Skip to content
Virtainer Docs Virtainer Docs Virtainer Docs

What is Virtainer Lite?

Updated

Virtainer Lite is self-hosted virtualization that runs on one host. You give it a Linux cloud image or an OCI (Docker) image, and it runs that image as a full virtual machine on your own hardware, with its own kernel, its own storage, and a hardware-enforced isolation boundary.

Every machine runs on Linux and KVM. There is no shared container runtime and no orchestration stack to assemble. Lite installs on a single host as one appliance, and you operate it from a web UI or an API. It is available now, and currently in beta.

What one host gives you

Section titled “What one host gives you”

The entire product lives on that one host, with no separate control plane to install:

  • the web UI and the API
  • the VM and AppVM engine
  • an image cache
  • storage and network setup
  • metrics
  • the full machine lifecycle

Two machine types

Section titled “Two machine types”

Virtainer Lite runs two kinds of machine from the same engine:

TypeSource imageWhat you get
VMA standard Linux cloud imageA normal Linux server, with cloud-init, disks, networking, and a console.
AppVMAny Docker / OCI imageThe application image booted as its own VM, with its own kernel and disk and no container engine inside the guest.

A VM behaves like any cloud instance you have run before. Pick a Linux cloud image, let cloud-init handle first-boot configuration, attach disks and networking, and open a console.

An AppVM is the less familiar one. An OCI image is not bootable on its own: it is a root filesystem plus some metadata, with no kernel and no init. Virtainer supplies both. It imports the image once, gives it a guest kernel and its own init, and boots the result as a real VM that comes up in seconds. After import, the running machine has no link back to a registry.

That init is the part that makes an AppVM possible, and Virtainer wrote it from scratch. It runs as the guest’s first process, in place of any Docker or container engine, and turns a plain application image into a running machine. It owns the lifecycle directly and provides the controls you expect from a container: auto-restart, resource limits, sealed secrets, and health checks. Because nothing else runs in the guest to do that job, there is less inside each machine to secure and maintain.

You can run an AppVM stateless or keep its disk across reboots. It is built for code you do not fully control, such as AI agents, untrusted or third-party images, and internal services you want to keep apart, but ordinary services like nginx run exactly the same way.

Where Virtainer Lite fits

Section titled “Where Virtainer Lite fits”

Most workloads are placed by choosing between two models:

  • Virtual machines give strong isolation, with a separate kernel behind a hardware boundary. They are also heavy and slow to start.
  • Containers are fast and dense, but they share the host’s kernel, so the boundary between workloads is a kernel feature rather than hardware.

Virtainer aims at the middle ground: microVM-style isolation at close to container start-up speed. It reaches that ground from the machine side. The unit you run is always a real machine, and container-image convenience is layered on top. The more common microVM approach does the reverse. It keeps the container as the unit and places a stronger boundary underneath, while still carrying a runtime, scheduler, and network plugins along with it.

The result is VM-grade isolation without Kubernetes, CRI, CNI, or CSI. Nothing extra sits in the data path while a machine runs, so there is less to secure and fewer moving parts that can fail.

The appliance model

Section titled “The appliance model”

Virtainer Lite ships as a single, self-contained appliance image. The host system is immutable: your configuration and data persist, and everything else is read-only. Updating the host is an image switch rather than a package upgrade. You can stage it ahead of time, and a checkpoint is taken automatically, so you can roll back in a single reboot. You always know which version a host is running, and there is no configuration drift to track down.

Platform capabilities

Section titled “Platform capabilities”
  • Resilient storage: pool multiple drives with redundancy, with early warning when a disk starts to fail.
  • Bridged networking: each machine gets a real presence on your network through a Linux Layer 2 bridge, with optional anti-spoofing and port isolation.
  • Resource control: cap CPU, memory, and disk I/O per machine, with safe oversubscription of host resources.

Lite and Basic

Section titled “Lite and Basic”

Virtainer Lite is the single-host edition, and it runs everything described above on one machine. Virtainer Basic adds a central layer for running more than one host as a cluster. It is coming soon.

Where to go next

Section titled “Where to go next”

Start here and work down, or jump to the part you need: