Re: Hosting recommendations ... ?

[Matt Harris <matt () netfire net>]

On Tue, Jan 19, 2021 at 3:27 PM Brandon Martin <lists.nanog () monmotha net>
wrote:

> On 1/19/21 12:56 PM, Bryan Holloway wrote:
> > I'm very curious about your assertion:
> >
> > Is nested virtualization really a thing?
> >
> > I mean, I'm not exactly trying to render Pixar's latest movie ... just
> > trying to push some bits around (light web-sites, some e-mail ...)
> >
> > It just seems inherently prone to issues.
> >
> > Could you back this up with any white-papers or documentation on the
> > subject? I'm genuinely interested ...
>
> With KVM, if you have a recent kernel and qemu, it pretty much "just
> works" on supported hardware.  AFAIK Xen supports "Xen on Xen", too, but
> I haven't used it and don't know much about it.
>
> The use case is pretty much exactly this.  You (the product consumer)
> are handed a product that amounts to a virtual machine on somebody
> else's $BIGBOX.  You want to deploy multiple virtual machines where you
> have direct control over their lifecycle, configuration, etc. and can
> bring in additional I/O resources, etc. at the hypervisor level
> (consider that, with KVM, the Linux kernel basically IS the hypervisor).
>   So, you run one or more VMs inside the top level VM that you're handed.
>
> It's full of lots of little wiggles and can be a pain to maintain if you
> have visibility into both levels of the equation, but it does seem to
> work and is surprisingly performant.

Nested virtualization is, however, pretty widely deployed for production
workloads. Take for instance Juniper's vSRX and vMX products. Both require
nested virtualization support as they run a Wind River Linux instance with
KVM directly on your virtual machine which may be on vmware, KVM, Hyper-V,
etc, and then Junos running nested within the WRL KVM virtual machine. So
it's not like this is something that's uncommon or not trustworthy, lots of
us are doing it every day with no serious problems and entirely acceptable
performance on modern hardware. I run a decent fleet of vSRX's on Hyper-V
and it works well. YMMV as always based on your own platform, but I don't
think that nested virtualization is something that we should be steering
clear of at this point.

- mdh

Matt Harris|Infrastructure Lead Engineer
816-256-5446|Direct
Looking for something?
Helpdesk Portal|Email Support|Billing Portal
We build and deliver end-to-end IT solutions.