Ask HN: What do you use VMs for regularly?
I know many people use VMs for work, or to test things they develop. Makes sense.
But what else do people use it for? I want to hear interesting or unusual things you use a VM for.
For example, I have thought of running a VM only to use git in there, maybe so try and see if magit will run faster in a VM rather than on the host macos. I also have thought of using a VM to only run a browser in there, to keep the memory under control. Not sure any of these are good, but they are interesting.
What are your ideas or actual ways you use VMs?
176 comments
[ 2.2 ms ] story [ 229 ms ] threadhttps://app.vagrantup.com/boxes/search?page=1
https://www.osboxes.org/virtualbox-images/
I use Parallels to run windows on a Mac, a pretty common use. I've heard of people running game servers in VM's e.g. Minecraft
It lets me test against all of them pretty easily. Tear down, spin up, repeat.
I learned that various versions of RHEL6 kernels have stuff like epoll() but others don’t and it’s not everything after kernel version X.Y. Joy.
Better than before when I had to support HP-UX, Solaris, AIX, etc. At least I have a consistent shell and least common denominator tools. That was like old school browser detection.
But yeah, a lot of focus on doing work without stressing the machine at all to not impact business workloads. Not my “day job”, but get pulled into emergencies because folks trust that I’ll do it. Log4j2 detection/validation was not fun. That was a “real cli” with a degraded pure shell fallback. And due to the lack of predictably, that was a try, fail, degrade. Nested jars/wars/ears suck when you can’t just play in memory.
I run macOS with virtualbox locally, but can get all the Linuxes I need and quickly ruby/shell a test harness.
Only annoying thing is remembering to remove them all when I’m done to get that disk back.
For other Linux users out there — a VM is not needed for this, use a cgroup with memory limits. It's very easy to do with systemd, but can be done without it:
The kernel will prevent Firefox from using more than 2 GiBs of RAM by forcing it into swap (including all child processes). To quote systemd.resource-control(5):> Specify the throttling limit on memory usage of the executed processes in this unit. Memory usage may go above the limit if unavoidable, but the processes are heavily slowed down and memory is taken away aggressively in such cases. This is the main mechanism to control memory usage of a unit.
If you'd rather have it OOMed, use MemoryMax=2G.
It's actually very useful for torrent clients. If you seed terabytes of data (like I do), the client quickly forces out more useful data out of the page cache. Even if you have dozens of gigabytes of RAM, the machine can get pretty slow. This prevents the client from doing that.
There are lots of other interesting controllers that can put limits on disk and network I/O, CPU usage, etc.
For most folks, they're right.
I prefer lxd for gui programs personally, while probably a tad more effort initially setting up the x11 profile to get gpu acceleration, once that is done you can pop everything into its own linux container using that profile. From there you can control resource limits permanently.
Especially like it for intrusive apps such as discord, zoom, etc which are hard to escape from.
Some of its more interesting features (in addition to the obvious path/privilege restrictions):
- putting the application into a separate network namespace with its own firewall rules/network interfaces (for example, you can force Firefox to work through a VPN connection only, or block incoming connections with your main firewall rules and allow them for a single application)
- using a separate X server for each application (works pretty much transparently)
- setting resource limits (network bandwidth, memory, CPU, I/O; although not as flexible as systemd limits, they can be combined)
- running `sudo firecfg` once will create a bunch of symlinks for all applications installed on your system and supported by firejail. After that, those applications will run under a sandbox automatically. Or you can create them manually (I did it for the PDF reader and such).
https://github.com/netblue30/firejail/
What if there's no swap (as I believe is the current fashion in desktop envs, unlike servers)?
In the end, I went and specifically hunted down Docker for use on servers to get an installation without all the Desktop cruft - even on that page [0] there's a big thing advertising Docker Desktop for Linux.
0: https://docs.docker.com/engine/install/
Another highly likely possibility is a proprietary filter from the printer manufacturer that wasn't complied as a universal binary or compiled with i386 dependencies and thus won't run on x64-only versions of the OS.
I could put multiple services on a single vm but split is easier mental model wise
So if I need a new VM I copy an existing inventory section for a VM (which has mem, cpu, NFS mounts etc variables defined), tweak that and run the deploy script with that.
Followed by another ansible script specific to the software piece I'm deploying.
Bit unorthodox (traditionally deploy part is terraform not ansible) but works for me. This is home server though...for cloud VMs I'd use terraform.
Installing tunnels and certs needed for contract work.
Experimenting with new software environments.
Testing and playing with older systems (Windows 9x, Linux distros from the 90s) for fun and kicks (or to compile some sutpidly old tarball of something that sounds interesting or fun but hasn't been updated in 15 years)
Building network meshes to play around with running BGP, OSPF etc. on FRRouting
All this works with a great, unified interface on Qubes OS (https://qubes-os.org). See also: https://forum.qubes-os.org/t/how-to-pitch-qubes-os/4499/15.
That's right.
> but the idea that it easy to get inside vm keeps me from doing it
No! Of course the host is the ultimate dictator. Just don't do untrusted operations in the host context. Have low-trust, low-connectivity, low resource level VM for untrusted work.
This makes me wonder how many security holes CPUs have which have been buried into secrecy by the manufacturers.
Most VM escapes happen through buggy virtual-devices written in C/C++/.. code. Virtual-device bugs that are exploitable by attackers with root access in the VM are found frequently.
An attacker would need to do some quite invasive hardware tampering to get a third party hypervisor to work on a system secured like that.
Furthermore, preventing hypervisor detection requires constant updates if the OS itself is configured to check for the presence of a hypervisor. There's a constant arms race going on between security researchers and cybercriminals who don't want their malware to trigger on analysts' machines, many of which use virtualization to easily reset the system back to a known, secure state. Every time malware comes up with a new method of detection your evil hypervisor needs to be patched to fake that stuff too or you risk detection next time the OS updates its detection algorithms.
See also: https://forum.qubes-os.org/t/verified-boot-on-qubes-a-lofty-...
It's nearly worth it for avoiding Google's terrible account switching UX alone :)
I've been using QubesOS as my daily dev machine for a couple of years now. No regrets. I really like that I've set up each of my clients' work in their own VMs, so there's no way one can pollute the other.
Switching back to macOS is a relief for some tasks, but it feels dirty smudging all my different types of task into the one OS again.
Because 2 years ago I moved back to Windows from MacOS for my daily driver because of WSL2.
I get the same "modern GUI on top, Unix-like shell underneath" experience that I had with MacOS but now I have a 24-core machine with 32GB of RAM for a third (or less) the price of what a similar Mac would have cost me.
The only thing I've had to add to it is an addon called Owl for accessing MS Exchange with Thunderbird at my previous employer. But stock Thunderbird is good enough for accessing Office 365 where I work now.
Plasma feels more predictable to me than Windows does, and I really like what it builds into the desktop environment itself. The essentials— window management, the volume mixer, global keyboard shortcut configuration, the panels, the desktop, compose key support, the default terminal emulator, the network management applet, display configuration, the default GUI text editor, the file manager, etc.— all feel just right to me, with very little tweaking required. What configuration is required is straightforward in the GUI and super easy to automate or save in my dotfiles.
Some of this is my own habituation to Plasma's quirks over the years, and some of it is my usage patterns not intersecting with open issues that Windows users would likely find strange. But I do think it's genuinely a wildly underrated desktop that a lot of developers would quickly come to love if they gave it a chance.
I'm curious as to what pain points make you avoid it. Do you prefer the windows GUI interface? do you not want to deal with with updates breaking your system or having to manage things yourself? or are there programs that you use on windows that aren't available on linux? (or something else).
I want to stress that this is a good faith question. (since it seems flame-war territory adjacent, which I'm not interested in getting into).
I think the other question is, why would one want to use desktop Linux? With Windows 11 and WSL2, I get both. I can run all my normal apps on Windows 11, and if I really want to run GUI apps on WSL2, I can do that too.
Honestly, Windows plus WSL is the most "just works" platform out there right now. macOS is far too brittle and a compromise between high-level OS and a Unix-like environment. Linux does Linux, obviously, but it struggles as a low-friction, high-level OS.
GNOME 4 is superior to Windows and MacOS as low-friction, high-level OS in my experience. Control panel is clear, if spartan, three finger gestures stolen from MacOS "just work", and the desktop just stays out of the way so I can focus on the applications that I really care about.
I have not had a "struggle with drivers" for over a decade with Ubuntu, Fedora, and Manjaro (YMMV in other distros of course, but it's much more uniform these days), and Windows has become even worse with doing unnecessary BS work in the background slowing down the GUI such that heavyweight desktops like GNOME and KDE feel as svelte as LXDE in comparison.
I honestly can't stand any time I have to use a Windows machine due to how inconsistent the settings are, how many ~200-300ms pauses happen randomly, especially when I'm trying to type, and applications that don't "just work" but only because of the high marketshare I can google a solution. (MacOS is less viscerally disgusting to me, but more disappointing due to all of the "small" bugs that have creeped in despite having 100% control of the hardware in question. Wake-from-sleep shouldn't screw up the Wifi, unplugging and plugging back in an external monitor shouldn't shuffle the window locations, etc.)
Last time I tried Linux, driver support for my new graphics card was poor, my multi-monitor displayport setup was unsupported, DPI scaling - despite even Windows supporting it well for the previous 5 years - was quite bad (and non-integer scaling especially so). Even my CPU simply didn't work without some custom boot args.
So when it comes to "just works", the year of the linux desktop is here if your hardware is at least 2 years old. There's nothing wrong with 2-year-old hardware, but whenever I get a new computer, I install Windows and it just works, rarely do I ever have a good enough reason to switch to Linux given the effort involved.
Ubuntu/Debian tend to take longer to support brand new hardware because they're more conservative with kernel updates, but you can also just use the System76 PPA to get a super-recent kernel on Ubuntu. But faster-paced or rolling distros like Fedora or Manjaro are best for that kind of thing.
I haven't had a single GPU-related issue, AMD or nVidia, for about a decade, if you're willing to go with non-free drivers.
> I haven't had a single GPU-related issue, AMD or nVidia, for about a decade
While I might be off-base, I would wager that you have probably forgotten and not noticed the amount of times you have debugged these things and other driver-related issues.
I had way more problems debugging weird crap with the Wifi when walking between meetings with my MacBook Air, annoyed that when I plugged back into my monitor at my desk I would have to rearrange my windows on my desktops again (GNOME 4 puts the windows back where they were if you plug back into the exact same monitor). And dealing with Homebrew BS because Apple likes to break it on OS updates and sometimes it would break randomly on its own while Debian-derived distros never have package issues pushed me back.
Just saying that you really ought to try it out again, and Fedora is a super-polished GNOME experience if you want "Mac-like, but not annoying."
I used to be a heavy Macbook user but am no longer. I use Windows because it simply has the least amount of friction. Every time I try Linux for anything other than a certain style of software development, it's an endless chain of web searching and configuration. Windows is far superior to macOS in terms of memory management. On a high-end Macbook Pro with 16GB, I am almost always maxed out, and the Macbook can't even drive my monitor properly with a dedicated graphics card. Mouse and keyboard settings reset every other day. I can't even imagine how much time I would have to spend setting up just my monitor, webcam, mouse, and keyboard setup with Linux, if drivers and applications are even available. My Windows laptops and desktops don't have any of these issues.
What webcam, mouse, or keyboard doesn't work with Linux? I have not run into one, and I have several weird ones like the Tap keyboard.
And apparently the fingerprint scanner works but I just never got around to it because I don’t care.
So, I have spent zero minutes setting up hardware on Linux in at least the last 15 years and then it was one of those hand tracking things the company donated to the Blender Foundation that I ended up with which was experimental so didn’t have drivers in the distro.
Is the Linux experience perfect? Certainly not, there can be hiccups - try guiding someone on the other side of a phone line through connecting one of those Dell USB3 docks which needs that Synaptic-provided DisplayPort driver - but compared to Windows it is a breath of fresh air. Since Linux in general only serves one master - you - where Windows has to serve at least two - Microsoft first, you may come in second but it is quite possible for some other vendors to push themselves in front of that queue - this is hardly surprising.
I have nothing against Linux (or MacOS), and it was a fair question.. =)
I think for lots of people it would be a very suitable choice, and if I had a "work only" machine, I would absolutely consider Linux, probably even over MacOS at this point..
But for my specific uses, Windows (with WSL2) lets me do all the things I want to with one machine, so it's the winner.
I've had great use of VMs when testing more boutique and unsupported software, where I need to test compatibility on various versions of OS
(2 minutes for starting the project outside vs 25 seconds inside)
I'm also running android-x86[1], for a single mobile game with an x86 port
[1] https://www.android-x86.org/
(DVD-A is a variant of the DVD format where audio is lossless, compressed using MLP. (Very similar to FLAC.) In general, DVD-A is 100% obsolete because Bluray supports lossless audio over HDMI without a special player. Unfortunately, some artists still release on DVD-A for reasons I don't fully understand.)
I use a VM on my work machine to get around Docker Desktop licensing on macOS. I also use VMs on my work and personal machines to test out new-to-me OSes that I want to play with but don't necessarily want to run full time. And once upon a time, I used VMs heavily to write and test Chef cookbooks, but those days are mostly over for me.
Perhaps my understanding is outdated, but I remember a time when the GPU was somewhat limited when virtualized since it potentially needed to be shared as well be exposed through a common layer.
Maybe this doesn't matter for all use cases, but for Plex especially when it's doing transcoding, I'd imagine it's very important.
On the other hand, I was able to very easily get GPU pass through working on Emby inside and LXC container.
The challenge is getting your friends and family to change the default prefer-transcoding behavior every time they fire up a new client.
I know you can use tricks like tautulli events to terminate transcode streams but they're difficult to deploy and a bad UX for the users even at their best. Better to have Plex tell users something like "This content can't be played at your preferred bitrate X, would you like to use more data to play at full bitrate Y? Yes/No/Always"
And of course for learning. For example you can learn a lot about operating systems if you can just run any older version at your will.
Also, you are obviously speaking of virtualization of a given hardware platform but a lot of stuff is modeled as a "virtual machine" in the generalized sense - e.g. the pickle Python format.
[1] https://www.rodsbooks.com/refind/