# Nested virtualization

Every sandbox has `/dev/kvm`, so QEMU, Firecracker and the Android emulator can run inside it.

```sh
harebox new --name kvm
harebox exec current -- test -e /dev/kvm
```

## What changes while nested guests run

| Feature | While a nested VM runs |
|---|---|
| Auto-sleep | Off |
| Memory snapshot | Refused with `409 capability_unavailable` |
| Disk snapshot | Works, and says `crash_consistent` |
| Fork | Disk only |
| Maintenance | A scheduled restart, with at least 72 hours' notice |

This is deliberately conservative. Saving nested CPU state isn't confirmed on AMD. Having `/dev/kvm` doesn't trigger this: only running nested guests does. Read `capabilities.memory_snapshot` rather than assuming.