 | | Matt Harris | | Infrastructure Lead Engineer |
|
| |
|
|
|
|
| Looking for something? | |  | | We build and deliver end‑to‑end IT solutions. |
|
|
|
|
|
|
On Tue, Jan 19, 2021 at 3:27 PM Brandon Martin <
lists.nanog@monmotha.net> wrote:
On 1/19/21 12:56 PM, Bryan Holloway wrote:
>
> I'm very curious about your assertion:
>
> Is nested virtualization really a thing?
>
> I mean, I'm not exactly trying to render Pixar's latest movie ... just
> trying to push some bits around (light web-sites, some e-mail ...)
>
> It just seems inherently prone to issues.
>
> Could you back this up with any white-papers or documentation on the
> subject? I'm genuinely interested ...
With KVM, if you have a recent kernel and qemu, it pretty much "just
works" on supported hardware. AFAIK Xen supports "Xen on Xen", too, but
I haven't used it and don't know much about it.
The use case is pretty much exactly this. You (the product consumer)
are handed a product that amounts to a virtual machine on somebody
else's $BIGBOX. You want to deploy multiple virtual machines where you
have direct control over their lifecycle, configuration, etc. and can
bring in additional I/O resources, etc. at the hypervisor level
(consider that, with KVM, the Linux kernel basically IS the hypervisor).
So, you run one or more VMs inside the top level VM that you're handed.
It's full of lots of little wiggles and can be a pain to maintain if you
have visibility into both levels of the equation, but it does seem to
work and is surprisingly performant.
Nested virtualization is, however, pretty widely deployed for production workloads. Take for instance Juniper's vSRX and vMX products. Both require nested virtualization support as they run a Wind River Linux instance with KVM directly on your virtual machine which may be on vmware, KVM, Hyper-V, etc, and then Junos running nested within the WRL KVM virtual machine. So it's not like this is something that's uncommon or not trustworthy, lots of us are doing it every day with no serious problems and entirely acceptable performance on modern hardware. I run a decent fleet of vSRX's on Hyper-V and it works well. YMMV as always based on your own platform, but I don't think that nested virtualization is something that we should be steering clear of at this point.
- mdh