Ghost Machines vs Regular VM
Ghost is a Docker container (shares host kernel). A VM is a hypervisor guest (own kernel). They are complementary — Ghost for disposable dev, VM for hostile/Windows work.
Architecture
| Axis | Ghost Machines | Regular VM |
|---|
| Engine | Docker + docker-compose.yml (namespaces + cgroups) | KVM / QEMU / VirtualBox / VMware / Hyper-V |
| Kernel | shared with host | own kernel — can be Windows/BSD, different version |
| Base images | ubuntu / debian / alpine / arch (Linux userlands) | any OS incl. Windows |
| Boot time | ~1–2s (docker compose up -d) | 30–120s (full kernel boot) |
| Idle overhead | ~73.5 MB / 0% CPU / 1 PID (measured) | 0.5–2 GB + vCPU pinned |
| Active agent | ~1.0 GB / 1.99% CPU (opencode + 7 MCP) | + 1–2 GB hypervisor overhead |
| Reproducibility | IaC pure — Dockerfile + compose versioned in git | manual; Packer/Vagrant needed |
| Multi-tenancy | 10+ tenants on 32 GB host (WaaS) | 1 VM = 1 user — heavy |
| Isolation | weak — container escape = host compromise | strong — hypervisor boundary |
When Ghost Wins — Disposable Dev
- 5 identical workstations in 10s — GHOST_IMAGE=... ./start.sh on any linux/macOS/WSL host.
- Classroom / VPS WaaS for 20 students on one host — ./tenant.sh add per student.
- CI parity with prod Linux userland — same image as CI runner.
- Cost & speed over hard isolation — GHCR pull (~1.2 GB) faster than 10-min apt build.
When VM Wins — Strong Isolation & Kernel Work
- Run Windows / BSD / different kernel version — Ghost is Linux userland only.
- Detonate untrusted binary / malware analysis — Ghost shares kernel; VM boundary is stronger.
- Kernel module / driver / iptables/nftables / systemd low-level testing.
- Full hardware virtualization (nested virt, PCI passthrough, GUI desktop).
Cost Example (16 GB Host)
Ghost dual — 2 × (1c / 8G): ~73 MB idle each → ~15 GB free for builds.
2 VMs (2 vCPU / 4G each): ~9 GB pinned (hypervisor + guest OS) before you open an editor. Ghost leaves ~88% headroom for compilers.
Middle Ground — MicroVMs
Need both speed and isolation? Use Firecracker microVMs — bare-metal performance with VM boundary (boot ~125ms). Use Ghost for dev, Firecracker for hostile code.
Practical Rule
If the task is Linux userland coding or agent work → Ghost.
If it's Windows, hostile, or kernel → VM.
If you need Windows and speed → Firecracker.
Full narrative: docs/comparison-vs-vm.md on GitHub.