What is a hypervisor? Type 1 vs type 2, and how virtual machines really run

Short answer: a hypervisor, also called a virtual machine monitor (VMM), is the software that creates and runs virtual machines. It sits between the physical hardware and the operating systems running on it, gives each one its own slice of CPU time, memory, storage and network, and keeps them isolated from each other — so one server can run many independent machines, each believing it has the hardware to itself. Every VPS and every cloud instance runs on one.

What does a hypervisor actually do?

• CPU: each virtual machine gets virtual CPUs (vCPUs), which the hypervisor schedules onto physical cores. The guest runs its own code directly on the processor; only privileged operations — touching hardware, changing page tables, halting — trap to the hypervisor, which handles them and resumes the guest.
• Memory: each guest sees a contiguous “physical” memory starting at zero. The hypervisor maps that onto real RAM wherever it has it, and makes sure no guest can address another’s.
• Devices: guests get virtual disks, network cards and consoles — either emulated real hardware (slow but universal), paravirtual devices designed for VMs (virtio on KVM, VMBus devices on Hyper-V), or real devices passed through to one guest.
• Isolation and control: starting, stopping, snapshotting, migrating and limiting guests, and making sure one cannot read or crash another.

Type 1 vs type 2 hypervisors

The split dates back to Robert Goldberg’s work in the early 1970s and is blurrier in practice than in the table. KVM is a module of the Linux kernel, so Linux itself becomes the hypervisor — usually counted as type 1, although a full Linux system runs alongside. Hyper-V is installed from inside Windows but then moves that Windows into a privileged partition on top of itself, which makes it type 1 as well. What matters in practice is whether the hypervisor controls the hardware or asks an operating system for it.

How do CPUs make virtualisation fast?

In 1974 Gerald Popek and Robert Goldberg set out what an architecture needs so that a hypervisor can run guests efficiently: every instruction that could reveal or change the machine’s state must trap when a guest runs it. The x86 processors of the 1990s did not meet that rule — some sensitive instructions silently behaved differently instead of trapping — so early x86 hypervisors had to work around it. VMware rewrote problematic guest code on the fly (binary translation), and Xen modified guest kernels to call the hypervisor explicitly (paravirtualisation).

Hardware support arrived in the mid-2000s with Intel VT-x and AMD-V. They add a separate mode for guests: the guest runs at full speed until it does something the hypervisor must handle, which causes a VM exit. A few years later came second-level address translation — Intel EPT and AMD NPT (also called RVI) — which lets the CPU translate guest addresses to host addresses in hardware instead of the hypervisor maintaining shadow page tables. An IOMMU (Intel VT-d, AMD-Vi) does the same for devices, which is what makes safe PCI passthrough possible.

grep -Ec '(vmx|svm)' /proc/cpuinfo   # >0: VT-x (vmx) or AMD-V (svm) is present
lscpu | grep -i virtualization

A count of zero on a physical machine usually means the feature is switched off in the firmware. Inside a VM it means the host does not pass the extensions through, so you cannot run another hypervisor there — nested virtualisation is a host setting.

Which hypervisors will you meet?

Proxmox VE is worth singling out because people often call it a hypervisor: it is a Debian-based platform that manages KVM virtual machines and LXC containers through a web interface. The hypervisor underneath is KVM.

Hypervisors vs containers

Containers — Docker, LXC, OpenVZ — involve no hypervisor. They are processes on one shared Linux kernel, separated by namespaces and limited by cgroups. That makes them lighter and faster to start, but every container depends on the host’s kernel: it cannot load its own modules, run another operating system or change kernel settings. A virtual machine has its own kernel, so it can. For a VPS that difference decides whether Docker, WireGuard or a custom kernel will work at all — see KVM vs OpenVZ.

How do you tell which hypervisor a server runs on?

systemd-detect-virt        # kvm, microsoft (Hyper-V), vmware, xen, oracle (VirtualBox) or none
lscpu | grep -i 'hypervisor vendor'
cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name

On Windows, the last lines of systeminfo say “A hypervisor has been detected” inside a virtual machine, and the system manufacturer and model name the virtual platform. A container instead reports lxc, openvz or docker from systemd-detect-virt.

What does the hypervisor mean for your VPS?

• CPU steal time. When the host has more vCPUs ready to run than physical cores, your vCPU waits. Linux shows that wait as st in top and vmstat 1; a few percent is normal, a steady double-digit value means a crowded host.
• Overcommitment. Hypervisors can promise more vCPUs, and some setups more RAM, than the host has. Moderate CPU overcommit is how VPS pricing works; RAM overcommit is where neighbours start to hurt each other.
• Paravirtual drivers. A Linux guest on KVM should use virtio for disk and network — virtio-blk disks appear as /dev/vda, virtio-scsi disks as /dev/sda, and lsmod | grep virtio shows which are loaded; emulated hardware costs throughput.
• Isolation. A guest breaking out into the hypervisor is rare and patched fast when found, which is why VMs remain the boundary clouds trust between customers. CPU side-channel flaws such as Spectre are mitigated at the hypervisor level too, which is one reason hosts update kernels promptly.

Which hypervisor does VMHeaven use?

Every VMHeaven VPS is a KVM virtual machine with its own kernel: Standard KVM, Hi-CPU KVM, DMCA Ignored KVM and Pentesting KVM. If you want to be the one running the hypervisor — Proxmox, plain KVM or Hyper-V — a dedicated server gives you the bare hardware with no hypervisor of ours in the way.

Frequently asked