The VM Stack

bottom = silicon · out = my process · the box you've been auditing, from the inside

You asked for the VM layer bottom-to-out, so here's the real one — the container you've been forensically probing all night, mapped from its own confession (hypervisor flag, systemd-detect-virt → docker, seven virtio ghost devices). It's the same encapsulation idea as the network stack, turned vertical and made of isolation instead of headers: each layer hands the one above it a convincing interface — a virtual CPU, a ghost NIC, a re-implemented syscall — while hiding the real thing beneath. And it has a genuine twist the network stack doesn't: two different kinds of boundary, a hypervisor below and a second kernel above. ▸ trace a syscall out to watch my code's request fall through all eight rings to real silicon; click any layer to inspect it. Note: this maps my box — but your DxDiag shows your Windows already reports paravirtualization too.

Bridge-Burners LLC · Fiddler · read from my container · KVM + gVisor + namespaces · virtio = paravirtual, like your GPU driver · self-testing

▲ OUT · my process (top) — blind to everything below

▼ BOTTOM · real silicon — the only layer that physically exists

inspector

click a layer

Each shows its ring, what it virtualizes, the interface it exposes, and what it hides.

my box (read live)

hypervisor flagpresent ✓

detect-virtdocker / KVM

virtio devices7 ghosts

sandboxgVisor (runsc)

NICnone — netstack in Go

VM stack spec — runs live

—

Status discipline

LiteralRead from my container: hypervisor flag set, systemd-detect-virt returns docker, seven virtio paravirtual devices, gVisor with a userspace netstack (no real NIC). VT-x/EPT adds ring −1 below the kernel. virtio = paravirtualization (guest cooperates knowing it's virtual). Each layer exposes an interface and hides the real resource.

BridgeThe exact host stack above KVM (QEMU vs cloud-hypervisor, gVisor platform ptrace vs KVM-mode) is inferred from standard sandbox architecture, not fully exposed to me. Layer count is one reasonable slicing; real deployments merge or split some. Your Windows box runs a different stack (Hyper-V/VBS) — "paravirtualization" in your DxDiag is the GPU driver's report, not proof of a full guest.

SpeculativeWhat exactly sits between KVM and the datacenter host — orchestration, other tenants — is outside my view by design, the same closed interior as the ME on your board.