Overview
Virtualization lets one physical machine run many isolated virtual machines, each with its own operating system, by placing a hypervisor between hardware and guests. The hypervisor divides CPU, memory, storage, and network among VMs and prevents them from interfering with each other. It is the foundation that made cloud computing possible.
Type 1 hypervisors run directly on hardware (KVM, VMware ESXi, Xen, Hyper-V); Type 2 run on a host OS (VirtualBox). Modern CPUs have hardware support (Intel VT-x, AMD-V) and cloud providers offload networking and storage to dedicated hardware (AWS Nitro) so VMs run at near-native speed.
One building (physical server) is divided into apartments (VMs), each with its own locks, kitchen, and utilities meter. The building manager (hypervisor) allocates space and keeps tenants from entering each other's homes.
When to use it
- Running multiple OSes or strongly isolated workloads on shared hardware.
- Cloud infrastructure (every EC2 instance is a VM).
- Legacy applications that need a full OS.
- Security isolation stronger than containers.
Where it shows up in interviews
Recognize it when: containers or VMs for untrusted code?
- Design a code execution sandbox (LeetCode runner)
- Design a multi-tenant hosting platform
Where it is used in real software
Custom hardware and a lightweight hypervisor give EC2 near bare-metal performance and strong isolation.
AWS's microVM monitor starts VMs in ~125 ms; it powers Lambda and Fargate.
Most enterprise data centers virtualize servers with vSphere or Hyper-V.
Key terms
- Hypervisor
- Software that creates and runs VMs.
- Type 1 / Type 2
- Bare-metal / hosted hypervisor.
- Guest / host
- Virtual machine OS / physical machine.
- Overcommit
- Allocating more virtual resources than physical ones.
- MicroVM
- Minimal VM optimized for fast startup and density.
How it works, step by step
- 1Hypervisor boots on hardware
Controls CPU virtualization extensions.
- 2VMs are created
With virtual CPUs, memory, disks, and NICs.
- 3Guest OS boots
Believes it has its own hardware.
- 4Hypervisor schedules
Maps vCPUs to physical cores and isolates memory.
- 5Live migration (optional)
Move running VMs between hosts for maintenance.
Isolation technologies
From strongest isolation to lightest
| Technology | Isolation | Startup | Overhead |
|---|---|---|---|
| Bare metal | Physical | Minutes | None |
| Virtual machine | Hardware-virtualized kernel | Tens of seconds | Low-moderate |
| MicroVM (Firecracker) | VM-level | ~125 ms | Very low |
| Sandboxed container (gVisor) | User-space kernel | ~Seconds | Moderate for syscalls |
| Container | Namespaces and cgroups | ms | Minimal |
NOWTechnology: Bare metal | Isolation: Physical | Startup: Minutes | Overhead: None
Running untrusted code (serverless, online judges) usually uses microVMs or sandboxes for safety with near-container speed.
Implementation
resource "aws_instance" "worker" { ami = data.aws_ami.al2023_arm.id instance_type = "m7g.large" # 2 vCPU, 8 GiB, Graviton (ARM) subnet_id = aws_subnet.private_a.id vpc_security_group_ids = [aws_security_group.worker.id] metadata_options { http_tokens = "required" } # IMDSv2 only root_block_device { volume_type = "gp3" volume_size = 30 encrypted = true } tags = { Name = "worker", team = "platform" }}Complexity and performance
With hardware virtualization.
Thousands per host.
Trade-offs
VMs isolate strongly but use more memory and boot slower than containers.
Overcommitting improves utilization but can cause noisy neighbors.
Variants and related techniques
Guests use hypervisor-aware drivers for efficiency (virtio).
VMs inside VMs, used for testing and some CI.
Common mistakes
- Treating VMs as pets.
Fix: Build immutable images and replace VMs instead of patching by hand.
- Using containers alone for untrusted code.
Fix: Add microVM or sandbox isolation.
Interview questions
How would you run untrusted user code safely?
Execute it in short-lived microVMs (Firecracker) or sandboxed containers (gVisor) with no network by default, strict CPU, memory, and time limits, read-only filesystems, and destroy them after each run.
What is a hypervisor?
Software that virtualizes hardware so multiple isolated guest operating systems share one physical machine, scheduling CPU and isolating memory, storage, and network.
Practice problems
| Problem | Difficulty | What it trains |
|---|---|---|
| Compare VM and container isolation for a SaaS | Easy | Trade-offs. |
| Design an online code execution service | Hard | Sandboxing and scaling. |