Nested virtualization

Nested virtualization lets a CI runner start another virtual machine inside the EC2 instance. The common cases are Linux KVM workloads, Android emulator acceleration, VM-based integration tests, and Windows Hyper-V workloads.

Usage#

Flex#

On Linux, nested-virt exposes KVM to the job so VM-based tests and accelerated emulators can run:

jobs:
  kvm:
    runs-on: runs-on=${{ github.run_id }}/family=c8i.large/image=ubuntu24-full-x64/nested-virt
    steps:
      - name: Verify KVM
        run: |
          test -c /dev/kvm
          sudo apt-get update -qq
          sudo apt-get install -y cpu-checker
          sudo kvm-ok

On Windows, the same idea enables Hyper-V features and Hyper-V-isolated containers:

jobs:
  hyperv:
    runs-on: runs-on=${{ github.run_id }}/family=m8i.large/image=windows25-full-x64/nested-virt
    steps:
      - shell: pwsh
        run: |
          Import-Module Hyper-V
          Get-WindowsFeature Hyper-V,Hyper-V-PowerShell,Containers
          $Image = "mcr.microsoft.com/windows/nanoserver:ltsc2025"
          docker run --isolation=hyperv $Image cmd /c ver

See nested-virt and Windows runners for full Flex syntax.

Fleet#

For Fleet, nested virtualization is configured in Terraform. On a current stack the nested-enabled launch templates already exist, so you only mark the runner definitions that should launch with nested virtualization:

...
  runners = {
    deploy-nested-virt = {
      family = ["m8i.large"]
      image = "windows25-full-x64"
      nested-virt = true
    }
  }

See Runner fleets for the full runner-catalog configuration.

Constraints#

Nested virtualization is a host capability, not a package you can install after boot. The runner must launch on an EC2 family that supports it, and the stack must include the right launch templates.

Practical constraints:

• x64 only — arm64 EC2 families do not support nested virtualization;
• Linux uses KVM; Windows uses Hyper-V;
• supported EC2 families only ↗ — current x64 Nitro families that expose nested virtualization;
• requires a current RunsOn stack — existing stacks must be upgraded to include the nested-enabled launch templates before nested-virt jobs can run, otherwise the launch fails.

Flex vs Fleet#

Same hardware requirement; the difference is who decides which jobs get the capability.

When not to use it#

Do not enable nested virtualization for ordinary builds, tests, or Docker workloads. It narrows instance selection and can increase launch pressure if you also require a specific family, image, region, or Spot capacity pool.