Nested Virtualization for InterServer KVM Systems

We regularly review our infrastructure to ensure the highest levels of performance, stability, and security for your applications. Today, we want to share an important policy update regarding nested virtualization on our standard KVM VPS platform.

What is Nested Virtualization?

Simply put, nested virtualization is the ability to run a virtual machine (VM) inside an already existing virtual machine. For example, if you provision a KVM slice and then attempt to run your own hypervisor—like Proxmox or ESXi—inside that slice to host even more VMs, you are using nested virtualization.

Policy Change for New Hostnodes

Going forward, as we deploy new hostnodes running Ubuntu 26 LTS, nested virtualization will no longer be offered or enabled.

If your current KVM slice is running on a prior hostnode, nested virtualization support remains active at this time so your existing environments aren’t disrupted. However, for all future architecture planning, you should consider nested virtualization effectively unavailable on our standard KVM VPS plans.

Why Are We Making This Change?

Security is the primary driver behind this decision. The broader security community has identified significant potential attack surfaces related to nested virtualization setups.

A prominent example is the recent “Januscape” vulnerability, which involves a guest-to-host escape in KVM/x86 environments. When multiple customers share a single hardware hostnode, disabling nested virtualization is a necessary step to mitigate these complex risks and protect the integrity of the underlying hardware for everyone. We may re-evaluate this stance in the future as hypervisor security technologies evolve.

Need Nested Virtualization? Here Are Your Options

We understand that some of you have specific development or deployment needs that require nested virtualization. If your project relies on this feature, we still have you covered.

Nested virtualization remains fully supported and available on our Rapid Deploy systems as well as our Dedicated Servers. Because these environments provide dedicated hardware resources rather than sharing a hostnode hypervisor, the security profile allows us to safely offer nested virtualization without risking other tenants.

If you have any questions about how this update impacts your specific setup, or if you need help migrating a project to a Rapid Deploy or Dedicated system, please reach out to our support team. We are always here to help you find the right infrastructure fit.