Chapter 8: Virtualization and Containers

Updated

October 31, 2026

Chapter 8: Virtualization and Containers

Workload isolation has evolved from heavyweight virtual machines into a continuous spectrum: from bare-metal containers sharing a single kernel, to system containers managing full init systems, to hardware-isolated virtual machines, and ultimately to hardware-encrypted Confidential Virtual Machines (CVMs).

Ubuntu 26.04 LTS is the reference operating system across all these virtualization layers: KVM/QEMU with libvirt, LXC/LXD system containers, Docker and containerd, rootless Podman, and hardware-enforced Intel TDX and AMD SEV-SNP confidential enclaves.

This chapter details the deployment, administration, and performance tuning of virtualized workloads on Ubuntu 26.04 LTS.

The Virtualization and Container Spectrum

┌────────────────────────────────────────────────────────────────────────┐
│                   THE WORKLOAD ISOLATION SPECTRUM                      │
│                                                                        │
│   Isolation Level   Technology                Primary Use Case         │
│   ───────────────   ──────────                ────────────────         │
│   Lightweight       Docker / Podman           Microservices & CI/CD    │
│   System-Level      LXC / LXD                 Full Linux OS Containers │
│   Hardware-Emulated KVM / QEMU (libvirt)      Heterogeneous OS Guests  │
│   Hardware-Encrypted Intel TDX / AMD SEV-SNP  Zero-Trust Cloud CVMs    │
└────────────────────────────────────────────────────────────────────────┘

QEMU/KVM Virtualization Fundamentals

The Kernel-based Virtual Machine (KVM) turns the Linux kernel into a Type-1 hypervisor:

# Verify CPU hardware virtualization support (Intel VT-x or AMD-V)
egrep -c '(vmx|svm)' /proc/cpuinfo
# Output must be > 0

# Install QEMU/KVM, libvirt daemon, and command-line tools
sudo apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virtinst

# Ensure current user is in libvirt group
sudo usermod -aG libvirt $USER

libvirt and virsh Management

Management of virtual machines is coordinated through virsh:

# Provision a headless Ubuntu 26.04 VM using virt-install
virt-install \
  --name u26-guest01 \
  --ram 4096 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/u26-guest01.qcow2,size=20,bus=virtio \
  --os-variant ubuntu24.04 \
  --network bridge=virbr0,model=virtio \
  --graphics none \
  --console pty,target_type=serial \
  --location /var/lib/libvirt/images/ubuntu-26.04-server-amd64.iso \
  --extra-args 'console=ttyS0,115200n8 serial'

# Lifecycle Operations
virsh list --all             # List all defined virtual machines
virsh start u26-guest01      # Power on virtual machine
virsh console u26-guest01    # Connect to serial console (Exit: Ctrl + ])
virsh shutdown u26-guest01   # Clean ACPI shutdown
virsh snapshot-create-as u26-guest01 snap1 "Before OS upgrade"

LXC/LXD System Containers

Unlike Docker which is designed to package a single application process, LXD provides complete system containers that boot an entire Ubuntu, Debian, or Alpine userland with full systemd init management:

# Initialize LXD storage pools and network bridge
sudo lxd init --auto

# Launch a pure Ubuntu 26.04 system container in seconds
lxc launch ubuntu:26.04 web-container

# List running containers
lxc list

# Execute an interactive root bash shell inside the container
lxc exec web-container -- bash

# Snapshot and clone
lxc snapshot web-container backup-v1
lxc copy web-container web-staging

Docker and containerd: Dual-Track Updates

Ubuntu 26.04 maintains dual-track availability for Docker environments: 1. Ubuntu Archive Track (containerd, docker.io): Maintained and security-patched directly through Canonical’s standard APT repositories. 2. Docker Upstream Track (docker-ce): For organizations requiring bleeding-edge Docker releases.

# Install native container runtime
sudo apt install -y docker.io containerd

# Enable rootless Docker or add user to docker group
sudo usermod -aG docker $USER

# Verify container runtime execution
docker run --rm hello-world

Rootless Podman and Distrobox

For development and multi-user environments where developers should not possess daemon-level root privileges, Podman provides a daemonless, rootless container architecture:

sudo apt install -y podman distrobox

# Run container without root privileges (utilizes user namespaces)
podman run -d --name my-redis -p 6379:6379 redis:alpine

# Distrobox: Seamlessly run other Linux distributions integrated with your desktop
distrobox create --name arch-dev --image archlinux:latest
distrobox enter arch-dev

Inside the Distrobox container, your home directory, display server, audio, and GPU are mounted natively without configuring complex bridge tunnels.

Confidential Computing: Intel TDX and AMD SEV-SNP

In zero-trust and multi-tenant cloud environments, workloads run inside Confidential Virtual Machines (CVMs).

┌────────────────────────────────────────────────────────────────────────┐
│                   CONFIDENTIAL COMPUTING ARCHITECTURE                  │
│                                                                        │
│   Untrusted Cloud Operator / Compromised Hypervisor (Ring 0 / Root)    │
│              │                                                         │
│              ▼ [ BLOCKED BY HARDWARE MEMORY ENCRYPTION ]               │
│                                                                        │
│   ┌────────────────────────────────────────────────────────────────┐   │
│   │   Confidential Virtual Machine (Guest Kernel + Customer App)  │   │
│   │                                                                │   │
│   │   - CPU Registers encrypted per-vCPU                           │   │
│   │   - Physical RAM encrypted via AES-XTS (Intel MKTME / AMD SME) │   │
│   │   - Hardware Remote Attestation report cryptographically signed │   │
│   │     by AMD / Intel root keys before secrets are provisioned!   │   │
│   └────────────────────────────────────────────────────────────────┘   │
└────────────────────────────────────────────────────────────────────────┘

Launching an AMD SEV-SNP Guest on Ubuntu 26.04

Ubuntu 26.04 LTS includes native KVM support for SEV-SNP and Intel TDX guest attestation:

# Verify host CPU confidential computing capability
sudo dmesg | grep -E "(SEV-SNP|TDX)"

# Launch QEMU with AMD SEV-SNP guest memory encryption enabled
qemu-system-x86_64 \
  -enable-kvm \
  -cpu EPYC-v4 \
  -machine q35,confidential-guest-support=sev0,memory-backend=mem0 \
  -object memory-backend-memfd,id=mem0,size=4G,share=true,prealloc=true \
  -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1 \
  -drive file=u26-cvm.qcow2,if=virtio \
  -nographic

The guest OS verifies its cryptographic attestation measurement before retrieving decryption keys from enterprise key vaults (e.g., HashiCorp Vault), guaranteeing that untrusted cloud administrators cannot inspect memory payloads.

Chapter Summary

  • KVM and libvirt provide hypervisor performance with enterprise management via virsh.
  • LXC/LXD delivers lightweight, full-distribution system containers with dedicated systemd inits.
  • Docker and containerd provide microservice packaging via native Ubuntu packages.
  • Podman and Distrobox enable daemonless, rootless containers for secure developer workstations.
  • Confidential Computing with Intel TDX and AMD SEV-SNP delivers hardware-encrypted memory enclaves for untrusted public clouds.