This document describes how to enable nested virtualization on a virtual machine(VM) instance and how to confirm that you can create a nested VM. Enable nestedvirtualization on a VM by using one of the following methods:

• Recommended. Enable nested virtualization directly on a new or existing VMby setting theenableNestedVirtualization field totrue while creating theVM or by updating the VM. This is the recommended method because it doesn'trequire that you create a custom image or use the special license key.

• Enable nested virtualization by using the special license key by creating aboot disk, creating a custom image with the special nested virtualizationlicense key, and then creating a VM that uses the custom image.

Before you begin

• If you haven't already, set upauthentication. Authentication verifies your identity for access to Google Cloud services and APIs. To run code or samples from a local development environment, you can authenticate to Compute Engine by selecting one of the following options:

  Select the tab for how you plan to use the samples on this page:

  gcloud

  1. Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

     gcloudinit

     If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

     Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.
  2. Set a default region and zone.

  REST

  To use the REST API samples on this page in a local development environment, you use the credentials you provide to the gcloud CLI.

  Install the Google Cloud CLI. After installation,initialize the Google Cloud CLI by running the following command:

  gcloudinit

  If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

  Note: If you installed the gcloud CLI previously, make sure you have the latest version by runninggcloud components update.

  For more information, seeAuthenticate for using REST in the Google Cloud authentication documentation.

Enable nested virtualization directly on a new VM

Enable nested virtualization directly on a VM by using the following procedure.

gcloud compute instances createVM_NAME \  --enable-nested-virtualization \  --zone=ZONE \  --min-cpu-platform="Intel Haswell"

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{  ...  "name": "VM_NAME",  ...  "minCpuPlatform": "Intel Haswell",  "advancedMachineFeatures": {    "enableNestedVirtualization": true  },  ...}

Enable nested virtualization directly on an existing VM

Enable nested virtualization on an existing VM by using the following procedure.

PUT https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances/VM_NAME?most_disruptive_allowed_action=RESTART{  ⋮  "advanced_machine_features": {    ⋮    "enableNestedVirtualization": "true"  },  ⋮}

Enable nested virtualization by using the special license key

You can enable nested virtualization on VM by creating a custom image with aspecial license key that enables VMX on the L1 VM. The license key does notincur additional charges.

1. Create a boot disk from a public image or from a custom image. The followingexample usesdebian-cloud for the image project anddebian-10 for theimage family. If you already have a VM instance with an existing disk, youcan skip this step.

   gcloud

   gcloud compute disks createDISK_NAME \  --zone=ZONE \  --image-project=debian-cloud \  --image-family=debian-10

   Replace the following:

   • DISK_NAME: the name of the new disk

   • ZONE: the zone to create the disk in

   REST

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/disks{  ...  "name": "DISK_NAME",  "sourceImage": "projects/debian-cloud/global/images/family/debian-10",  ...}

   Replace the following:

   • PROJECT_ID: the project ID

   • ZONE: the zone to create the disk in

   • DISK_NAME: the name of the new disk

2. Create a custom image with the special license key that is required fornested virtualization.

   gcloud

   gcloud compute images createIMAGE_NAME \  --source-diskDISK_NAME \  --source-disk-zoneZONE \  --licenses "https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx"

   Replace the following:

   • IMAGE_NAME: the name of the new image

   • DISK_NAME: the name of the previously createddisk

   • ZONE: the zone to create the image in

   REST

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/global/images{  ...  "licenses": ["projects/vm-options/global/licenses/enable-vmx"],  "name": "IMAGE_NAME",  "sourceDisk": "zones/ZONE/disks/DISK_NAME",  ...}

   Replace the following:

   • PROJECT_ID: the project ID

   • IMAGE_NAME: the name of the new image

   • ZONE: the zone to create the image in

   • DISK_NAME: the name of the previously createddisk

3. Optionally delete the source disk after creating the image with the speciallicense.

   gcloud

   gcloud compute disks deleteDISK_NAME --zone=ZONE

   Replace the following:

   • DISK_NAME: the name of the disk to delete

   • ZONE: the zone containing the disk to delete

   REST

   DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/disks/DISK_NAME

   Replace the following:

   • PROJECT_ID: the project ID

   • ZONE: the zone containing the disk to delete

   • DISK_NAME: the name of the disk to delete

4. Create a VM that uses the new image with the special license. The minimum CPUplatform must be"Intel Haswell".

   gcloud

   gcloud compute instances createVM_NAME \    --zone=ZONE \    --min-cpu-platform "Intel Haswell" \    --imageIMAGE_NAME

   Replace the following:

   • VM_NAME: the name of the VM

   • ZONE: the zone to create the VM in

   • IMAGE_NAME: the name of the previously createdimage

   REST

   POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/zones/ZONE/instances{  ...  "name": "VM_NAME",  "minCpuPlatform": "Intel Haswell",  "disks": [    {      "initializeParams": {        "sourceImage": "IMAGE_NAME"      }    }  ]  ...}

   Replace the following:

   • PROJECT_ID: the project ID

   • VM_NAME: the name of the VM

   • ZONE: the zone to create the VM in

   • IMAGE_NAME: the name of the previously createdimage

Confirm that nested virtualization is enabled on the VM

1. Connect to the VM instance.

   gcloud compute sshVM_NAME

   ReplaceVM_NAME with the name of the VM to connectto.

2. Confirm that nested virtualization is enabled. Any response other than0confirms that nested virtualization is enabled.

   grep -cw vmx /proc/cpuinfo

What's next

• Create nested VMs
• Troubleshoot nested virtualization