Nested virtualization
What you get
- WSL2 and Hyper-V in a Windows 10 VM; KVM and microVMs in a Linux VM; a lab for virtualization work without touching real machines.
- One switch per VM in the web interface. A nested VM is suspended and restored across a host restart like any other, its Hyper-V or KVM state included.
How it works
The keel hypervisor keeps a shadow of the guest's virtual-machine control structure and runs the inner VM on the guest's behalf. It was built in steps: a demo, VMCS shadowing, then nested EPT. Hyper-V also needed a few things Microsoft does not document.
What was measured
- Linux 6.12 KVM as L1: the inner VM boots to user space in 4–5 seconds; 2000 fork+exec in 2.18 s (213 s in the first demo); one inner exit costs 32 µs.
- Windows 10 22H2 with Hyper-V: boots to SSH in 31–35 s; WSL2 starts in 4–5 s and survived 10 start-stop cycles; a Generation 2 Alpine VM in Hyper-V reached the login prompt within 60 s.
Limits
- Intel hosts only. Nested SVM on AMD is not done.
- A nested VM cannot have PCI passthrough devices; kcells cannot enable it.
- Windows VBS and HVCI (memory integrity) do not work yet. Windows 11, Windows Server and Proxmox as the outer guest are not tried.
- Workloads with many exits (lots of small I/O) are clearly slower than on the host directly: fine for WSL2, development and labs, not for production virtualization.
- While an upgrade is still on trial, a nested VM is shut down on a host restart, because the old slot cannot read the new checkpoint format.