Nested virtualization (KVM inside a VM) across common VPS and cloud providers

• Question: Q-0015 VERIFY: which common VPS providers expose nested virtualization / KVM
• Researched: 2026-11-02 by agent:ds-research-3
• Status: answered (11 providers now have a fetchable official statement; 4 remain “not found” and 2 are reported-only)

Short answer

Nested KVM is the exception, not the rule, on cheap VPS. It is explicitly refused by Hetzner Cloud, Hostinger VPS, Contabo VPS and netcup (SVM flag disabled), and reported refused by Akamai/Linode. It is offered on OVHcloud Public Cloud (with vmx exposed and a live-migration caveat), on DigitalOcean Droplets (per a DigitalOcean support-engineer answer; any Intel/AMD split is unconfirmed), on Contabo VDS, on Vultr VX1 only, and on specific cloud families: AWS opt-in (M8i/C8i/R8i/M7i/C7i/R7i/I7i/X8i), GCP Intel and N4D, Azure on Dv3/Dv4-class VMs but not with Trusted Launch, and OCI Intel VM shapes (OCI AMD VM shapes are excluded in writing). Bare metal is the reliable answer: a dedicated server has no hypervisor under you, so /dev/kvm is yours as long as VT-x/AMD-V is on in firmware.

For Quoro’s MVP the practical shortlist is: bare metal (Hetzner Robot/OVH/Scaleway Elastic Metal), OVHcloud Public Cloud, DigitalOcean Droplets (verify CPU family yourself — the Intel/AMD split is unconfirmed), AWS c8i/m8i/r8i with nested virtualization enabled, GCP Intel instances, or OCI Intel VM shapes. Everything else on the list must be tested with ls /dev/kvm before it is promised to a user.

“KVM VPS” in marketing means the host runs KVM. It says nothing about /dev/kvm inside your guest; most such plans do not expose it.

Findings

Provider matrix

Accessed 2026-11-02. “Bare metal” rows are inferred: with no hypervisor layer, the guest OS is the host OS and owns VT-x/AMD-V. That inference is labelled Hypothesis even where the product description is Confirmed. Rows marked “Not found” mean a real search was run and no official statement exists (the queries are listed under Open risks); they are not a negative claim.

Why “KVM VPS” does not mean nested KVM

• The KVM kernel modules do not enable nesting by default: you must set nested=1 (AMD) or nested=Y (Intel) on the host. So a provider can run KVM and still hand you a CPU without vmx/svm. Confirmed. Source: https://www.linux-kvm.org/page/Nested_Guests (accessed 2026-11-02)
• The same page calls nested guests “working but experimental” (as of Feb 2018) and documents a hard limitation: once an L1 guest runs an L2 guest it cannot be migrated, saved or loaded until the L2 shuts down. Confirmed. Same URL.
• Therefore “KVM VPS” is a statement about the host’s hypervisor (and usually about virtio/ISO support), not about guest CPU features. Choosing a plan because it says KVM tells you nothing about /dev/kvm. Hypothesis (interpretation; no provider publishes a “KVM VPS implies no nesting” statement).
• Corollary for bare metal: because there is no hypervisor under the OS, /dev/kvm works if the CPU exposes VT-x/AMD-V and firmware enables it. Hypothesis for every provider except where the product page states “no virtualization layer” (Vultr, Confirmed).

How a user checks support

• /dev/kvm present and writable: ls -l /dev/kvm (expect crw-rw---- root kvm). Then test an actual VM boot; presence alone does not prove the CPU supports it.
• CPU flags: grep -E 'vmx|svm' /proc/cpuinfo (vmx = Intel VT-x, svm = AMD-V). This is exactly the check Proxmox’s own nested-virt guide recommends. Confirmed. Source: https://pve.proxmox.com/wiki/Nested_Virtualization (accessed 2026-11-02; last edited 2025-12-03)
• Module parameter on a host you control: cat /sys/module/kvm_intel/parameters/nested (or kvm_amd). Confirmed. Same URL.
• kvm-ok (from the cpu-checker package on Debian/Ubuntu) wraps the above and prints whether KVM acceleration can be used. Hypothesis (widely used; not verified against a vendor doc in this pass).
• Quoro’s node-agent should run this check at enrolment and refuse to advertise “KVM-capable” without a real microVM boot test — /dev/kvm can exist while L2 guest entry fails.

Performance cost of nested virtualization

• GCP: “Even with hardware-assisted nested virtualization, nested VMs might experience a 10% or greater decrease in performance for workloads that are CPU-bound and possibly greater than a 10% decrease for workloads that are input/output bound.” Confirmed. Source: https://cloud.google.com/compute/docs/instances/nested-virtualization/overview (accessed 2026-11-02)
• Proxmox: running VMs with no hardware-assisted extensions exposed is “nearly unusable (you can expect 10x slower or more)”; with extensions exposed, nesting still “obviously adds an overhead”. Confirmed. Source: https://pve.proxmox.com/wiki/Nested_Virtualization (accessed 2026-11-02)
• AWS: recommends evaluating bare metal for workloads that need hardware virtualization extensions and are performance- or latency-sensitive. Confirmed. Source: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-ec2-nested-virtualization.html (accessed 2026-11-02)
• Proxmox also warns: “VMs with nesting active (vmx/svm flag) cannot be live-migrated”. Confirmed. Same Proxmox URL.
• Practical reading for Quoro: expect ~10%+ CPU overhead and worse I/O in a nested lab, plus no live migration; benchmarking on such a lab is not representative.

Enabling nested virtualization on a Proxmox host

Generic procedure on a physical Proxmox VE (PVE) host:

1. Confirm the host CPU is AMD or a recent Intel, kernel >= 3.10. Confirmed. Source: https://pve.proxmox.com/wiki/Nested_Virtualization
2. Check cat /sys/module/kvm_intel/parameters/nested (or kvm_amd); N means off.
3. Persist it:
   • Intel: echo "options kvm-intel nested=Y" > /etc/modprobe.d/kvm-intel.conf
   • AMD: echo "options kvm-amd nested=1" > /etc/modprobe.d/kvm-amd.conf Then modprobe -r kvm_intel && modprobe kvm_intel (or reboot).
4. Set each guest VM’s CPU type to host: qm set <vmid> --cpu host.
5. Verify inside the guest with egrep '(vmx|svm)' /proc/cpuinfo.
6. Expect no live migration for those VMs while nesting is active.

All six points are Confirmed by the Proxmox wiki page above (accessed 2026-11-02).

Versions checked

Implications for Quoro

• D-0009 is sound and the research supports keeping the container fallback deferred, but the addressable market is narrower than “VPS” suggests: of the providers checked, KVM inside a virtual product is documented for DigitalOcean Droplets, OVHcloud Public Cloud (with a live-migration caveat), Contabo VDS, Vultr VX1, AWS (specific families), GCP (Intel/N4D), Azure (Dv3/Dv4) and OCI Intel VM shapes — and AWS/GCP/Azure/OCI require an explicit opt-in or a specific CPU vendor that most users will not have chosen. Hetzner Cloud, Hostinger VPS, Contabo VPS and netcup explicitly refuse it, and Linode is reported to refuse it. Hetzner Cloud — the default cheap European VPS — is explicitly ruled out.
• Onboarding must verify, not trust the product name. A preflight (/dev/kvm, vmx|svm, then an actual Cloud Hypervisor boot) belongs in the node-agent handshake, because “KVM VPS” is not evidence. Without this, Quoro will fail at first microVM launch on a host the user believes is supported.
• Position bare metal as the supported path for self-hosters, and name the cheap ones that still exist: Hetzner Robot/dedicated, OVH Bare Metal, Scaleway Elastic Metal. Equinix Metal is no longer an option at all (sunset 2026-06-30) and must not appear in docs, pricing or provider lists.
• Cloud-provider support is a per-instance-family matrix, not a boolean. If Quoro documents AWS/GCP/Azure/OCI as “supported”, it must also document --cpu-options NestedVirtualization=enabled (AWS) / the nested-virt flag and org constraint (GCP) / avoiding Trusted Launch (Azure) / choosing an Intel shape rather than AMD (OCI, which excludes AMD VM shapes in writing). Getting this wrong yields a “supported” host where KVM is absent.
• OVHcloud Public Cloud is the one cheap virtual product with an explicit “yes”, but its own FAQ says a live migration “may panic” the guest kernel. That makes it acceptable for a lab or a failover-tolerant pool, not for a workload Quoro promises to keep up across host maintenance.
• Nested virtualization is slower (GCP states 10%+ CPU degradation; Proxmox warns nesting blocks live migration), so a nested test lab is not valid for performance benchmarks.
• A Proxmox-based test host needs kvm_intel nested=Y / kvm_amd nested=1 on the physical host in addition to CPU type host in the guest. If lab VMs show no vmx/svm, this is the fix, and it needs a module reload (and possibly a host reboot), i.e. it touches the shared host and should be scheduled with whoever owns it.
• No accepted decision rests on a false premise here, but D-0009’s “VPS with nested virt” should be read as “a small, specific set of VPS products”, not as a general category.

Open risks and unknowns

• Still “not found” after a dedicated search pass (treat as unknown, not as “no”): Vultr Cloud Compute and Optimized Cloud Compute, Scaleway Instances, IONOS VPS/Cloud Servers, UpCloud Cloud Servers. Queries run per provider: "<provider> nested virtualization", "<provider> /dev/kvm", "<provider> vmx", "<provider> run KVM inside VPS", "site:<provider docs domain> nested virtualization", plus "site:<provider docs domain> nested". For Vultr the whole docs index (docs.vultr.com/llms.txt) was fetched and contains no nested-virtualization entry; for UpCloud the Cloud Servers docs index was fetched and contains no occurrence of “nested”. Absence of documentation is not proof of refusal.
• Akamai/Linode is Hypothesis, not Confirmed. Three separate official-looking answers (“no option to enable nested virtualization for a Linode”, “nested virtualization disabled by default”, “we don’t support nested virtualization at the moment”) live on linode.com/community and akamai.com/cloud/community, and every one of them returns HTTP 403 to a direct fetch. Only search snippets were available.
• DigitalOcean’s “yes” is thin. It rests on a 2021 community answer by a DO support engineer plus the live-migration doc; there is no DO docs page that says “nested virtualization is supported”. The Intel/AMD split has no DO source at all and must be treated as folklore until tested per region/CPU.
• OVHcloud’s VPS (as opposed to Public Cloud) answer is marketing, not a statement. The KVM VPS page’s “launch multiple virtual machines” line may simply describe how the VPS itself is built. Do not promise nesting on OVH VPS without a /dev/kvm test.
• Hetzner’s statement is from 2024-09-12 and covers Cloud only. Hetzner could change it, and dedicated servers were not verified either way.
• Contabo VDS supports nesting, but Contabo’s own KB says Hyper-V inside a Windows VDS is broken; only KVM/Proxmox/XenServer paths are safe.
• netcup’s refusal is phrased in AMD terms (“SVM flag”); an Intel-based netcup host was not checked, and netcup’s own docs page covers root servers too without confirming nesting there.
• Azure’s supported-series list is not enumerated in one authoritative page any more; Dv3/Dv4 are confirmed only as examples. Other series (Ev3, Fsv2, Mv2) are unverified, and Trusted Launch blocks nesting.
• OCI’s docs confirm Intel VM shapes and exclude AMD VM shapes, but say nothing about Ampere A1 (Arm). A1 is a Hypothesis, and the linked Oracle blog posts (blogs.oracle.com) return HTTP 403, so the how-to detail was not read.
• Actual performance overhead per workload is not measured; the 10% figure is GCP’s, on GCP hardware, and may be optimistic or pessimistic elsewhere.
• Cloud Hypervisor’s behaviour under nested KVM (not just “KVM boots”) was not tested here; some features (e.g. specific CPU features, MSR handling) may differ from bare metal.

Sources

1. https://docs.hetzner.com/cloud/servers/faq/ (accessed 2026-11-02)
2. https://docs.digitalocean.com/products/droplets/details/live-migration/ (accessed 2026-11-02)
3. https://www.digitalocean.com/community/questions/does-digitalocean-support-kvm-or-nested-virtulzation (accessed 2026-11-02)
4. https://docs.vultr.com/llms.txt (accessed 2026-11-02)
5. https://blogs.vultr.com/cpus-workhorse-agentic-ai-infrastructure (accessed 2026-11-02)
6. https://docs.vultr.com/products/compute/instances/bare-metal/provisioning.md (accessed 2026-11-02)
7. https://www.ovhcloud.com/en/vps/vps-kvm/ (accessed 2026-11-02)
8. https://docs.ovhcloud.com/en/guides/public-cloud/cross-functional/faq-pci (accessed 2026-11-02)
9. https://www.scaleway.com/en/docs/instances/concepts (accessed 2026-11-02)
10. https://www.scaleway.com/en/docs/tutorials/install-kvm-elastic-metal/ (accessed 2026-11-02)
11. https://help.contabo.com/en/support/solutions/articles/103000271595-can-i-setup-nested-virtualization-on-my-server- (accessed 2026-11-02)
12. https://contabo.com/en-us/virtualization/ (accessed 2026-11-02)
13. https://contabo.com/blog/kb/103000270408-why-am-i-unable-to-create-virtual-machines-with-hyper-v-on-a-virtual-dedicated-server/ (accessed 2026-11-02)
14. https://www.netcup.com/en/helpcenter/documentation/server (accessed 2026-11-02)
15. https://www.hostinger.com/support/10429687-is-nested-virtualization-supported-in-hostinger/ (accessed 2026-11-02)
16. https://upcloud.com/docs/products/cloud-servers/ (accessed 2026-11-02)
17. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/amazon-ec2-nested-virtualization.html (accessed 2026-11-02)
18. https://cloud.google.com/compute/docs/instances/nested-virtualization/overview (accessed 2026-11-02)
19. https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/troubleshoot-vm-by-use-nested-virtualization (accessed 2026-11-02)
20. https://docs.oracle.com/en-us/iaas/oracle-linux/oci/index.htm (accessed 2026-11-02)
21. https://docs.oracle.com/en-us/iaas/Content/Compute/Tasks/movinganinstance.htm (accessed 2026-11-02)
22. https://pve.proxmox.com/wiki/Nested_Virtualization (accessed 2026-11-02)
23. https://www.linux-kvm.org/page/Nested_Guests (accessed 2026-11-02)
24. https://docs.equinix.com/goodbye-metal/ (accessed 2026-11-02)

Not fetchable, cited only for a Hypothesis-level claim: https://www.akamai.com/cloud/community/questions/17491/how-do-i-enable-nested-virtualization-for-my-linode (HTTP 403), https://www.linode.com/community/questions/25027/kvm-not-available (HTTP 403), https://blogs.oracle.com/linux/kvm-nested-virtualization-in-oci (HTTP 403).