Redhat documentation describes the process for sealing a virtual machine here

Many distributions publish a 'cloud image', e.g.

What are the differences between cloud images and sealed virtual machines? I presume they are not exactly the same thing, since a cloud image has some mechanism to regenerate ssh keys upon boot, etc. Where is that mechanism stored in the image?


Generally, "cloud images" are configured to run in a IaaS (infrastructure as a service) cloud computing environment, like Amazon EC2 (a "public cloud" provider — you pay for metered resources from a provider) or OpenStack (software to implement your own IaaS environment).

These environments typically provide a metadata service which can be used to provide configuration information to individual instances. Cloud images are often configured with a provisioning tool like cloud-init which looks for such a service and responds appropriately. This can be actively dangerous outside a known cloud environment — if you, for example, launch a cloud image on your laptop in a VM, some hostile actor could be running a metadata server and basically pwn your new VM.

Additional configuration might include optimization for performance under a particular provider, or lack of a default packet-filter firewall (because the convention is that the cloud environment provides similar functionality via its own APIs at the network level). But this will vary from distro to distro.

The images distributed by the distros will be "sealed virtual machines" in the sense given in the document you link. That is, they're void of unique identifiers and ready to provision. But, you could also have a sealed virtual machine that's meant for another purpose (like a dev environment meant for running on your laptop).

  • Thanks, I hadn't realized that cloud images depend on a metadata service. Can you clarify - does that mean that a cloud image is equivalent to a sealed VM with a cloud-init package installed? – SauceCode Nov 4 '16 at 15:24
  • @SauceCode That is basically the case for Fedora's Cloud Base image, but I'd be careful about extending that generically. Other distros might use a different (possibly somewhat-compatible) provisioning tool, and may have other changes — for example, for a while, we carried a kernel configuration hack we knew was necessary for performance in the version of Xen Amazon used to use in EC2. (We've since dropped that.) – mattdm Nov 4 '16 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.