Virtual machines and snapshots

02Locate the boundary

The guest uses host processing, memory and storage, but has its own OS and files. A virtual disk is usually stored as files on the host. The guest sees that virtual disk as its drive. Seeing Ubuntu inside a Windows window does not change the host OS into Ubuntu.

Snapshots can record VM settings and included virtual disks. A snapshot taken while running may also record memory. Here we use powered-off snapshots: the guest is shut down first, so no running memory is recorded. Special disk modes can exclude changes; this stage assumes a normal disk.

Snapshot boundary: fictional example
HOST: physical computer and existing operating system
  Downloads/photo.txt: outside the snapshot
  Hypervisor: software managing the virtual machine
    GUEST: separate operating system and normal virtual disk
      B0: plan.txt contains first draft
      Later: plan.txt contains second draft
      Restore B0: plan.txt returns to first draft
REMOTE SERVICE: outside the snapshot

A powered-off snapshot includes no running memory.
This example includes the normal guest disk and excludes host folders.
Other disk modes may behave differently.
The guest disk and snapshot still depend on files on host storage.

03Use snapshots within their limits

Restoring can discard changes made after the snapshot across the included guest state. The operation is wider than the single file you may be watching. Practice only in a disposable guest with no important work, or use the text cards.

A snapshot depends on VM files stored on the host. If that storage fails, the guest and its snapshots may be lost together. A backup kept separately and recoverable after that failure addresses a different problem. A snapshot alone is not that independent backup.

Shared folders let a guest access host folders. A network connection lets it reach other systems. NAT, short for network address translation, is a network mode that lets the guest make connections through the host. It does not make external actions part of your permitted lab. Later installation steps keep sharing off and use NAT only for ordinary downloads, with no port forwarding to make guest services reachable from outside.

04Try boundary predictions

Read the Activity B0 case and classify each location before predicting a restore.

Snapshot boundary worksheet
Fictional case. Assume one normal guest disk, no shared host folders,
and no attached external disk. A normal disk is included in snapshots.

Activity:
B0 records guest Documents/plan.txt containing first draft.
Later changes:
- Guest plan.txt now contains second draft.
- Host Downloads/photo.txt is created.
- A remote account profile is edited.

For each location, write guest, host or remote.
Predict what restoring B0 changes and what stays outside its boundary.
State which assumptions let you make that prediction.

Separate question case:
R0 records guest note.txt at its recorded state on the normal disk.
Host Downloads is outside R0.
Which location can R0 return to its recorded state?
Answer format: guest or host.

1. Write guest, host or remote beside plan.txt, photo.txt and the account profile. Draw a box around the normal guest disk included in B0.
2. Predict each result, then compare: plan.txt returns to first draft; the host photo and remote profile stay outside the restore. Explain each result using location rather than the fact that a VM window was open.
3. Record the assumptions: normal guest disk, no shared folders and no external disk. If a file were instead in a shared host folder, you would need different evidence about its location and recovery.
4. Write a stop rule for real work: if you cannot identify the included disk or know whether later work can be discarded, do not restore. Use the paper case until the configuration is clear.
5. Finish the prediction note. No VM or remote account was changed in this activity.

05The computer module case

Use the machine case below to combine this module's ideas. Write the five explanations requested by the card, then use this rubric to review them. This writing is ungraded practice.

Your note should give RAM and storage different jobs; distinguish the viewer program, map data and two viewer processes; identify the guest viewer as requester; predict map.txt returning to route A; and exclude the host receipt and remote service from M0. If a conclusion needs an unstated assumption, name it. Unfamiliar names alone do not establish harmful behavior.

The computer: combine the evidence
Fictional case; no machine was inspected.

Host: 16 GiB RAM, x86-64 CPU, 120 GiB free storage.
Guest: Ubuntu VM, normal virtual disk, 4 GiB RAM, no shared folders.
Saved program file: viewer.
Saved data file: guest Documents/map.txt.
Running processes: PID 71 viewer; PID 72 viewer.
Exchange: guest viewer requests a map; remote service sends map data.
M0 snapshot: guest map.txt contains route A.
Later: guest map.txt contains route B; host Downloads/receipt.txt created.

Write five short explanations:
1. How RAM and storage have different jobs.
2. Which items are a program file, data file and running processes.
3. Which participant requests and which responds.
4. What restoring M0 would do to map.txt.
5. Why M0 would not rewind the host receipt or remote service.
Use the lesson's rubric to review your note.

06Optional challenge

Suppose the host drive fails. Compare what must survive for a local snapshot restore with what must survive for an independent backup restore. Name where the needed data would have to be kept. Do not delete files or simulate drive failure to answer.

07Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Mira uses a physical laptop whose existing OS is Windows.
VirtualBox runs on Windows and manages a VM named archive-lab.
Ubuntu runs inside archive-lab with its own normal virtual disk.
A viewer program inside Ubuntu requests a document from a remote service.
No remote login, shared folders or external disks are present.

Snapshot C7 was taken after archive-lab was shut down.
C7 includes its normal guest disk; it includes no running memory.
At C7: guest Documents/colour.txt contains copper.
Later: guest Documents/colour.txt contains silver.
Later: host Downloads/receipt.txt contains paid.
Later: the remote service changes the document status to sent.
The host file and remote service are outside C7.
Restore C7. No other action changes these three values.

Snapshot D2 was taken while a disposable guest was powered off.
Its normal virtual disk is included; no running memory was recorded.
Later the guest boots and an editor starts as process 408.
The editor holds an unsaved paragraph only in working memory.
Restore D2, leaving the guest powered off. No automatic recovery or restart is configured.
The saved editor program file existed on the disk at D2.

This separate guest has a shared folder backed by host Documents/Shared.
Guest /media/shared/colour.txt is the host file exposed through that folder.
Snapshot E4 excludes the shared host folder and records no memory.
At E4: that shared file contains amber.
Later: the guest edits that same shared file to contain violet.
Restore E4. No backup, synchronization or other action changes the host file.

The guest disk and all its local snapshot files are on host drive H.
A separately kept backup on drive J contains the needed guest files.
The case establishes that this backup can restore those files without drive H.
Drive H fails completely; drive J remains readable.

08Explain the whole VM case

Optional self-check: write a short note connecting VM cards A and B. Identify the host, hypervisor and guest; explain whose RAM and storage the guest uses; identify the requester and responding service; and predict the three restored values.

Review your note: distinguish working memory from saved files and the viewer program from its running instance. Explain that the guest viewer requests the document and the remote service responds. State the normal-disk assumption, exclude host and remote state, and explain why card D needs a different prediction. A local snapshot also depends on host storage; do not describe it as an independent backup.