[Qemu-discuss] Starting without '-kernel'; isolating VMs

[Nikita Karetnikov]

I'd like to use multiple VMs to isolate various applications from each
other (see [1]).

I've never used QEMU, so I have a couple of questions:

1. I'm starting it like this (as suggested here [2]):

     $ qemu-system-i386 -kernel /tmp/vmlinuz -initrd /tmp/initrd.img \
                        -hda test.img -append "root=/dev/sda"

   Is there a way to use the kernel from the image?  If I omit
   everything except '-hda', it won't boot.

2. Some say that VMs are not designed with security in mind.  So what
   should I do to make it harder to escape a VM?  What are the best
   practices?

[1] http://wiki.lewman.is/blog/2012-11-23-a-week-with-qubes
[2] http://www.aurel32.net/info/debian_arm_qemu.php

pgpo6b8cRdsmc.pgp
Description: PGP signature