Infrastructure abstraction
Virtual machines
A virtual machine is a computer made of files. A hypervisor hands a guest operating system fake hardware, and the guest cannot tell the difference — which is why the same idea runs a laptop demo and half of the public cloud.
One machine, divided
The hypervisor is the layer that decides who gets how much of the CPU, memory and disk. Each guest gets its own kernel and believes it owns the hardware. The physical machine only ever runs one thing: the hypervisor.
Type 1 hypervisors run straight on the hardware — ESXi, Proxmox, Hyper-V, KVM — and that is what a cloud provider uses. Type 2 hypervisors run as an application on your desktop: VirtualBox, VMware Workstation. Same idea, one more operating system in the stack, one more tax on performance.
Why the abstraction earns its keep
Isolation: a guest cannot see another guest's memory, so a compromised application is contained by a boundary the kernel enforces. Portability: the guest is a bundle of files, so it can be moved, copied and replayed somewhere else. Density: one server runs many workloads that each believe they are alone.
The cost is the guest operating system itself. Every VM boots a full kernel, reserves its memory whether or not it uses it, and duplicates the work your host is already doing. That tax is exactly what containers remove — which is the next guide.
Where you meet them in this course
An EC2 instance is a virtual machine. `run-instances` boots a guest from an image (an AMI) on hardware you never see, and a security group is the firewall in front of it. The labs let you drive that from the CLI and then read the state back as JSON, because that is how you will debug it in a job.
The in-browser sandbox is the same abstraction taken to its logical end: a filesystem that exists for the length of a lesson and is thrown away. Nothing you break costs anything.
Commands in this lesson
Every one of these runs in the sandbox — no real account, no real bill.
| Command | Why |
|---|---|
aws ec2 create-security-group --group-name web-sg --description 'SSH access' | The firewall exists before the machine does — a VM with no group is a VM nobody can reach. |
aws ec2 authorize-security-group-ingress --group-name web-sg --protocol tcp --port 22 --cidr 203.0.113.10/32 | One port, one source. Least privilege is a CIDR, not a slogan. |
aws ec2 run-instances --image-id ami-0abcd1234 --instance-type t3.micro --security-groups web-sg | Image + size + firewall = a booted guest. The image is the VM's disk before first boot. |
aws ec2 describe-instances > /opt/instances.json | State, read back as data. Never trust that a resource exists because a command returned 0. |
Now do it
Reading the model makes the first attempt faster. Only the lab makes you able to do it.
- Open the lab
Launch an EC2 Instance Behind a Least-Privilege Security Group
Intermediate · 30 min · members
- Open the lab
Services: Managing systemd Units
Intermediate · 20 min · free
Virtual machines · OphirCloud Academy · all lessons