{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"platform/virtual-machine","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/platform/virtual-machine/","da":"https://cmaintz.github.io/tech-atlas/da/terms/platform/virtual-machine/"},"term":{"en":"Virtual machine","da":"Virtuel maskine"},"aka":{"en":["VM"],"da":["VM"]},"domain":["platform"],"cluster":"cloud","layer":"infrastructure","status":"current","era":1967,"summary":{"en":"A whole computer made in software, with its own operating system, running side by side with others on one physical machine.","da":"En hel computer lavet i software med sit eget styresystem, der kører side om side med andre på én fysisk maskine."},"body":{"formal":{"en":"A software copy of a complete computer - processor, memory, disk and network card - created by a hypervisor; it runs its own full operating system, kept apart from the other virtual machines on the same hardware.","da":"En softwarekopi af en hel computer - processor, hukommelse, disk og netkort - skabt af en hypervisor; den kører sit eget fulde styresystem, adskilt fra de andre virtuelle maskiner på samme hardware."},"plain":{"en":"Like flats in one building - each has its own front door, kitchen and bathroom, even though they share the same foundations.","da":"Som lejligheder i én ejendom - hver har sin egen hoveddør, sit eget køkken og badeværelse, selvom de deler samme fundament."},"inPractice":{"en":"The IT operations manager at a water utility runs the payroll system, the file server and a test environment as three virtual machines on one large server, each with its own Windows or Linux.","da":"Den IT-driftsansvarlige på et vandværk kører lønsystemet, filserveren og et testmiljø som tre virtuelle maskiner på én kraftig server, hver med sin egen Windows eller Linux."},"whyItMatters":{"en":"It is the basic building block of most cloud services; strong separation between machines is what lets strangers safely share the same hardware.","da":"Den er den grundlæggende byggesten i de fleste cloudtjenester; stærk adskillelse mellem maskinerne er det, der gør, at fremmede trygt kan dele den samme hardware."}},"deepDive":{"en":"A VM is defined by a virtual hardware specification (vCPU count, memory size, virtual devices), firmware (legacy BIOS or UEFI, increasingly with Secure Boot and a virtual TPM) and one or more disk images in formats such as VMDK, VHDX, qcow2 or raw, which can be packaged for exchange with the DMTF's Open Virtualization Format (OVF). Virtual devices are either fully emulated (an Intel e1000 network card, an IDE controller), which works with unmodified guests but is slow, or paravirtualised (virtio-net and virtio-blk under KVM, VMXNET3 and PVSCSI under VMware), where the guest runs drivers that know they are virtualised. Each vCPU is a schedulable entity on the host, so CPU can be overcommitted; memory can be overcommitted too, through ballooning, host swapping or page sharing, though VMware disabled transparent page sharing between VMs by default in 2014 because of side-channel concerns.\n\nLifecycle operations are where VMs differ most from physical servers. Snapshots record a delta disk (and optionally memory state) from a point in time; they are not backups, because they depend on the base disk and degrade performance when kept for long. Cloning from a template duplicates identity material such as SSH host keys and machine identifiers unless the image is generalised (sysprep on Windows, cloud-init or machine-id regeneration on Linux). Live migration, described by Clark et al. in 2005 and sold as vMotion, iteratively pre-copies memory pages while the VM runs and pauses it only briefly to transfer the last dirty pages and CPU state.\n\nIsolation between VMs is only as strong as the hypervisor and the CPU's side-channel mitigations, but it is structurally stronger than between containers, which share one host kernel. VM artefacts are sensitive in themselves: a disk image or memory snapshot of a domain controller lets an attacker extract the Active Directory database and keys offline, so access to storage and the hypervisor console must be treated as tier-0. VM sprawl leaves forgotten, unpatched machines on the network. Confidential computing (AMD SEV-SNP, Intel TDX) encrypts VM memory with keys the hypervisor cannot read, reducing trust in the host operator.\n\nTwo naming overlaps cause confusion. A system VM, emulating a whole machine, is not a process VM such as the JVM or the .NET CLR, which runs one program in a language runtime. And in cloud terminology an \"instance\" is simply a VM of a predefined instance type, sometimes on dedicated or bare-metal hosts, and nested virtualisation lets a VM itself host further VMs.","da":"En VM er defineret af en virtuel hardwarespecifikation (antal vCPU'er, hukommelse, virtuelle enheder), firmware (klassisk BIOS eller UEFI, i stigende grad med Secure Boot og en virtuel TPM) og et eller flere diskimages i formater som VMDK, VHDX, qcow2 eller raw, som kan pakkes til udveksling med DMTF's Open Virtualization Format (OVF). Virtuelle enheder er enten fuldt emulerede (et Intel e1000-netkort, en IDE-controller), hvilket virker med uændrede gæster, men er langsomt, eller paravirtualiserede (virtio-net og virtio-blk under KVM, VMXNET3 og PVSCSI under VMware), hvor gæsten kører drivere, der ved, at de er virtualiserede. Hver vCPU er en enhed, som værten planlægger, så CPU kan overbookes; hukommelse kan også overbookes via ballooning, swapping på værten eller deling af sider, dog slog VMware i 2014 deling af sider mellem VM'er fra som standard på grund af risikoen for sidekanaler.\n\nDet er i livscyklussen, at VM'er adskiller sig mest fra fysiske servere. Snapshots gemmer en deltadisk (og eventuelt hukommelsens tilstand) fra et tidspunkt; de er ikke backup, fordi de afhænger af basisdisken og forringer ydelsen, hvis de bliver liggende længe. Kloning fra en skabelon kopierer identitetsmateriale som SSH-værtsnøgler og maskin-id'er, medmindre imaget er generaliseret (sysprep på Windows, cloud-init eller ny machine-id på Linux). Live migration, beskrevet af Clark m.fl. i 2005 og solgt som vMotion, kopierer iterativt hukommelsessider, mens VM'en kører, og sætter den kun kortvarigt på pause for at overføre de sidste ændrede sider og CPU-tilstanden.\n\nIsolationen mellem VM'er er kun så stærk som hypervisoren og CPU'ens afhjælpning af sidekanaler, men den er strukturelt stærkere end mellem containere, der deler én værtskerne. VM-artefakter er i sig selv følsomme: et diskimage eller hukommelsessnapshot af en domænecontroller lader en angriber trække Active Directory-databasen og nøgler ud offline, så adgang til lager og hypervisorkonsol skal behandles som tier 0. VM sprawl efterlader glemte, upatchede maskiner på netværket. Confidential computing (AMD SEV-SNP, Intel TDX) krypterer VM'ens hukommelse med nøgler, som hypervisoren ikke kan læse, og mindsker dermed den tillid, der skal vises til værtens operatør.\n\nTo navnesammenfald skaber forvirring. En system-VM, der emulerer en hel maskine, er ikke det samme som en proces-VM som JVM eller .NET CLR, der kører ét program i en sprog-runtime. Og i cloudterminologi er en \"instans\" blot en VM af en foruddefineret instanstype, nogle gange på dedikerede værter eller bare metal, og nested virtualisering lader en VM selv være vært for flere VM'er."},"edges":[{"type":"requires","to":"platform/hypervisor","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/operating-system","confidence":"high","strength":"normal"}],"depth":1,"sources":[{"title":"NIST SP 800-125 - Guide to Security for Full Virtualization Technologies","tier":"standard","publisher":"NIST"}],"draft":true}