What Is a Virtual Machine?

Virtual MachinesLesson 1 of 420 minutes

Learning objectives

By the end of this lesson

• Explain the difference between a host computer and a guest virtual machine.
• Describe what the hypervisor does.
• Explain why snapshots are useful but are not backups or perfect security boundaries.
• Choose the correct setup guide for your computer.

A computer inside your computer

Before we start exploring Linux, we need somewhere to explore it. We could install Linux directly on your computer, but that turns every mistake into a problem for the computer you use for everything else. It also makes “start over” a much more ambitious instruction than it needs to be.

Instead, we will use a virtual machine, usually shortened to VM.

A virtual machine is a computer created in software. It has virtual processors, memory, storage, networking, and other hardware. We can install an operating system inside it, start it, shut it down, and break it without reinstalling the computer sitting on your desk.

The physical computer is the host. The operating system running inside the VM is the guest. Software such as VMware Workstation, Hyper-V, or UTM sits between them and provides the virtual hardware. That software is called a hypervisor.

Key concept

The apartment-building model

Think of the host as an apartment building and each VM as an apartment. The building supplies shared resources, but each apartment has its own rooms and locks. A tenant can make a mess without automatically redecorating every other apartment.

The analogy stops being accurate at the locks. VM isolation is useful, but hypervisors are still software and software can have bugs. A VM is a boundary, not a magical containment spell.

Virtual hardware still uses real hardware

When we assign four processor cores and eight gigabytes of memory to a VM, we have not created those resources out of optimism. The hypervisor schedules time on the host’s real processor and reserves some of its real memory.

The same applies to storage. A virtual disk normally appears as one or more files on the host. The guest sees that file as though it were a physical drive. If the virtual disk grows to 40 GB, the host must have roughly 40 GB available to store it.

For this course, the comfortable target is a host with at least 16 GB of memory and 80 GB of free storage. We will normally give the course VM 8 GB of memory, four virtual processor cores, and a virtual disk with room to grow to 60 GB. A machine with 8 GB of total memory can still work, but you may need to assign only 4 GB to the VM and close other applications while it runs.

Why this course uses a VM

A consistent environment

Every student will use the same general Linux distribution and architecture. Commands, file locations, tools, and lab artifacts should therefore behave the same way instead of depending on whatever happens to be installed on the host.

A disposable workspace

We are going to install tools, change configurations, crash programs, and eventually run intentionally vulnerable software. Those activities belong in a machine built for experiments, not beside your tax documents and saved browser passwords.

Snapshots

A snapshot records enough of a VM’s current state to return to that point later. Before a risky experiment, we can take a snapshot. If the guest becomes unusable, we restore it instead of spending an afternoon undoing damage we only vaguely remember causing.

A snapshot depends on the original VM files, so it is not a backup. If the host drive fails or the VM directory is deleted, its snapshots usually disappear with it.

Controlled connections

The hypervisor controls how the guest connects to the host and the network. We will begin with NAT networking, which lets the guest reach the internet through the host without normally exposing the guest as another directly reachable machine on the local network. Later labs may use more restrictive networks when the target does not need internet access.

Safety note

Convenience creates openings

Shared folders, shared clipboards, USB passthrough, and networking connect the guest to things outside it. They are useful, but each connection weakens the separation we built the VM to provide. We will enable them only when a lesson needs them.

Virtualization and emulation

Virtualization runs guest code on a host processor with the same architecture. An x86-64 Windows computer can virtualize an x86-64 Linux guest efficiently.

Emulation makes one processor architecture behave like another. Current Macs use Apple Silicon ARM processors, while the course targets use the x86-64 architecture common to Intel and AMD computers. UTM can emulate x86-64 on Apple Silicon, but translating instructions adds overhead.

We are accepting that slower performance to keep the course environment consistent. An ARM Linux VM may feel faster on an Apple Silicon Mac, but it will produce different machine code and will not run every x86-64 lab artifact. That difference becomes very important once we begin reading assembly.

Choose your setup guide

• VMware Workstation 17: the recommended option for Windows 10 or 11 Home, Pro, or Enterprise on an Intel or AMD processor.
• Hyper-V: a built-in option for Windows 10 or 11 Pro or Enterprise. It is not included with Home editions.
• UTM: the course option for macOS. The guide covers both Intel and Apple Silicon Macs.

Do not install both VMware Workstation and Hyper-V merely to compare buttons. They can coexist on current Windows systems, but the extra hypervisor layer can reduce VMware performance and makes troubleshooting less pleasant. Pick one and continue.

Knowledge check

Question 1 of 3

What is the guest in a virtual-machine setup?

The physical computerThe operating system inside the VMThe hypervisor

Check answer

Next, follow the setup guide for your host computer.