Tanenbaum, A. S., & Bos, H. (2015). Modern Operating Systems (4th ed.). Pearson. (Chapter 7: Virtualization and the Cloud).
- Popek, G. J., & Goldberg, R. P. (1974). Formal requirements for virtualizable third generation architectures. Communications of the ACM, 17(7), 412-421. ACM Link.
- Soltesz, S., Pötzl, H., Fiuczynski, M. E., Bavier, A., & Peterson, L. (2007). Container-based operating system virtualization: a scalable, high-performance alternative to hypervisors. ACM SIGOPS Operating Systems Review, 41(3), 275-287. ACM Link.
- Rosenblum, M., & Garfinkel, T. (2005). Virtual machine monitors: Current technology and future trends. IEEE Computer, 38(5), 39-47. IEEE Link.