Virtual machines predate containers by two decades, yet in 2026 they still run most of the world's cloud workloads. Understanding how they work — and crucially, when they are the right choice over containers — is fundamental knowledge for any developer who touches infrastructure.
What changed in 2026
- Firecracker is mainstream. AWS Lambda and Fly.io use Firecracker microVMs to get VM-level isolation with ~125 ms boot times. The line between "VM" and "container" blurred significantly.
- Apple Silicon made Type 2 hypervisors fast. Parallels and UTM on M-series Macs run Linux VMs at near-native speed — no more 30 % overhead penalty for local dev VMs.
- Confidential computing grew. AMD SEV and Intel TDX encrypt VM memory even from the hypervisor — relevant for regulated data workloads.
- ARM VMs dominate on cost. AWS Graviton4 and Azure Cobalt 100 (ARM) instances are 20–40 % cheaper per core than equivalent x86 VMs for the same throughput.
How virtualisation works
A hypervisor sits between physical hardware and guest operating systems:
┌─────────────────────────────────────┐
│ Guest VM 1 Guest VM 2 │
│ ┌───────────┐ ┌───────────┐ │
│ │ App + OS │ │ App + OS │ │
│ └───────────┘ └───────────┘ │
├─────────────────────────────────────┤
│ Hypervisor │
├─────────────────────────────────────┤
│ Physical Hardware │
└─────────────────────────────────────┘
The hypervisor virtualises CPU, memory, network, and disk — each VM believes it has real hardware. Modern hypervisors use hardware-assisted virtualisation (Intel VT-x, AMD-V) so the guest runs native instructions most of the time; only privileged operations trap to the hypervisor.
Type 1 vs Type 2 hypervisors
| Type |
Examples |
How it works |
Best for |
| Type 1 (bare-metal) |
KVM, VMware ESXi, Hyper-V, Xen |
Runs directly on hardware |
Cloud providers, enterprise datacentres |
| Type 2 (hosted) |
VirtualBox, Parallels, UTM |
Runs on a host OS |
Local dev, testing |
KVM is the dominant Type 1 hypervisor in Linux-based clouds (AWS, GCP, DigitalOcean). It is built into the Linux kernel, making every Linux server a potential hypervisor.
VMs vs Containers — honest comparison
| Dimension |
Virtual Machine |
Container |
| Isolation |
Full kernel, hardware virtualised |
Namespaces + cgroups (shared kernel) |
| Boot time |
10 s – 2 min |
Milliseconds |
| Image size |
GBs |
MBs |
| Overhead |
5–15 % CPU, fixed RAM for OS |
Near zero |
| Security boundary |
Strong |
Moderate (kernel exploits affect all) |
| Best for |
Full OS, legacy apps, multi-tenancy |
Stateless services, CI, microservices |
Firecracker: microVMs for the serverless era
Firecracker is an open-source microVM manager from AWS. It strips out everything a VM does not need for serverless workloads:
- No BIOS, no device emulation beyond virtio-net and virtio-block
- Boot time: ~125 ms from cold
- Memory overhead: ~5 MB per VM
- Isolation: full KVM kernel boundary
# Minimal Firecracker setup (simplified)
curl -Lo firecracker https://github.com/firecracker-microvm/firecracker/releases/latest/download/firecracker-v1.8.0-x86_64
chmod +x firecracker
# Start the Firecracker process, then configure via API:
curl -X PUT http://localhost:8080/boot-source \
-H "Content-Type: application/json" \
-d '{"kernel_image_path": "vmlinux", "boot_args": "console=ttyS0 reboot=k panic=1"}'
AWS Lambda and Fly.io Machines are both built on Firecracker. For your own platform, it is the right choice when you need multi-tenant isolation without container breakout risk.
When to choose a VM
- Multi-tenancy with untrusted code — container escapes exist; VM boundaries are much harder to cross.
- Kernel-level software — kernel modules, eBPF programs, or OS configuration that requires its own kernel.
- Legacy applications — apps that require Windows, specific kernel versions, or kernel parameters containers cannot provide.
- Regulated workloads — compliance requirements (PCI-DSS, HIPAA) sometimes mandate full OS isolation.
- GPU workloads — GPU passthrough (VFIO) gives VMs direct hardware access; containers with GPU work via drivers but share the host kernel.
How to pick
- Stateless web service or microservice? → Container.
- Need full OS isolation or kernel control? → VM.
- Multi-tenant serverless platform? → Firecracker microVM.
- Local dev environment? → Containers (Docker Desktop) or a lightweight VM (Lima, OrbStack on Mac).
- Legacy Windows app? → VM (or WSL 2 if only dev use).
Common mistakes
Over-provisioning VM memory. "Just give it 16 GB" wastes money. Profile your app under real load and right-size. Cloud providers now offer memory-optimised and compute-optimised shapes — pick the right class.
Not using spot/preemptible instances. Spot instances (AWS) and preemptible VMs (GCP) cost 60–90 % less than on-demand for fault-tolerant workloads. Use them for batch jobs and CI.
Storing state on the VM disk. Instance storage is ephemeral on most clouds. Use managed databases and object storage; treat VMs as cattle, not pets.
Never updating the base image. Stale VM images accumulate CVEs. Automate base image rebuilds monthly using Packer or a cloud image pipeline.
What to skip
- Type 2 hypervisors in production — use cloud VMs or bare metal; VirtualBox on a server is a support nightmare.
- Large VMs for tiny services — a t3.nano (~$3.80/month) runs a small Go service fine. Don't over-provision.
- DIY hypervisor management — use cloud autoscaling groups and managed instance templates; hand-managing individual VMs at scale is operationally unsustainable.
FAQ
Is WSL 2 a virtual machine?
Yes — WSL 2 runs a real Linux kernel inside a lightweight Hyper-V VM. That is why it can run Docker natively and has better compatibility than WSL 1, which used a kernel translation layer.
What is the difference between a VM snapshot and a backup?
A snapshot captures the full VM state (disk + memory) at a point in time and is fast to restore. A backup copies the disk to separate storage and is slower but survives datacenter-level failures. Use both.
Can I run containers inside a VM?
Yes — this is the standard cloud deployment model. EC2 instances run Docker containers inside. The VM provides the host OS; containers run on top.
How do cloud providers charge for VMs?
Typically per vCPU-hour and GB-RAM-hour, billed by the second (AWS, GCP, Azure). Choose instance families carefully: compute-optimised (C-series) for CPU-heavy work, memory-optimised (R/X-series) for in-memory databases, general-purpose (M-series) for most web services.
Where to go next