KVM vs OpenVZ and LXC: what you actually get
KVM gives each VPS its own kernel; OpenVZ and LXC share the host's. What that changes for Docker, VPNs, memory and swap, and how to check what you have.
A KVM VPS is a full virtual machine with its own kernel, so it behaves like a physical server. An OpenVZ or LXC VPS is a container that shares the host's kernel, which is lighter for the provider but limits what you can run.
If the plan page doesn't say which one you're buying, ask before you pay. It decides whether Docker, WireGuard and plenty of other everyday software will work.
The short version
| KVM | OpenVZ | LXC | |
|---|---|---|---|
| Kind | Virtual machine | Container | Container |
| Kernel | Your own | The host's | The host's |
| Choose or upgrade the kernel | Yes | No | No |
| Docker | Works normally | Depends on the host | Depends on the host |
| WireGuard, kernel modules | Yes | Usually not | Only if the host allows |
| Your own swap file | Yes | No | Rarely |
| Memory | Yours, as a fixed amount | Often shared and overcommitted | Limited by the host's settings |
Virtual machines and containers
KVM is part of the Linux kernel. It uses the CPU's virtualisation features to run complete virtual machines. Each VM boots its own kernel from its own disk, exactly as a physical computer would. From inside, it's hard to tell it isn't one.
OpenVZ and LXC don't run a second kernel at all. Every customer's "server" is a set of processes on the host, fenced off with kernel features so they can't see each other. Starting one is quick and they need very little memory overhead, which is why providers like them: more customers per machine.
OpenVZ was the default for budget VPS hosting for a long time. The widely used OpenVZ 6 is long out of support, and providers still running it are on very old kernels. LXC is the modern container approach and is in mainline Linux, so it's better maintained, but it has the same basic limit: one kernel for everyone.
What sharing a kernel changes
You can't change the kernel
On OpenVZ or LXC, uname -r shows the host's kernel, and you can't upgrade it, add a module or change most sysctl settings. Anything that needs a newer kernel feature has to wait for the provider.
On KVM, the kernel comes from your distribution and updates with apt upgrade or dnf upgrade like any other package.
Docker
Docker uses kernel features (namespaces, cgroups, overlay filesystems, its own firewall rules) that a container may not be allowed to use. On LXC and newer OpenVZ it can work, if the host has turned on nesting and the right options. On old OpenVZ it often doesn't work at all. On KVM it simply works; Install Docker is the whole story.
VPNs
WireGuard lives in the kernel. In a container, it only works if the host has the module loaded and lets you use it. OpenVPN needs a TUN device, which on many container VPS plans is a support ticket away. On KVM both work out of the box.
Memory and swap
On KVM, memory is given to your VM as a fixed amount, and you can add your own swap file so a spike slows things down instead of killing a process.
Container plans often advertise "burst" memory on top of the guaranteed amount, which you only get if the host has some spare. You usually can't add swap, and when the host is short of memory, your processes are the ones that get killed.
Isolation
A container escape is a kernel bug away. Kernel bugs happen. A VM boundary is a much smaller target. KVM isn't perfect, but it's the stronger wall.
Is KVM always better?
For you, almost always. Containers are faster to start and use a little less memory per server, but those savings go to the provider, not to you. The one place containers really shine is on your own hardware, where you trust every neighbour because they're all you.
Check what you're on
On a server you already have:
systemd-detect-virtIt prints kvm on a KVM VPS, openvz on OpenVZ and lxc on LXC. none means bare metal. If systemd-detect-virt isn't there, these give strong hints:
ls /proc/vz # exists on OpenVZ
cat /proc/1/environ | tr '\0' '\n' | grep container # set in LXCDoing it on VPSNine
Every VPSNine server is KVM, on every plan. You get your own kernel from your distribution, your own fixed memory, swap if you want it, and Docker, WireGuard and kernel modules all work. Run systemd-detect-virt on one and it says kvm.
The WireGuard and Docker one-click apps are a quick way to see it for yourself. For how we keep VMs apart on the network as well, read how we keep your VPS isolated. The plans page has the sizes.