Hypervisors provide hardware-level isolation that exceeds the security boundaries of OS-level containerization. While Docker and Podman share a host kernel among containers, hypervisors partition CPU, memory, and I/O at the hardware abstraction layer, preventing kernel exploitation from crossing virtual machine boundaries. This page covers the two dominant open-source hypervisor architectures: Xen (type 1, bare-metal) and KVM (type 1.5, kernel-integrated), with specific focus on Qubes OS and Proxmox VE deployments.
This page documents hypervisor architecture (Xen vs KVM), Qubes OS security model, Proxmox VE, VFIO PCI passthrough, and the Qubes vs Proxmox debate. For container-level isolation, see Containerization. For hosting security, see Hosting.
Xen runs a minimal hypervisor (the "Xen VMM") directly on hardware. Domain 0 (Dom0) is a privileged VM that manages hardware and runs device drivers. All other VMs (DomU) are unprivileged and communicate with hardware through Dom0.
graph TD
HW["Hardware"]
VMM["Xen VMM<br/>Hypervisor"]
D0["Dom0<br/>Privileged"]
D0D["Device Drivers"]
D0T["Toolstack"]
SN["sys-net<br/>Untrusted"]
SF["sys-firewall"]
SW["work"]
SP["personal"]
SV["vault<br/>Air-gapped"]
HW --> VMM
VMM --> D0
D0 --> D0D
D0 --> D0T
VMM --> SN
VMM --> SF
VMM --> SW
VMM --> SP
VMM --> SV
SN -.->|"network traffic"| SF
SF -.->|"filtered"| SW
SF -.->|"filtered"| SP
style HW fill:#333,color:#fff
style VMM fill:#5a3a2d,color:#fff
style D0 fill:#2d5a3a,color:#fff
style SN fill:#8B0000,color:#fff
style SV fill:#4a7c59,color:#fff
KVM is a kernel module that converts Linux into a hypervisor. Each VM runs as a standard Linux process, scheduled by the kernel's process scheduler. QEMU provides I/O device emulation.
Text Only
Hardware
|
+-- Linux Kernel
|
+-- KVM module
| +-- VM1 (qemu-kvm process)
| +-- VM2 (qemu-kvm process)
| +-- VM3 (qemu-kvm process)
|
+-- Standard Linux services
Qubes OS is a security-focused desktop operating system built on Xen. It uses security by compartmentalization: activities are isolated into separate VMs called "qubes." The default installation includes:
Proxmox VE is an open-source server virtualization platform combining KVM for VMs and LXC for containers. It provides a web-based management interface and supports clustering, live migration, ZFS storage, and Ceph distributed storage.
VFIO (Virtual Function I/O) allows direct assignment of physical PCI devices to virtual machines. The device is isolated from the host kernel and given exclusively to the guest.