A survey of traditional machine virtualization. See the catalog post for the structured outline, or browse the chapters and case studies directly below.
Rust separation-kernel Type-1 hypervisor from Syswonder, descended from Jailhouse and RVM1.5. Static partitioning of hardware into isolated zones, no CPU scheduler, no overcommit, virtio trampoline for paravirtual I/O.
Rust Type-1 hypervisor built as an application of the ArceOS unikernel: vCPUs are scheduled as ArceOS tasks, and the hypervisor is a thin shell over a stack of arceos-hypervisor crates (axvm, axvcpu, axaddrspace, axdevice, axhvc).
The canonical commercial monolithic Type-1 hypervisor. VMkernel as a specialized OS holding scheduler, storage, network, drivers, and per-VM vmm worlds; lineage from Disco (1997) to Workstation (1999) to ESX (2001); inventor of memory overcommit (TPS, ballooning, hypervisor swap).
The canonical Type-2/hosted hypervisor: a Linux kernel module exposing the /dev/kvm ioctl ABI to userspace VMMs (QEMU, Firecracker, crosvm, cloud-hypervisor). The hosted shape pushed to its production conclusion — thin kernel hot path, everything else in userspace.
The universal machine emulator and userspace half of every major Type-2 stack: TCG binary translator, QOM/qdev frameworks, accelerator interface, block layer, live migration, QMP. Why QEMU is best read as composable frameworks, not a hypervisor.
Oracle’s cross-platform desktop Type-2 hypervisor. Ships its own kernel module (vboxdrv) per host OS family rather than using KVM; read through the lens of the portability tax that this ‘be your own kernel module’ choice imposes.
AWS’s Rust microVM (~50 KLoC) on KVM, the production substrate for AWS Lambda and Fargate. The reference for what a VMM looks like when its requirements are aggressively bounded; jailer + Rust + minimal device set as defense in depth.
The container-VM hybrid: an OCI runtime placing each container or Kubernetes pod inside a microVM (QEMU / Firecracker / cloud-hypervisor / Dragonball) running a real Linux kernel. Hardware-grade isolation with container UX; substrate for Confidential Containers.
The canonical OS-level virtualization stack: containers as host processes restricted by namespaces, cgroups, seccomp, capabilities, OverlayFS, and netfilter. Full walk from Docker Engine to containerd to runc to kernel features.
Google’s userspace-kernel sandbox: Sentry, a Go reimplementation of the Linux syscall ABI, services guest syscalls intercepted via KVM / ptrace / systrap platforms. Production isolation behind App Engine, Cloud Run, and Cloud Functions.