# virtualization Published articles for virtualization. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Lenovo ThinkAgile VX850 V4 Takes On In-Memory Virtualization With New Deploy Tiers and Four-Hypervisor Express Bundles DevFeed: [Lenovo ThinkAgile VX850 V4 Takes On In-Memory Virtualization With New Deploy Tiers and Four-Hypervisor Express Bundles]() Original publisher: [Read original article]() Author: Harold Fritts Published: 2026-09-17T16:43:22Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [virtualization](), [Hardware](), [Deployment](), [hyper-v](), [Windows](), [Microsoft](), [Azure](), [nutanix](), [intel]() Tags: [azure](), [capacity](), [deployment](), [enterprise](), [hardware](), [hyper-v](), [intel](), [microsoft](), [nutanix](), [nvme](), [pcie](), [server](), [virtualization]() ### AI overview Lenovo added the four-socket ThinkAgile VX850 V4 to its virtualization lineup for demanding in-memory workloads. The launch also introduces three Infrastructure Deployment Services tiers and pre-validated Top Choice Express bundles covering Microsoft, Red Hat, SUSE, and Nutanix. Lenovo has not yet published the VX850 V4's own product specifications. ### Source excerpt Lenovo has added the ThinkAgile VX850 V4 to its virtualization lineup, a four-socket node it describes as purpose-built for highly virtualized and demanding in-memory workloads, and paired the launch with a three-tier deployment service framework and a set of pre-validated Top Choice Express bundles spanning Microsoft, Red Hat, SUSE, and Nutanix. The announcement follows Lenovo's The post Lenovo ThinkAgile VX850 V4 Takes On In-Memory Virtualization With New Deploy Tiers and Four-Hypervisor Express Bundles appeared first on StorageReview.com. ## Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents DevFeed: [Security evaluations find traditional virtual machines inadequate for containing cyber-capable autonomous agents]() Original publisher: [Read original article]() Author: Olimpiu Pop Published: 2026-09-17T07:07:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [virtual machines](), [Security](), [Vulnerabilities](), [Linux Kernel](), [qemu](), [Firecracker](), [systems]() Tags: [agent-escape-vm](), [ai-security](), [development](), [devops](), [firecracker](), [linux](), [linux-kernel](), [news](), [qemu](), [security](), [security-breach](), [virtual-machines](), [virtualization](), [vm](), [vulnerabilities]() ### AI overview Security evaluations found that a cyber-capable autonomous agent escaped standard QEMU and KVM virtual machine configurations by exploiting kernel and library vulnerabilities. Firecracker contained the agent in testing, but the agent still hardlocked the host through Linux kernel flaws. ### Source excerpt Traditional virtual machines are inadequate for isolating cyber-capable autonomous agents. Tests using GPT-5.6-Cyber indicated multiple escape attempts due to kernel flaws. While Firecracker provided some containment, vulnerabilities remained. The study underscores the need for minimal attack surface virtualisation technologies and rapid, proactive patching strategies to safeguard host systems. By Olimpiu Pop ## TrueNAS Releases a Native Proxmox VE Plugin for Managing VM Storage DevFeed: [TrueNAS Releases a Native Proxmox VE Plugin for Managing VM Storage]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-16T13:40:55Z Content type: article Language: en Sources: [Virtualization Howto]() Topics: [truenas](), [Proxmox](), [virtualization](), [NVMe]() Tags: [bug](), [home-lab](), [home-server](), [nvme](), [proxmox](), [release](), [testing](), [truenas](), [virtualization](), [zfs]() ### AI overview TrueNAS released an official Proxmox VE storage plugin that lets administrators provision and manage TrueNAS-backed VM disks through Proxmox workflows. The plugin supports iSCSI, NVMe over TCP, and OpenZFS snapshots, but the article describes it as an early-adopter release that is not yet recommended for production workloads. ### Source excerpt It really feels like Proxmox is on fire lately with announcements and momentum behind the solution. We just came off the heels of Proxmox announcing they were bringing on 24x7... The post TrueNAS Just Fixed One of Proxmox's Biggest Storage Headaches appeared first on Virtualization Howto. ## How vagrant-libvirt Plugin Deals with Duplicate Subnets DevFeed: [How vagrant-libvirt Plugin Deals with Duplicate Subnets]() Original publisher: [Read original article]() Published: 2026-09-16T06:27:00Z Content type: tutorial Language: en Sources: [ipSpace.net blog]() Topics: [Vagrant](), [virtual machines](), [Linux](), [Ubuntu]() Tags: [debugging](), [linux](), [vagrant](), [virtual-machines](), [virtualization]() ### AI overview The article explains that vagrant-libvirt can fail when an existing libvirt virtual network has the same IP subnet as the desired management network but a different name. It identifies the resulting network-name mismatch and reports that correcting the network definition in the Vagrantfile resolves the problem. ### Source excerpt TL&DR: Badly. The vagrant-libvirt plugin mysteriously crashes when an existing virtual network (with a different libvirt name) uses the same IP subnet as the desired management network. Background: netlab is using the vagrant-libvirt plugin to manage libvirt/KVM virtual machines with Vagrant. As I already have that infrastructure, I use it to start standalone virtual machines (usually to test various Ubuntu releases) on my Linux server. Things work great... until they don't. Here's how I managed to waste half a day chasing imaginary gremlins caused by a simple error. Read more ... ## Open-Source Project Brings Full iOS 27 Virtualization to Apple Silicon DevFeed: [Open-Source Project Brings Full iOS 27 Virtualization to Apple Silicon]() Original publisher: [Read original article]() Author: Sergio De Simone Published: 2026-09-12T16:00:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [iOS](), [Tooling](), [Command-line interface](), [debugging](), [App]() Tags: [apple](), [cli](), [debugging](), [development](), [ios](), [ios-27-virtualization](), [iphone](), [kernel](), [macos](), [mobile](), [mobile-testing](), [news](), [open-source](), [research](), [reverse-engineering](), [security](), [ssh](), [testing](), [virtualization](), [xcode]() ### AI overview vphone-cli runs a full iOS 27 system as a virtual machine on Apple Silicon using Apple's Virtualization.framework. The article contrasts it with the Xcode iPhone Simulator and highlights uses in security research, reverse engineering, debugging, and automated testing. ### Source excerpt The open-Source project vphone-cli enables a full iOS 27 system to run as a virtual machine on Apple Silicon. Built on Apple's own Virtualization.framework rather than traditional emulation, the project opens up new possibilities for security research, reverse engineering, and automated iOS testing. By Sergio De Simone ## If I Had 2 Hours for My Home Lab This Weekend, I'd Do These 7 Things DevFeed: [If I Had 2 Hours for My Home Lab This Weekend, I'd Do These 7 Things]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-11T12:53:06Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Proxmox](), [backups](), [Docker](), [Docker Compose]() Tags: [backups](), [docker](), [docker-compose](), [home-lab](), [home-server](), [proxmox](), [virtualization]() ### AI overview A practical two-hour home lab maintenance plan covering selective updates, backup verification, storage health, reboot checks, and focused remediation. It discusses Proxmox hosts, Docker images, Docker Compose stacks, and optional automatic updates. ### Source excerpt Let's face it, our time in the home lab among other things we have going on in our lives and families may be hard to come by and there are... The post If I Had 2 Hours for My Home Lab This Weekend, I'd Do These 7 Things appeared first on Virtualization Howto. ## I Turned My Proxmox Server Into a NAS Without Installing TrueNAS DevFeed: [I Turned My Proxmox Server Into a NAS Without Installing TrueNAS]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-10T12:46:18Z Content type: article Language: en Sources: [Virtualization Howto]() Topics: [Proxmox](), [Homelab](), [virtualization](), [hosting](), [Linux](), [Debian]() Tags: [ceph](), [debian](), [home-lab](), [home-server](), [hosting](), [linux](), [nas](), [proxmox](), [self-hosted](), [self-hosting](), [server](), [storage](), [virtualization]() ### AI overview The article presents ANAS, a project that adds native storage-management panels to the existing Proxmox VE web interface. It aims to let Proxmox manage storage using the underlying Debian/Linux capabilities without installing TrueNAS or introducing a separate management interface. ### Source excerpt Proxmox is really good with all types of storage and I have used it as a dedicated NAS appliance many times. I have used dedicated NAS devices. I have also... The post I Turned My Proxmox Server Into a NAS Without Installing TrueNAS appeared first on Virtualization Howto. ## VMware defends ending downloads of SDK that helps VM backups - or migrations to rivals DevFeed: [VMware defends ending downloads of SDK that helps VM backups - or migrations to rivals]() Original publisher: [Read original article]() Author: Simon Sharwood Published: 2026-09-10T02:05:58Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [SDKs]() Tags: [dev](), [migration](), [software-license](), [virtualization](), [vmware]() ### AI overview The article reports that VMware is defending its decision to end downloads of an SDK used for virtual-machine backups and potentially migrations to rival platforms. VMware says the license was never intended to support moving VMs. ### Source excerpt Says license was never about moving VMs ## QNAP TVS-hx77AX Brings NFS over RDMA and U.2 NVMe to Desktop ZFS NAS DevFeed: [QNAP TVS-hx77AX Brings NFS over RDMA and U.2 NVMe to Desktop ZFS NAS]() Original publisher: [Read original article]() Author: Lyle Smith Published: 2026-09-09T17:18:09Z Content type: news Language: en Sources: [StorageReview.com]() Topics: [systems](), [networking](), [virtualization](), [cpu](), [Network](), [GPU](), [Artificial Intelligence]() Tags: [10gbase-t](), [2-5gbe](), [amd](), [cpu](), [enterprise](), [gpu](), [medium-nas](), [memory](), [nas](), [networking](), [nvme](), [pcie](), [qnap](), [virtualization]() ### AI overview QNAP introduced the TVS-hx77AX series of desktop ZFS NAS systems, combining AMD Ryzen 7000 processors, DDR5 memory, U.2 NVMe storage, and NFS over RDMA. The 16-, 12-, and 8-bay models target video collaboration, virtualization, and small-scale AI workloads. ### Source excerpt QNAP has introduced the TVS-hx77AX series, a new line of desktop ZFS NAS systems combining AMD Ryzen 7000 series processors with DDR5 memory, U.2 NVMe storage, and NFS over RDMA support. The family includes the 16-bay TVS-h1677AX, 12-bay TVS-h1277AX, and 8-bay TVS-h877AX, and QNAP is aiming all three at video collaboration, virtualization, and small-scale AI The post QNAP TVS-hx77AX Brings NFS over RDMA and U.2 NVMe to Desktop ZFS NAS appeared first on StorageReview.com. ## Using Proxmox Resource Mappings for GPU Passthrough Across Cluster Nodes DevFeed: [Using Proxmox Resource Mappings for GPU Passthrough Across Cluster Nodes]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-09T12:43:14Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Proxmox](), [Homelab](), [virtualization](), [configuration](), [Hardware]() Tags: [configuration](), [hardware](), [home-lab](), [home-server](), [proxmox](), [virtualization]() ### AI overview This tutorial explains how Proxmox Resource Mappings can represent passthrough hardware as logical resources across cluster nodes. It contrasts this approach with assigning a VM a fixed PCI address, which may fail when the VM moves to a node where the device has a different address. ### Source excerpt Many home labbers are starting to experiment with AI in the home lab and are using things like GPU passthrough on their Proxmox hosts. But passthrough is not just something... The post I Changed How I Do GPU Passthrough in Proxmox After Finding This Feature appeared first on Virtualization Howto. ## I Was Running Redundant VMs on the Same Proxmox Host Without Realizing It DevFeed: [I Was Running Redundant VMs on the Same Proxmox Host Without Realizing It]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-08T12:19:53Z Content type: opinion Language: en Sources: [Virtualization Howto]() Topics: [Proxmox](), [Homelab](), [virtualization](), [systems]() Tags: [architecture](), [home-lab](), [proxmox](), [server](), [servers](), [systems](), [virtualization]() ### AI overview The article describes discovering that two supposedly redundant VMs were running on the same Proxmox host. It explains how shared failure domains can make apparently resilient home-lab architectures fail together and recommends auditing workload placement across hosts and dependencies. ### Source excerpt If you have spent a lot of time over the years building redundancy into your home lab, you probably have looked at many of the same layers that I have.... The post I Was Running Redundant VMs on the Same Proxmox Host Without Realizing It appeared first on Virtualization Howto. ## Leaving VMware Just Got Harder After Broadcom Pulled VDDK Downloads DevFeed: [Leaving VMware Just Got Harder After Broadcom Pulled VDDK Downloads]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-07T12:07:37Z Content type: news Language: en Sources: [Virtualization Howto]() Topics: [virtualization](), [migration](), [Azure](), [SDKs](), [Microsoft]() Tags: [azure](), [developer](), [home-lab](), [home-server](), [microsoft](), [migration](), [proxmox](), [tool](), [virtualization](), [vmware]() ### AI overview Broadcom has removed public download access to VMware's Virtual Disk Development Kit (VDDK), creating a potential obstacle for customers migrating away from VMware. The library is used by migration tools including Microsoft Azure Migrate, Red Hat's Migration Toolkit, Nutanix Move, VMware-to-KVM products, virt-v2v, and nbdkit. The article notes that affected links return errors and that no formal transition notice, deprecation announcement, or replacement has been identified. ### Source excerpt Just when we thought that Broadcom wouldn't be able to slow down customers moving off of vSphere to another platform. They may just now have done something that will have... The post Leaving VMware Just Got Harder After Broadcom Pulled VDDK Downloads appeared first on Virtualization Howto. ## 7 Weekend Projects That Make Your Home Lab Less Dependent on You DevFeed: [7 Weekend Projects That Make Your Home Lab Less Dependent on You]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-06T12:32:10Z Content type: article Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Automation](), [Git](), [virtualization]() Tags: [architecture](), [automation](), [documentation](), [git](), [home-lab](), [home-server](), [virtualization]() ### AI overview The article presents weekend projects for making a home lab more understandable, recoverable, resilient, and predictable when its owner is unavailable. The supplied text covers documenting the lab and moving configurations into Git, including recording hosts, IP addresses, VLANs, and architecture. ### Source excerpt I have been pretty focused on automation in the home lab. But there is also mindset changes I needed to make to keep from having to baby sit my lab... The post 7 Weekend Projects That Make Your Home Lab Less Dependent on You appeared first on Virtualization Howto. ## I Thought Keepalived Only Protected My Home Lab Servers. Then I Found Track Scripts DevFeed: [I Thought Keepalived Only Protected My Home Lab Servers. Then I Found Track Scripts]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-04T12:32:34Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Availability](), [Linux](), [Proxmox](), [Network](), [Protocol (disambiguation)](), [Docker](), [Server](), [configuration]() Tags: [availability](), [dns](), [docker](), [high-availability](), [home-lab](), [home-server](), [linux](), [network](), [proxmox](), [servers](), [virtualization]() ### AI overview The article explains how Keepalived provides high availability for home lab servers by moving a virtual IP address between Proxmox hosts using VRRP. It focuses on track scripts, which allow failover decisions based on application-level checks rather than only complete server failure, with Docker-based DNS services as an example. ### Source excerpt I have used Keepalived in my home lab for quite some time and most of the time, I have thought of it in a very simple way as to what... The post I Thought Keepalived Only Protected My Home Lab Servers. Then I Found Track Scripts appeared first on Virtualization Howto. ## Xen on RISC-V just ran on real hardware! DevFeed: [Xen on RISC-V just ran on real hardware!]() Original publisher: [Read original article]() Author: Baptiste Le Duc Published: 2026-09-03T08:00:27Z Content type: article Language: en Sources: [XCP-ng Blog]() Topics: [RISC-V](), [virtualization](), [systems](), [ci](), [cpu](), [Emulator]() Tags: [ci](), [cpu](), [qemu](), [risc-v](), [systems](), [virtualization]() ### AI overview Xen now boots a guest domain on physical RISC-V hardware using a HiFive Premier P550. Supporting changes accommodate the board's pre-ratification hypervisor extension and add reproducible hardware-based CI that boots Xen and a Linux guest. ### Source excerpt Xen now boots a guest domain on physical RISC-V hardware, not just in QEMU. The board we used ships a CPU designed before the hypervisor extension was ratified, which turned out to be the whole challenge. ## Networking Aspects of Running VMs in Containers DevFeed: [Networking Aspects of Running VMs in Containers]() Original publisher: [Read original article]() Published: 2026-09-02T05:44:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [Containers](), [virtualization](), [networking](), [Linux](), [Orchestration]() Tags: [bridge](), [containers](), [docker](), [ethernet](), [linux](), [netlab](), [networking](), [podman](), [qemu](), [virtual-machines](), [virtualization]() ### AI overview The article explains how vrnetlab and a containerlab fork package virtual machines, especially network devices, as containers so container orchestration can provision network topologies. It focuses on connecting QEMU virtual network interfaces, Linux tap interfaces, bridges, and container veth pairs, including why data-plane and management interfaces require different handling. ### Source excerpt The vrnetlab project and its containerlab fork implement a wonderful idea: let's package virtual machines (primarily network devices that cannot be containerized) as containers to use reliable orchestration tools like containerlab to provision network topologies. That approach might have a few drawbacks (depending on how the container images are built), but the obvious elephant in the room is: how do you make the virtual network plumbing work? Read more ... ## Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact DevFeed: [Patching at Fleet Scale, Twice: How DigitalOcean Closed Januscape and the AMD Safe RET Issue Without Customer Impact]() Original publisher: [Read original article]() Author: Tim Lisko Published: 2026-08-24T21:25:19Z Content type: article Language: en Sources: [DigitalOcean]() Topics: [Digital Ocean](), [virtualization](), [vulnerability](), [Cloud](), [cloud security](), [Security](), [Exploit](), [Kernel](), [Linux]() Tags: [cloud](), [cloud-computing](), [cve](), [digitalocean](), [engineering](), [exploit](), [infrastructure](), [kernel](), [linux](), [security](), [trust-security](), [update](), [virtualization](), [vulnerability]() ### AI overview DigitalOcean describes how it responded to two serious vulnerabilities affecting its hypervisor fleet: Januscape, a KVM nested-virtualization flaw, was addressed with fleet-wide livepatching, while a separate AMD hypervisor vulnerability required kernel updates and reboots across roughly 1,600 hypervisors. The article reports zero confirmed customer-facing impact. ### Source excerpt Setting the stakes In early July, security researcher Hyunwoo Kim discovered Januscape (CVE-2026-53359), a flaw in KVM's handling of nested virtualization that could allow a malicious guest to escape into the host hypervisor. It was disclosed publicly on July 6 via the Linux oss-security mailing list. For a cloud provider, a guest-to-host escape is the most serious class of vulnerability there is: the hypervisor is the boundary that keeps each customer's workloads isolated from each other, and from our infrastructure itself. We responded, patched the entire fleet in eight days with zero confirmed customer-facing impact, and drafted a post about how we did it. Then, before we could hit publish, it happened again. In late July we learned of a second and unrelated vulnerability affecting our entire AMD hypervisor fleet, that could not be livepatched. Roughly 1,600 hypervisors needed a kernel update and a reboot. So now this story is about two responses, three weeks apart. The first built the muscle. The second proved it was repeatable, at a larger scale, and on a harder constraint. Here's how both played out, and why two of the most serious vulnerability classes in cloud computing ended up feeling like just another couple of weeks for us. Act one: Januscape The fast path: fleet-wide livepatching Our response kicked off the same night the vulnerability was disclosed. When public exploit code surfaced late in the evening of July 6, the Kernel Engineering team was paged and dug in immediately. Engineers reproduced the exploit in an isolated environment, confirmed which kernel lines were affected, and built the first working livepatch before 1 AM, roughly 45 minutes after answering the page. Livepatching lets us fix a running kernel in place, with no reboot, no migration, and no observed disruption to the customer. A few hours later, patches for the kernel versions (6.1 and 6.12) that run the majority of our hypervisor fleet were ready to ship. For the remainder, we had to ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-24T16:00:31Z Content type: article Language: en Sources: [Android Developers Blog]() Topics: [Android](), [Security](), [virtualization](), [virtual machines](), [SELinux](), [POSIX](), [Processes](), [Google]() Tags: [android](), [android-security](), [article](), [google](), [posix](), [process](), [security](), [selinux](), [virtual-machines](), [virtualization]() ### AI overview This article explains the security design of Android Automotive Operating System for Software Defined Vehicle (AAOS SDV). It describes virtualization for domain isolation, UID-based application and service sandboxing, POSIX capabilities, SELinux deny-by-default enforcement, and Android's vulnerability management and disclosure processes. ### Source excerpt Posted by Markus Vill, Software Engineer, Sean Keys, Security Engineer, and Istvan Nador, Software Engineer, Android Auto At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. While our release announcements focused on the features, this blog post outlines some of the security concepts. Foundation: Domain IsolationVirtualization to isolate co-hosted instances The current trend of consolidating Electronic Control Units (ECUs) into a single chip reduces isolation by running multiple domains side-by-side. While AAOS SDV instances provide internal isolation mechanisms, it is often preferable to run logical domains independently. For instance, a cluster and an infotainment system have distinct requirements. We use virtual machines to run multiple instances in parallel, ensuring that sharing remains explicit and isolation is the default behavior. Inherited Android Security AAOS SDV evolved from Microdroid, a minimalistic Android version optimized for privacy virtual machines (pVM). This lineage provides Android platform engineers with established security features they already know. Process Isolation & Deny by Default AAOS SDV follows Android's User ID (UID)-based isolation model to set up a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions. We employ Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pair this with Security-Enhanced Linux (SELinux) to enforce a "deny-by-default" posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. We apply this same strategy to our communication permission system, as explained l ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-24T16:00:31Z Content type: article Language: en Sources: [Android Developers Blog](), [Android Developers Blog]() Topics: [Android](), [Security](), [SELinux](), [virtualization](), [vulnerability management](), [Process](), [Resilience](), [Google]() Tags: [android](), [android-security](), [article](), [automotive](), [blog](), [deep-dive](), [google](), [process](), [resilience](), [security](), [selinux](), [virtualization](), [vulnerabilities](), [vulnerability-management]() ### AI overview AAOS SDV is presented as a secure-by-design platform for software-defined vehicles. The article explains how virtualization isolates co-hosted domains, while Android UID-based process sandboxes, POSIX capabilities, and SELinux enforce least privilege and deny-by-default access. It also describes vulnerability response, penetration testing, security audits, and architectural reviews. ### Source excerpt Posted by Markus Vill, Software Engineer, Sean Keys, Security Engineer, and Istvan Nador, Software Engineer, Android Auto At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. While our release announcements focused on the features, this blog post outlines some of the security concepts. Foundation: Domain IsolationVirtualization to isolate co-hosted instances The current trend of consolidating Electronic Control Units (ECUs) into a single chip reduces isolation by running multiple domains side-by-side. While AAOS SDV instances provide internal isolation mechanisms, it is often preferable to run logical domains independently. For instance, a cluster and an infotainment system have distinct requirements. We use virtual machines to run multiple instances in parallel, ensuring that sharing remains explicit and isolation is the default behavior. Inherited Android Security AAOS SDV evolved from Microdroid, a minimalistic Android version optimized for privacy virtual machines (pVM). This lineage provides Android platform engineers with established security features they already know. Process Isolation & Deny by Default AAOS SDV follows Android's User ID (UID)-based isolation model to set up a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions. We employ Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pair this with Security-Enhanced Linux (SELinux) to enforce a "deny-by-default" posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. We apply this same strategy to our communication permission system, as explained l ## The post-VMware playbook: what to move first, what to leave for last DevFeed: [The post-VMware playbook: what to move first, what to leave for last]() Original publisher: [Read original article]() Author: manuel@giantswarm.io (Manuel Gawert) Published: 2026-08-18T09:25:47Z Content type: tutorial Language: en Sources: [Giant Swarm Blog]() Topics: [migration](), [Proxmox](), [virtualization](), [Amazon Web Services](), [Azure]() Tags: [cost](), [cost-optimization-in-kubernetes](), [migration](), [open-source](), [platform-engineering](), [proxmox](), [time](), [virtualization]() ### AI overview This article presents a migration playbook for teams evaluating a move away from VMware. It focuses on sequencing workloads, deciding among Proxmox, Azure, and AWS, and accounting for workload fit, risk, time, and cost. It emphasizes making the infrastructure decision before moving workloads because migrations can stall when that decision is unresolved. ### Source excerpt The post-VMware playbook: what to move first, what to leave for last, and what each option costs in risk, time, and money. (Giant Swarm) ## We rebuilt the Linux microVM stack on Apple Silicon DevFeed: [We rebuilt the Linux microVM stack on Apple Silicon]() Original publisher: [Read original article]() Author: Ivan Cernja Published: 2026-08-18T00:00:00Z Content type: article Language: en Sources: [Encore Updates]() Topics: [Firecracker](), [virtualization](), [macOS](), [Linux](), [Dockerfile](), [Go Language]() Tags: [docker](), [firecracker](), [go](), [linux](), [macos](), [virtualization]() ### AI overview Encore rebuilt its Linux microVM development stack to work on Apple Silicon. The article describes crackling, an API that uses Firecracker on Linux and Apple's hypervisor on macOS, along with the tooling needed to run the same build system on developer laptops and in production. ### Source excerpt Maybe we should have just moved everyone to Linux. ## Test Days for Fedora 45: Help Us Test the Big Changes DevFeed: [Test Days for Fedora 45: Help Us Test the Big Changes]() Original publisher: [Read original article]() Author: Petr Sklenar Published: 2026-08-14T17:22:24Z Content type: article Language: en Sources: [Fedora Magazine]() Topics: [Fedora](), [boot](), [ci](), [virtualization](), [Internationalization (i18n)](), [Confidential Computing](), [dnf](), [TLS (Transport Layer Security)](), [Matrix]() Tags: [article](), [community](), [developers](), [dnf](), [events](), [fedora-project-community](), [graphics](), [kernel](), [new-in-fedora](), [python](), [qa](), [test-day](), [testing](), [tls](), [virtualization]() ### AI overview This article invites the Fedora community to test Fedora 45 system-level changes on real hardware and virtual machines. It highlights testing for GNOME 51, RPM 6.1, OpenSSL 4.0, rebuilt boot and live media, kmscon, Python 3.15, GRUB EFI for Confidential Computing, and internationalization changes. Community testing is intended to find regressions that automated tests may miss and to support reproducible bug reports. ### Source excerpt Fedora 45 has several system-level changes that need testing on real hardware. The first test day up is GNOME 51, starting on 17 August, with more events planned for RPM 6.1, installation media and others. You can participate with a VM for most tests; some hardware-specific testing is more useful on a real machine. Details [...] ## QEMU version 11.1.0 released DevFeed: [QEMU version 11.1.0 released]() Original publisher: [Read original article]() Published: 2026-08-11T23:56:00Z Content type: release Language: en Sources: [QEMU]() Topics: [qemu](), [virtualization](), [version](), [Availability](), [Arm](), [cpu](), [RISC-V](), [virtio]() Tags: [announce](), [arm](), [availability](), [bugs](), [cache](), [changelog](), [ci](), [cpu](), [documentation](), [gui](), [qemu](), [qemu-11-1](), [release](), [releases](), [risc-v](), [testing](), [version](), [virtio](), [virtualization]() ### AI overview QEMU 11.1.0 has been released with more than 3,200 commits from 285 authors. The release adds or improves emulation, virtualization, GUI, architecture, firmware, and accelerator support, including UFS features, ARM and RISC-V capabilities, nested virtualization, and new machine and board support. ### Source excerpt We'd like to announce the availability of the QEMU 11.1.0 release. This release contains 3200+ commits from 285 authors. ## 2.5x Faster x86\_64 Linux Builds on macOS with Rosetta DevFeed: [2.5x Faster x86\_64 Linux Builds on macOS with Rosetta]() Original publisher: [Read original article]() Author: Jacek Galowicz Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Nixcademy Blog]() Topics: [macOS](), [Nix](), [virtualization](), [qemu](), [x86](), [Linux]() Tags: [apple-silicon](), [install](), [macos](), [qemu](), [rosetta](), [run](), [virtualization](), [x86-64]() ### AI overview The article explains a new nix-darwin Linux builder backend that uses Apple's Virtualization.framework and exposes Rosetta to guest VMs. On Apple Silicon Macs, it supports x86_64 Linux builds and is reported to be roughly 2.5 times faster than QEMU-based emulation. ### Source excerpt Build x86_64 Linux packages 2.5x faster on your Apple Silicon Mac with the new Rosetta-based linux-builder, a drop-in replacement in nix-darwin. [Next page]()