KVM stands for Kernel-based Virtual Machine. This Linux component lets software run virtual machines using hardware virtualization support. Virtual machine monitors such as QEMU supply the machine model around KVM, so a guest operating system can run with its own kernel and virtual hardware.
Copy link to headingHow does KVM fit into a virtual machine?
Virtual machines run a guest operating system using resources supplied by a host. KVM requires Linux on the host, but the guest can use another operating system such as an unmodified Windows installation.
The virtual machine monitor (VMM) configures the VM and supplies its machine model from userspace. KVM provides the kernel interface for virtualized execution. The processor presented to the guest is a virtual CPU, or vCPU.
General-purpose VMs and smaller microVMs can both use KVM while presenting different virtual hardware to their guests. To understand a particular deployment, identify the VMM as well as the virtualization component.
Copy link to headingWhat happens when a VMM uses KVM?
Through the KVM userspace API, a VMM opens /dev/kvm and uses KVM_CREATE_VM to obtain a VM handle. It then uses KVM_CREATE_VCPU to create virtual CPUs and calls KVM_RUN on a vCPU to enter guest execution. These are programming interfaces for building a VMM, not shell commands for starting a machine.
For example, in the KVM-backed Firecracker architecture, each process contains one microVM. Its vCPU threads enter KVM_RUN, while the VMM supplies the device models. Network and disk backing come from the host configuration. This division explains why enabling KVM alone does not give you a ready-to-use VM.
Applications built against the KVM API must query the host's capabilities because a kernel version alone doesn't establish which operations are available. If you're deploying an existing VMM, follow its host setup requirements.
This separation also helps when diagnosing failures. If a VMM cannot access KVM, investigate its host environment and permissions. If the guest starts but cannot use its disk or network, inspect the machine configuration and the resources backing those devices. The fact that both failures occur while launching a VM does not make them the same kind of problem.
Copy link to headingWhat is the difference between KVM and QEMU?
QEMU provides system emulation, including a model of a machine and its devices. KVM is one accelerator that QEMU can use to execute the guest. In a QEMU/KVM setup, both components are doing work: QEMU supplies the machine around the guest, and KVM supplies Linux's virtualization support.
QEMU can also use its Tiny Code Generator, or TCG, to emulate CPUs without KVM. It supports other host-specific accelerators, including options for macOS and Windows. Seeing QEMU in a command or dependency therefore does not tell you whether KVM is involved.
Check the guest machine type and the accelerator available on your host before selecting a configuration. Support for one accelerator or CPU architecture doesn't establish support for another, so validate the combination you plan to deploy.
Copy link to headingIs a KVM virtual machine the same as a microVM?
MicroVMs use reduced machine models. KVM supplies virtualization that a VMM can use for a microVM or a general-purpose VM. Knowing that a deployment uses KVM doesn't tell you which kind of VM it runs.
Firecracker is a VMM designed for microVMs. Its reduced device model limits the guest-facing functionality the VMM must provide. In its KVM-backed configuration, Firecracker boots a Linux guest through Linux KVM.
Ordinary containers share their container host's kernel. Each VM supplies its own guest kernel, and containers can run inside it. Container packaging can therefore coexist with a VM boundary around execution.
Consider a test service running containers inside a Linux VM. Those containers share the VM's guest kernel and remain separate from the physical host's kernel. Describing the service as "containerized" doesn't show this arrangement, so specify which workloads share a kernel when discussing isolation.
Copy link to headingHow can you check a Linux host for KVM access?
Begin with the host where the VMM will run. KVM acceleration requires Linux, and supported architectures include x86 and Arm. On x86, the processor must provide hardware virtualization extensions. Running a Linux guest on another operating system does not by itself establish that KVM will be available inside the guest.
On Linux, this read-only shell snippet checks whether /dev/kvm is visible and whether your current user has read and write access:
ls -l /dev/kvmif [ -r /dev/kvm ] && [ -w /dev/kvm ]; then printf '%s\n' 'Current user has read and write access to /dev/kvm.'else printf '%s\n' 'Check whether /dev/kvm exists and inspect its permissions.'fiThe result is a starting point for diagnosis. It does not create a VM or test the capabilities your VMM requires. If the device is missing, investigate the host's KVM setup. If it exists but access fails, inspect the permissions for the account that will run the VMM before changing them.
Running KVM inside another VM requires nested virtualization. For nested x86 KVM guests, the outer host must enable nesting and expose the CPU virtualization capabilities to the guest. Confirm both in the host or cloud provider configuration before relying on KVM inside a VM.
Copy link to headingWhat does KVM leave to the rest of your sandbox system?
KVM supplies virtualization. Building a usable sandbox also requires a guest image, network controls, and software that starts work and manages the environment's lifetime. The VMM and surrounding host software supply those functions, and vulnerabilities in these components can still compromise isolation.
Firecracker illustrates these host responsibilities. Its production guidance calls for the jailer or equivalent process restrictions. Firecracker also leaves network filtering to the host, so operators must configure which connections the guest can make.
Copy link to headingWhat does Vercel Sandbox provide above the VM layer?
Vercel Sandbox provides a managed Firecracker microVM for each sandbox, with a dedicated guest kernel and its own filesystem and network. Your application uses the Sandbox SDK to create an environment, transfer files, and run commands. Vercel operates the underlying infrastructure, so integrating code execution into an application doesn't require you to configure a KVM host or implement a VMM.
For code evaluation, the backend submits the program and inspects its exit status and results. Set lifetime and outbound access when creating the sandbox.
The Sandbox firewall defaults to allow-all. Choose deny-all when the program needs no outbound connections. To set up authentication and run your first command, connect your project to Sandbox.
Persistence is enabled by default. Stopping a session saves its filesystem for later use, but running processes and their memory do not survive. Restart the tools you need when the sandbox resumes.
For coding agents that generate tests and retry failures, combine Sandbox execution with Workflow orchestration. Workflow tracks progress across attempts while Sandbox manages the code's execution environment.
Copy link to headingFrequently asked questions
Copy link to headingIs KVM a hypervisor?
Yes. KVM provides hypervisor functionality inside Linux. It handles virtualized execution while a userspace VMM supplies the guest's machine model.
Copy link to headingHow do KVM and QEMU work together?
QEMU models the virtual machine and its devices. On Linux, it can use KVM for hardware-assisted guest execution. Other options include TCG for CPU emulation and host-specific accelerators for macOS and Windows.
Copy link to headingIs KVM the same as a microVM?
No. KVM is the Linux virtualization component used by several VMMs. MicroVMs have reduced machine models, as in Firecracker.
Copy link to headingCan KVM run on macOS or inside another VM?
KVM requires a Linux host, so it does not run directly as a macOS hypervisor. KVM can run inside a suitable Linux VM when the outer environment supports and enables the required nested virtualization capabilities. QEMU also offers a macOS-specific accelerator for running guests without KVM.