Skip to content

Compute: VM-backed instances (QEMU/KVM) #3

Open

Description

@drk1rd

EC2 instances currently run as resource-limited containers on Docker: they share the host kernel and their disk is the container's writable layer. This tracks VM-backed instances (full kernels, real disks, stronger isolation) alongside containers, selectable per image or instance type.

  • Hypervisor driver: QEMU/KVM on Linux, QEMU with Hypervisor.framework (hvf) on macOS; clear error when neither is available
  • Instance types enforced as real vCPU and memory limits
  • Boot cloud images (Ubuntu, Debian, Amazon Linux) with their own kernels
  • cloud-init: key pairs, user data, hostname
  • EBS volumes as virtual disks: attach/detach, snapshots, enforced sizes
  • VMs join VPC subnets with private IPs, same as container instances
  • Instance metadata (IMDS) reachable from VMs, including role credentials
  • Serial/VNC console in the web console; stop, start and reboot act on the VM
  • Containers stay available as a lightweight option
  • CloudWatch metrics collected from VMs
  • homecloud backup includes VM disks
  • Same EC2 API, CLI, Terraform and console, so existing tooling keeps working

Activity

  1. self-assigned this
    on Jan 12, 2025
  2. changed the title [-]Compute (EC2) (switch to KVM)[/-] [+]Compute: VM-backed instances (QEMU/KVM)[/+] on Sep 29, 2026
  3. drk1rd commented on Sep 29, 2026

    @drk1rd
    MemberAuthor

    Updated for v0.1.0: container instances, the EC2/VPC AWS API and the instance metadata service are in place, so VM-backed instances can plug into the same API. Still planned.

  4. drk1rd commented on Sep 30, 2026

    @drk1rd
    MemberAuthor

    Stage 1 is in #82: VM AMIs for Ubuntu 24.04 and Debian 12, QEMU in a container on the VPC network (passt), KVM or emulation, cloud-init, root disks, lifecycle, console output, security groups, CI with KVM.

    Stage 2:

    • Extra EBS volumes as virtio disks (attach/detach)
    • Snapshots and CreateImage for VM disks
    • Backups: include the base cloud image (or flatten the overlay) so a restored VM boots
    • Narrow seccomp profile instead of seccomp=unconfined for VM containers
    • Browser terminal and run-command (SSH or guest agent)
    • Guest-level CloudWatch metrics
    • macOS: hvf acceleration
    • Console: VM badge / virtualization column
    • User-mode network fallback: apply security group changes without waiting for a rebuild
  5. drk1rd commented on Oct 7, 2026

    @drk1rd
    MemberAuthor

    VM-backed instances shipped in #82 (stage 1 + stage 2: volumes, snapshots, images, backups, run-command, serial terminal, guest metrics, console choice). Open follow-ups: passt on Ubuntu 24.04 (#90), macOS native acceleration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

computeEC2, instances and VMsenhancementNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions