SYSTEMD-DETECT-VIRT(1)

📦
version 262.1 · 16 versions
, in arch rolling

🌸 systemd-detect-virt(1) 🌸

okay bestie, welcome to the systemd-detect-virt manual page 💖 this one's the little detective that tells you if you're living inside a VM or a container. it's iconic, it's useful, and yes we're reading the whole thing together. grab a snack 🍓

✨ NAME ✨

systemd-detect-virt — figure out if you're running inside a virtualized environment 🕵️♀️

✨ SYNOPSIS ✨

systemd-detect-virt [OPTIONS...]

✨ DESCRIPTION ✨

systemd-detect-virt detects execution in a virtualized environment. it IDs the virtualization technology and can tell full machine virtualization apart from container virtualization — two very different vibes, bestie.

here's the deal on how it talks back to you: systemd-detect-virt exits with a return value of 0 (success) if a virtualization technology is detected, and non-zero (error) otherwise. that's your vibe check right there ✨

by default, any type of virtualization gets detected, and the options --container and --vm are how you narrow down which types of virtualization you're willing to hear about.

when it runs without --quiet, it prints a short identifier for the detected virtualization technology. these are the technologies it currently knows about:

🦋 Table 1. Known virtualization technologies (both VM, i.e. full hardware virtualization, and container, i.e. shared kernel virtualization)

💜 VM

  • qemu — QEMU software virtualization, without KVM
  • kvm — Linux KVM kernel virtual machine, in combination with QEMU. Not used for other virtualizers using the KVM interfaces, such as Oracle VirtualBox or Amazon EC2 Nitro, see below.
  • amazon — Amazon EC2 Nitro using Linux KVM
  • zvm — s390 z/VM
  • vmware — VMware Workstation or Server, and related products
  • microsoft — Hyper-V, also known as Viridian or Windows Server Virtualization
  • oracle — Oracle VM VirtualBox (historically marketed by innotek and Sun Microsystems), for legacy and KVM hypervisor
  • powervm — IBM PowerVM hypervisor — comes as firmware with some IBM POWER servers
  • xen — Xen hypervisor (only domU, not dom0)
  • bochs — Bochs Emulator
  • uml — User-mode Linux
  • parallels — Parallels Desktop, Parallels Server
  • bhyve — bhyve, FreeBSD hypervisor
  • qnx — QNX hypervisor
  • acrn — ACRN hypervisor[1]
  • apple — Apple virtualization framework[2]
  • sre — LMHS SRE hypervisor[3]
  • google — Google Compute Engine[4]

🎀 Container

  • openvz — OpenVZ/Virtuozzo
  • lxc — Linux container implementation by LXC
  • lxc-libvirt — Linux container implementation by libvirt
  • systemd-nspawn — systemd's minimal container implementation, see systemd-nspawn(1)
  • docker — Docker container manager
  • podman — Podman[5] container manager
  • rkt — rkt app container runtime
  • wsl — Windows Subsystem for Linux[6]
  • proot — proot[7] userspace chroot/bind mount emulation
  • pouch — Pouch[8] Container Engine
🌈 heads up: if multiple virtualization solutions are used, only the "innermost" is detected and identified. That means if both machine and container virtualization are used in conjunction, only the latter will be identified (unless --vm is passed). innermost wins, no cap.

Windows Subsystem for Linux is not a Linux container, bestie — it's an environment for running Linux userspace applications on top of the Windows kernel using a Linux-compatible interface. WSL is categorized as a container for practical purposes. Multiple WSL environments share the same kernel and services should generally behave like when being run in a container. slay, but make it kernel-sharing 💅

when it runs with --cvm, instead of printing the virtualization technology, it will display the confidential virtual machine technology, if any. the following technologies are currently identified:

...so yeah, that's Table 1 energy. And here's its sister, the confidential-compute lineup 👑

🎀 Table 2. Known confidential virtualization technologies 🎀

Not every arch has every flavor, bestie — here's the whole roster, grouped by architecture:

  • x86_64:
    • sev — AMD Secure Encrypted Virtualization
    • sev-es — AMD Secure Encrypted Virtualization - Encrypted State
    • sev-snp — AMD Secure Encrypted Virtualization - Secure Nested Paging
    • tdx — Intel Trust Domain Extensions
  • s390x:
    • protvirt — IBM Protected Virtualization (Secure Execution)
  • arm64:
    • cca — Arm Confidential Compute Architecture

✨ OPTIONS ✨

Okay so here's everything it understands, and yes you're gonna want to know all of it:

  • -c, --container — container-only mode, periodt. It detects only container virtualization, aka shared-kernel virtualization. Nothing else.
  • -v, --vm — hardware virtualization only. If it's not a real VM, it's not interested.
  • -r, --chroot — detects whether it got invoked inside a chroot(2) environment. Heads up: in this mode it prints nothing — the return value is the whole story, telling you whether the process was invoked in a chroot() environment or not.

Added in version 228.

  • --private-users — detects whether it got invoked in a user namespace. Same deal: no output written, the return value is what tells you whether the process was invoked inside a user namespace or not. Want the lore? Go read user_namespaces(7).

Added in version 232.

  • --cvm — detects whether it got invoked in a confidential virtual machine. And bestie, listen carefully: you can use this result to turn off features that shouldn't be used in confidential VMs, but it must not be used to release security-sensitive information. That kind of info only gets released after attestation of the confidential environment. No shortcuts. 🚫

Added in version 254.

  • -q, --quiet — shuts up the virtualization technology identifier output. 🤫
  • --list — spits out every currently known and detectable container and VM environment. A whole menu of vibes.

Added in version 239.

  • --list-cvm — spits out all currently known and detectable confidential virtualization technologies. ✨

Added in version 254.

  • -h, --help — short help text, then it dips. 👋
  • --version — short version string, then it dips. 👋

💖 EXIT STATUS 💖

If a virtualization technology is detected, 0 comes back. Anything non-zero means nope, nothing found. That's the entire vibe check, fr fr.

🌈 SEE ALSO 🌈

Go read these when you're done here, iykyk:

📝 NOTES 📝

The footnotes, preserved in all their glory, links and all 💅

  1. ACRN hypervisor — https://projectacrn.org
  2. Apple virtualization framework — https://developer.apple.com/documentation/virtualization
  3. LMHS SRE hypervisor — https://www.lockheedmartin.com/en-us/products/Hardened-Security-for-Intel-Processors.html
  4. Google Compute Engine — https://cloud.google.com/compute
  5. Podman — https://podman.io
  6. Windows Subsystem for Linux — https://docs.microsoft.com/en-us/windows/wsl/about
  7. proot — https://proot-me.github.io/
  8. Pouch — https://github.com/alibaba/pouch

aaaand that's a wrap, bestie 🫶 this whole thing is from systemd 262.1, the man page for SYSTEMD-DETECT-VIRT(1) — go detect some virt, you absolute icon 👑💖

📦 where this page comes from
  • arch rolling: systemd 262.1-1 · LGPL-2.1-or-later AND CC0-1.0 AND GPL-2.0-or-later AND MIT-0
  • 💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on : a language model's rewrite of the original, under its terms