SERVERS
Many guests, one host
In servers, the hypervisor usually runs directly on the hardware, with no host operating system. NIST says servers are most often virtualised this way.
Compare the layoutsOne machine, several operating systems, each in its own box.
A virtual machine runs a complete operating system on virtual hardware. A thin layer of software called a hypervisor shares out the real processor, memory, disk and network, and keeps each guest to its own resources.
Updated
Compare the layoutsTHE SHORT ANSWER
Software pretends
to be hardware.
Each guest thinks it has its own computer.
The hypervisor makes that true enough to work.
DESKTOPS
A window into another system
On a desktop, the hypervisor usually runs as an app on your normal operating system, so you can use another system alongside your browser and email.
Good habits
SNAPSHOTS
Save the whole state
A snapshot records a running guest's state, including what was in its memory. It lets you pause, resume, or go back to a known good point.
See the historyA QUICK LAYOUT CHECK
Where does the
hypervisor sit?
Pick a kind of full virtualisation described by NIST to see how it is built. The bar shows how much software sits between the guest and the real hardware.
Based on NIST Special Publication 800-125, Guide to Security for Full Virtualization Technologies (2011).
TWO NUMBERS WORTH KNOWING
An old idea,
now everywhere.
Virtual machines began on mainframes
long before the cloud.
12 VMs
Virtual machines on one early research system
In January 1967 production use began on CP-40, a research system on which MIT and IBM researchers worked. Its control program supported 12 virtual machines.
CP-40 · 1967
24 VMs
Its successor doubled that
CP-40 evolved into CP-67, which could support up to 24 virtual machines and a variety of guest operating systems, and influenced VM/370 in 1972.
CP-67 · 1967
Source: SHARE, the IBM user group, on the history of mainframe virtualisation. The idea of a time-sharing computer was proposed by John McCarthy at MIT in 1961.
SAFER VIRTUAL MACHINES
Treat each guest
like a real computer.
NIST's advice for organisations applies at home too: a virtual machine is still a computer, and needs the same care.
Keep every layer updated
Patch the hypervisor, any host operating system and each guest. NIST calls for the same security practices as for physical systems.
Guard your snapshots
Snapshots can hold passwords or personal data from memory, even data never saved to disk, and they are easy to copy around.
Keep a known good image
If a guest is compromised, NIST suggests reverting it to a known good image saved before the problem.
Do not mix critical with casual
NIST warns that putting a critical service on the same host as other services weakens its protection.
VIRTUAL MACHINES IN THE CLOUD
Your server,
someone else's hardware.
Cloud services run many customers' workloads on shared hardware, so separation matters. The UK's National Cyber Security Centre says that if you want to run your own code, you should look for hardware-backed separation with a small attack surface, usually a hypervisor.
The NCSC adds that separation enforced only by software, including some kinds of containers, exposes a much greater attack surface, and should be backed by hardware-backed separation such as a Type 1 hypervisor when strong isolation is needed.
Questions
Questions people ask
What is a virtual machine?
A complete operating system and its applications running on virtual hardware. Several can share one physical computer, each managed and kept separate by a hypervisor.
What is a hypervisor?
The software that controls the flow of instructions between guest operating systems and the real hardware, such as processor, disk, memory and network cards, and keeps each guest to its own resources.
What is the difference between a host and a guest?
The guest is the operating system running inside the virtual machine. The host is the physical computer, or, in hosted virtualisation, the ordinary operating system the hypervisor runs on.
What is a snapshot?
A record of a running guest's state, usually stored as the differences from its image. It lets a guest be paused and resumed without rebooting, and can hold the contents of memory.
Are virtual machines the same as containers?
No. The NCSC says some container techniques rely on separation enforced by software and should only be used for functional separation unless backed by hardware separation such as a hypervisor.
Sources
Where the facts come from
ABOUT THIS NAME
Interested in leasing virtualmachineworld.com?
virtualmachineworld.com is part of the DoodleSale portfolio. It isn't in an auction right now, but you can ask about leasing it.