Nested Virtualization

Some CI workloads need nested virtualization in the runner guest to use hardware acceleration via /dev/kvm. The most common example is reactivecircus/android-emulator-runner for Android instrumentation tests, but some QEMU and libvirt workflows also need it.

Usage

Enable nested virtualization by adding nested-virtualization.enabled=true to the runs-on label in your workflow:

jobs:
  instrumentation-tests:
    runs-on: warp-ubuntu-latest-x64-4x;nested-virtualization.enabled=true

WarpBuild provisions the runner on hardware that supports nested virtualization and exposes the virtualization extensions to the guest, making /dev/kvm available.

Support matrix

If you include the nested-virtualization.enabled=true label on an unsupported runner type, the label will be silently ignored and the job will run normally without nested virtualization.

Android emulator workflows require a permissions step

Once /dev/kvm is available on the runner, the default device permissions (crw-rw---- root:kvm) still prevent the runner user from opening it so the following step is required before running reactivecircus/android-emulator-runner:

- name: Enable KVM group perms
  run: |
    echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \
      | sudo tee /etc/udev/rules.d/99-kvm4all.rules
    sudo udevadm control --reload-rules
    sudo udevadm trigger --name-match=kvm

The step is not a WarpBuild-specific workaround and is required in all GitHub and GitHub-compatible runners.

See Android emulator action's README and GitHub's blog about hardware-accelerated Android virtualization.

Without this step, the Android emulator action's ProbeKVM check fails and it silently launches the emulator with -accel off, falling back to pure software emulation, which is substantially slower than hardware-accelerated execution. Symptoms in your workflow logs:

1. ProbeKVM: This user doesn't have permissions to use KVM (/dev/kvm).
2. Disabling Linux hardware acceleration.
3. The emulator command line includes -accel off.

After adding the step, those messages disappear and tests run with hardware acceleration.