VM applications on edge devices

Virtual machine (VM) applications run alongside container workloads on Red Hat Edge Manager-managed edge devices, for workloads that require a full guest OS environment such as Windows software. Manage VM applications through the same Red Hat Edge Manager console and CLI as container applications.

How VM applications work
Copy link

VM applications use the KVM hypervisor and QEMU emulator on the edge device to run virtual machines inside Podman pods. When you deploy a VM application, the following operations occur:

  1. The control plane converts the KubeVirt VirtualMachine YAML specification into a set of Podman Quadlet units by using the vm-to-quadlet worker during device render.
  2. The Red Hat Edge Manager agent on the device pre-fetches the container disk image from an OCI-compatible registry.
  3. The agent starts a Podman pod that contains a virt-launcher container running QEMU/KVM with the VM guest disk image.

The virt-launcher container runs as non-root user UID 107, dropping all Linux capabilities except NET_BIND_SERVICE. This security model limits the attack surface of the virtualization process on the edge device.

Important

Manage VM applications only through Red Hat Edge Manager. The virt-launcher container includes the virsh command, but using virsh or any other on-device tool to change a running VM is not supported. Red Hat Edge Manager manages VM configuration, volumes, and mounts declaratively, and the agent reconciles the device toward the desired state that is defined in the control plane. Changes that you make directly on the device are not part of the desired state and can be lost or reverted. This restriction applies to how the VM is defined and managed from the host. Working inside a running VM guest, such as logging in, creating files, installing software, and running applications, is fully supported. To change how a VM is defined, update its specification through the Red Hat Edge Manager web console or the flightctl CLI. For more information, see Declarative application lifecycle management in the Additional resources section.

VM applications follow the KubeVirt VirtualMachine YAML format (kubevirt.io/v1). You can create VM specifications by using the Red Hat Edge Manager web console guided form, the raw YAML editor, or the flightctl CLI. The control plane converts each specification into Podman Quadlet units during device render, and the agent manages the VM lifecycle through systemd on the device.

Virt-launcher image and pull credentials
Copy link

The virt-launcher container that runs QEMU/KVM on the device uses a Red Hat image from registry.redhat.io. You configure the image through the worker.vmRender.launcherImage value on the Red Hat Edge Manager control plane — as a Helm chart value on Red Hat OpenShift Container Platform, or in /etc/flightctl/service-config.yaml for standalone Red Hat Enterprise Linux deployments. Both Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 currently use the same virt-launcher image (virt-launcher-rhel9).

Because registry.redhat.io requires authentication, every device that runs VM applications must have valid pull credentials stored at /root/.config/containers/auth.json. Without these credentials, the agent cannot pull the virt-launcher image and the VM application fails to start.

Before you deploy VM applications, verify that each target device meets the KVM hardware and software prerequisites. The Red Hat Edge Manager agent does not detect or verify KVM readiness automatically. For supported hypervisors, disk formats, and guest operating systems, see Supported VM configurations in the Additional resources section.