What is Virtainer?
Updated
Virtainer is self-hosted virtualization that turns an image into a virtual machine. You give it a Linux cloud image or an OCI (Docker) image, and it runs that image as a full virtual machine on your own hardware, with its own kernel, its own storage, and a hardware-enforced isolation boundary.
Every machine runs on Linux and KVM. There is no shared container runtime and no orchestration stack to assemble. Virtainer installs on a single host as one appliance, and you operate it from a web UI or an API.
Where Virtainer fits
Section titled “Where Virtainer fits”Most workloads are placed by choosing between two models:
- Virtual machines give strong isolation, with a separate kernel behind a hardware boundary. They are also heavy and slow to start.
- Containers are fast and dense, but they share the host’s kernel, so the boundary between workloads is a kernel feature rather than hardware.
Virtainer aims at the middle ground: microVM-style isolation at close to container start-up speed. It reaches that ground from the machine side. The unit you run is always a real machine, and container-image convenience is layered on top. The more common microVM approach does the reverse. It keeps the container as the unit and places a stronger boundary underneath, while still carrying a runtime, scheduler, and network plugins along with it.
The result is VM-grade isolation without Kubernetes, CRI, CNI, or CSI. Nothing extra sits in the data path while a machine runs, so there is less to secure and fewer moving parts that can fail.
Two machine types
Section titled “Two machine types”Virtainer runs two kinds of machine from the same engine:
| Type | Source image | What you get |
|---|---|---|
| VM | A standard Linux cloud image | A normal Linux server, with cloud-init, disks, networking, and a console. |
| AppVM | Any Docker / OCI image | The application image booted as its own VM, with its own kernel and disk and no container engine inside the guest. |
A VM behaves like any cloud instance you have run before. Pick a Linux cloud image, let cloud-init handle first-boot configuration, attach disks and networking, and open a console.
An AppVM is the less familiar one. An OCI image is not bootable on its own: it is a root filesystem plus some metadata, with no kernel and no init. Virtainer supplies both. It imports the image once, gives it a guest kernel and its own init, and boots the result as a real VM that comes up in seconds. After import, the running machine has no link back to a registry.
That init is the part that makes an AppVM possible, and Virtainer wrote it from scratch. It runs as the guest’s first process, in place of any Docker or container engine, and turns a plain application image into a running machine. It owns the lifecycle directly and provides the controls you expect from a container: auto-restart, resource limits, sealed secrets, and health checks. Because nothing else runs in the guest to do that job, there is less inside each machine to secure and maintain.
You can run an AppVM stateless or keep its disk across reboots. It is built for code you do not fully control, such as AI agents, untrusted or third-party images, and internal services you want to keep apart, but ordinary services like nginx run exactly the same way.
The appliance model
Section titled “The appliance model”Virtainer Lite ships as a single, self-contained Fedora bootc image. The host system is immutable: your configuration and data persist, and everything else is read-only. Updating the host is an image switch rather than a package upgrade. You can stage it ahead of time, and a checkpoint is taken automatically, so you can roll back in a single reboot. You always know which version a host is running, and there is no configuration drift to track down. The entire product lives on that one host, with no separate control plane to install.
Platform capabilities
Section titled “Platform capabilities”- Resilient storage: pool multiple drives with redundancy, with early warning when a disk starts to fail.
- Bridged networking: each machine gets a real presence on your network through a Linux Layer 2 bridge, with optional anti-spoofing and port isolation.
- Resource control: cap CPU, memory, and disk I/O per machine, with safe oversubscription of host resources.
Editions and availability
Section titled “Editions and availability”- Virtainer Lite is the single-host appliance, and it is available now (currently in beta). One host runs everything described above: the web UI and API, the VM and AppVM engine, an image cache, storage and network setup, metrics, and the full machine lifecycle.
- Virtainer Basic adds a central layer for running more than one host as a cluster. It is coming soon.