Hypervisors: type 1, type 2, and what each one is for

Why this matters

Virtualisation is the smallest domain on this exam and the one with the widest reach into the rest of the job. A technician who can build a virtual machine can test an operating system upgrade without risking a user's machine, keep a legacy application alive on a modern host, and run the isolated environment that half the labs in this course ask for.

The exam asks for the type 1 and type 2 distinction, the resource implications, and the firmware requirement. That last one accounts for a large share of real support calls: a hypervisor that refuses to start, or a virtual machine that will only run 32-bit guests, is almost always a disabled firmware setting.

This is also the one domain in Core 1 that a reader can explore fully with the machine they already own, which is why lesson 30 is entirely hands-on.

The lesson

What a hypervisor does, stated as who owns the hardware

A hypervisor presents virtual hardware to guest operating systems and schedules real hardware behind it. Each guest believes it has a processor, memory, disks and network adapters of its own, and the hypervisor arbitrates.

The useful way to hold the distinction is who owns the hardware:

• In a type 1 arrangement, the hypervisor owns it. It is installed directly on the machine, with no general-purpose operating system beneath it.
• In a type 2 arrangement, an ordinary operating system owns it, and the hypervisor is an application running on that operating system.

Everything else follows. A type 1 hypervisor has no desktop to slow it down and no unrelated software to crash it. A type 2 hypervisor shares the machine with a web browser and whatever else the user is running, which is convenient and means the guest's performance depends on the host's mood.

The properties virtualisation provides, and why they matter beyond the exam:

• Isolation. A guest's crash does not affect the host or other guests.
• Encapsulation. A machine is files, so it can be copied, moved and backed up like any other file.
• Hardware independence. A guest sees standard virtual devices, so it moves between physical hosts without caring what they are made of.
• Consolidation. One physical machine runs many workloads, each of which used to need its own box.

Type 1 on bare metal against type 2 on a desktop operating system

Type 1, also called bare-metal or native:

• Installed directly on the hardware.
• Better performance and lower overhead, because there is no host operating system competing for resources.
• More reliable: a smaller code base with less to go wrong.
• The choice for servers and data centres.
• Managed remotely; there is typically no local desktop to sit in front of.

Type 2, also called hosted:

• Installed as an application on Windows, macOS or Linux.
• Easier to set up, and the host machine remains a normal machine.
• Slower, because every guest operation passes through the host operating system.
• The choice for development, testing, training and running one legacy application.

The distinction is occasionally blurred in practice — some platform hypervisors are built into a desktop operating system and behave like type 1 while looking like a feature of the host. The exam asks the clean version, and the clean version is about whether a general-purpose operating system sits underneath.

Choosing from a scenario: a requirement mentioning production workloads, consolidation, many guests or high availability is type 1. A requirement mentioning a technician's laptop, testing, training or one old application is type 2.

Processor virtualisation support, and the firmware setting that has to be on

Modern processors include hardware assistance for virtualisation — Intel VT-x or AMD-V, with a second feature for device passthrough (VT-d or AMD-Vi). Without it, a hypervisor must emulate privileged instructions in software, which is dramatically slower, and most modern hypervisors simply refuse to run.

It is disabled by default on a great many machines. That single fact explains a large fraction of the virtualisation support calls a technician meets:

• The hypervisor refuses to install or start, reporting that virtualisation is unavailable.
• A 64-bit guest cannot be created, and only 32-bit options are offered.
• Performance is unusably poor where the hypervisor falls back to emulation.
• Container or subsystem features on the host will not start.

The fix is a firmware setting, usually under a CPU or advanced menu, named something like Intel Virtualization Technology, SVM Mode, or simply Virtualization. Lesson 27 covers getting into the firmware.

One complication worth knowing because it produces a confusing symptom: on a Windows host, some security features take exclusive ownership of the virtualisation extensions, and a third-party type 2 hypervisor then reports that virtualisation is unavailable even though it is enabled in firmware. The resolution is a host configuration question rather than a hardware one.

Resource allocation: processors, memory, storage and what overcommitting costs

A hypervisor divides finite resources, and each behaves differently when oversubscribed.

• Processor. Virtual processors are scheduled onto real cores. Allocating more virtual processors in total than there are real cores is normal and usually fine, because guests are mostly idle. Allocating many virtual processors to one guest can make it slower, because the scheduler may wait for enough cores to be free simultaneously.
• Memory. The least forgiving resource. A guest given memory the host does not have forces the host to page to disk, and the resulting collapse in performance affects everything on the machine. Leave the host enough — on a desktop, at least 4 GB and preferably more.
• Storage. Guests are files on the host's storage and they compete for the same throughput. Several guests on one mechanical drive is the classic reason a lab feels unusable; solid-state storage transforms it.
• Network. Shared through a virtual switch, with the host's adapter as the path out.

Overcommitting means allocating more than exists, on the assumption that not everything is busy at once. It is standard practice in production for processor and, carefully, for memory. The cost when the assumption fails is contention: everything becomes slow at the same time, which is harder to diagnose than one thing failing.

The rule for a bench machine: size each guest for what it actually needs rather than what seems generous. Four virtual processors and 8 GB for a machine that will run a text editor takes resources from the host for no gain.

Security implications of running an untrusted system on your own machine

Virtualisation provides isolation, and the exam expects a technician to know both that it is useful and that it is not absolute.

What isolation gives you:

• A guest cannot see the host's memory or files by default.
• A compromised guest can be deleted and rebuilt from a snapshot in minutes.
• Malware analysis and testing of untrusted software have a safe home — which is why a sandbox is usually a virtual machine.

What breaks the isolation, and these are the configuration choices to notice:

• Shared folders and drag-and-drop, which create a direct path between guest and host. A guest handling anything untrusted should have neither.
• Bridged networking, which puts the guest directly on the physical network. An isolated or host-only network keeps it contained. Lesson 30 covers the modes.
• Device passthrough, which gives a guest direct access to real hardware.
• Snapshots that are never cleaned up, which retain the compromised state as well as the clean one.
• Escape vulnerabilities, which are rare, real, and the reason isolation is a strong control rather than a perfect one.

The other direction matters too: a guest is a full machine and needs the same care as a physical one. It needs patching, it counts for licensing, and a forgotten guest running an unpatched operating system on a bridged network is an exposure that nobody is monitoring. Virtual machine sprawl — guests created for a purpose and never removed — is the operational version of that problem, and the exam names it.