> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensorlake.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Nested Virtualization

> Run virtual machines inside a sandbox.

A sandbox created from a [CAS image](/sandboxes/cas-images) exposes `/dev/kvm`, so you can run virtual machines inside it with any KVM-based hypervisor.
Snapshot-restore and all other features are supported for sandboxes with nested VMs running inside of them.

This guide builds an image with QEMU and an Ubuntu cloud image, boots that cloud image as a VM inside a sandbox, and connects to it over SSH.

## Build an Image with QEMU

The Dockerfile installs QEMU, [virtme-ng](https://github.com/arighi/virtme-ng), and a kernel for the nested VM:

```dockerfile Dockerfile theme={null}
FROM tensorlake/cas/ubuntu-systemd

ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        virtme-ng qemu-system-x86 linux-image-virtual \
        binutils busybox-static zstd \
    && rm -rf /var/lib/apt/lists/*
```

```bash theme={null}
tl sbx image create /tmp/nested-virt-guide/Dockerfile --registered-name nested-virt --cas --disk_mb 20480
```

## Create the Sandbox and Check KVM

Create the sandbox with enough CPUs, memory, and disk for the VM, then confirm the KVM device is there.
The QEMU packages make `/dev/kvm` owned by `root:kvm`, so the commands in this guide run as root:

```bash theme={null}
SANDBOX_ID=$(tl sbx create --image nested-virt --cpus 4 --memory 8192 --disk_mb 30720)
tl sbx exec $SANDBOX_ID --user root -- ls -l /dev/kvm
```

## Boot a VM

`vng` boots the installed kernel under QEMU with KVM acceleration from the sandbox's own filesystem, runs a command inside the VM, and shuts it down.
The output is the VM's kernel, not the sandbox's:

```bash theme={null}
tl sbx exec $SANDBOX_ID --user root -- bash -c 'vng -v -r /boot/vmlinuz-* --exec "uname -a"'
```

## See Also

<CardGroup cols={3}>
  <Card title="CAS Images" icon="boxes-stacked" href="/sandboxes/cas-images">
    The image format that exposes KVM inside a sandbox.
  </Card>

  <Card title="Snapshot and Clone" icon="camera" href="/sandboxes/snapshots">
    Save and restore a sandbox with its running VM.
  </Card>

  <Card title="Live Resize" icon="expand" href="/sandboxes/live-resize">
    Give a running sandbox more CPUs and memory for its VMs.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.