Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Adds support for nested virtualization

github.com

Post reply on HN
Print view View original

51–60 of 124 posts

Re: AWS Adds support for nested virtualization

#51

Post by firesteelrain »

ohthehugemanate wrote: post #34

I wonder if this is connected to Azure launching OpenShift Virtualization on "Boost" SKUs? There are a lot of VMWare customers going to OpenShift Virt, and apparently the CPU/memory overhead on Azure maxes out around 10% under full load... but then hyper V has been doing a lot of work on it. No idea if nitro includes any of the KVM-on-KVM passthrough of full KVM, to give it an edge here.

Azure has had nested virt for a while - maybe it’s related to OpenShift but you could run OpenShift on Azure for some time. I used to run HyperV in Azure on certain SKUs

Re: AWS Adds support for nested virtualization

#52

Post by firesteelrain »

gerdesj wrote: post #10

Could someone explain why this is might be a big deal? I remember playing with nested virty some years ago and deciding it is a backwards step except for PoC and the like. Given I haven't personally run out of virty gear, I never needed to do a PoC.

When you run nested virt, you can do multicast in Cloud between the nested VMs. You can’t do multicast across VMs inside the Cloud.

Basically you setup a small LAN with HyperV or something similar (I have only done it with HyperV)

Re: AWS Adds support for nested virtualization

#53

Post by leoc »

gerdesj wrote: post #10

Could someone explain why this is might be a big deal? I remember playing with nested virty some years ago and deciding it is a backwards step except for PoC and the like. Given I haven't personally run out of virty gear, I never needed to do a PoC.

Hopefully it mean that you can finally run a network simulator like GNS3 https://www.gns3.com/ in an AWS instance.

Re: AWS Adds support for nested virtualization

#54

Post by iangudger »

paulfurtado wrote: post #16
gerdesj wrote: post #10

Could someone explain why this is might be a big deal? I remember playing with nested virty some years ago and deciding it is a backwards step except for PoC and the like. Given I haven't personally run out of virty gear, I never needed to do a PoC.

It is great for isolation. There are so many VM based containerization solutions at this point, like Kata Containers, gvisor, and Firecracker. With kata, your kubernetes pods run in isolated VMs. It also opens the door for live migration of apps between ec2 instances, making some kinds of maintenance easier when you have persistent workloads. Even if not for security, there are so many ways a workload can break a mac…

One of the big benefits that gVisor offers is that it doesn't require nested virtualization (or any virtualization). They released a new version that improves performance when not using virtualization a while back: https://gvisor.dev/blog/2023/04/28/systrap-release/

Re: AWS Adds support for nested virtualization

#56

Post by Twirrim »

anurag wrote: post #11

This is a big deal because you can now run Firecracker/other microVMs in an AWS VM instead of expensive AWS bare-metal instances. GCP has had nested virtualization for a while.

OCI supports it with Intel. I know it works with AMD, but we don't officially support that so far as I'm aware. The performance hit on AMD is bigger than Intel, last I looked.

Re: AWS Adds support for nested virtualization

#57

Post by HumanOstrich »

iJohnDoe wrote: post #19
anurag wrote: post #11

This is a big deal because you can now run Firecracker/other microVMs in an AWS VM instead of expensive AWS bare-metal instances. GCP has had nested virtualization for a while.

Was hoping this comment would be here. Firecracker and microVMs are good use-case. Also, being able to simply test and develop is a nice to have. Nested virtualization can mean a lot of things. Not just full VMs.

> Firecracker and microVMs are good use-case.

Good use-case for what?

Re: AWS Adds support for nested virtualization

#58

Post by HumanOstrich »

BobbyTables2 wrote: post #40

Is nested VMX virtualization in the Linux kernel really that stable? The technical details are a lot more complex than most realize. Single level VMX virtualization is relatively straightforward even if there are a lot of details to juggle with VMCS setup and handing exits. Nested virtualization is a whole another animal as one now also has to handle not just the levels but many things the hardware normally does, plu…

It's been around for almost 15 years and stable enough for several providers to roll it out in production the past 10 years (GCP and Azure in 2017).

AWS is just late to the game because they've rolled so much of their own stack instead of adapting open source solutions and contributing back to them.

Re: AWS Adds support for nested virtualization

#59

Post by adobrawy »

HumanOstrich wrote: post #57
iJohnDoe wrote: post #19

Earlier quoted context omitted.

Was hoping this comment would be here. Firecracker and microVMs are good use-case. Also, being able to simply test and develop is a nice to have. Nested virtualization can mean a lot of things. Not just full VMs.

> Firecracker and microVMs are good use-case. Good use-case for what?

Nowadays universal answer for "what? why?" is AI. AI agent needs VMs to run generated code in sandbox as they can not be trusted.

Re: AWS Adds support for nested virtualization

#60

Post by HumanOstrich »

adobrawy wrote: post #59
HumanOstrich wrote: post #57

Earlier quoted context omitted.

> Firecracker and microVMs are good use-case. Good use-case for what?

Nowadays universal answer for "what? why?" is AI. AI agent needs VMs to run generated code in sandbox as they can not be trusted.

I don't think everyone should assume that AI is the answer to all questions. I was asking the person I replied to, thanks.
Post reply on HN