Configuration Reference

QV-CFG-001 Rev 1.0 — January 2026

Complete reference for QuantaVirt VM configuration files. VMs are defined using JSON configuration files that specify CPU topology, memory allocation, storage devices, network interfaces, PQC settings, and boot behavior. All fields are documented with types, defaults, and valid ranges.

Configuration Overview #

VM configuration files are stored in /var/lib/quantavirt/configs/ by default. The configuration is a JSON document validated against the QuantaVirt schema at VM creation time. Configuration files can be created manually, generated by the CLI wizard (quantavirt vm create --interactive), or exported from the GUI.

# Validate a config without creating the VM
quantavirt vm validate --config /path/to/vm.json

# Create VM from config
quantavirt vm create --config /path/to/vm.json

# Export running VM config
quantavirt vm export ubuntu-server --output ubuntu-server.json

VM Configuration Schema #

Top-level structure of a VM configuration document:

FieldTypeRequiredDefaultDescription
namestring✅—Unique VM name (1–64 chars, [a-zA-Z0-9_-])
descriptionstring""Human-readable description
uuidstringAuto-generatedUUID v4 — auto-generated if omitted
cpuobject✅—CPU topology and features
memoryobject✅—Memory allocation and policy
devicesobject✅—Storage, network, graphics, USB, PCI devices
bootobjectSee belowBoot order, firmware type, kernel boot
pqcobjectSee belowPQC subsystem configuration
migrationobjectSee belowLive migration settings
securityobjectSee belowConfidential computing (SEV-SNP/TDX)

CPU Configuration #

FieldTypeDefaultRangeDescription
cpu.countinteger11 – 256Number of virtual CPUs
cpu.modelstring"host"See modelsCPU model: "host" (passthrough), "qemu64", "EPYC", etc.
cpu.featuresarray[]—CPUID feature flags: "+aes", "-avx512f", "+rdrand"
cpu.topology.socketsinteger11 – 8Number of CPU sockets presented to guest
cpu.topology.coresinteger= count1 – 128Cores per socket (count = sockets × cores × threads)
cpu.topology.threadsinteger11 – 2Threads per core (SMT)
cpu.pinarraynull—vCPU-to-pCPU mapping: [{"vcpu":0,"pcpu":2}]
cpu.weightinteger2561 – 65535Scheduler weight (proportional CPU share)
cpu.capinteger00 – 100CPU cap (% of one pCPU); 0 = uncapped
cpu.numa_nodeintegernull0 – NPreferred NUMA node for memory and CPU placement

Memory Configuration #

FieldTypeDefaultDescription
memory.sizestring—RAM allocation: "512M", "2G", "64G". Required.
memory.hugepagesbooleanfalseUse 2MB hugepages for guest RAM (reduces TLB misses)
memory.hugepage_sizestring"2M"Hugepage size: "2M" or "1G"
memory.balloonbooleanfalseEnable VirtIO memory balloon (dynamic memory reclaim)
memory.max_sizestring= sizeMaximum memory for hotplug (must be ≥ size)
memory.preallocbooleanfalsePre-allocate all memory pages at VM creation
memory.encryptedbooleanfalseEnable memory encryption (SEV/TDX required)

Storage Devices #

Storage devices are defined in the devices.storage array. Each entry defines a block device presented to the guest.

FieldTypeDefaultDescription
typestring—Controller: "virtio-blk", "nvme", "ahci", "ide"
pathstring—Path to disk image or block device
formatstringAuto-detectImage format: "raw", "qcow2", "encrypted"
readonlybooleanfalsePresent device as read-only
mediastring"disk"Media type: "disk" or "cdrom"
boot_indexintegernullBoot priority (lower = higher priority)
cachestring"writeback"Cache mode: "none", "writeback", "writethrough", "directsync"
iostring"native"I/O backend: "native" (AIO), "threads"
queuesinteger1Number of I/O queues (VirtIO multi-queue)
encryptedbooleanfalseEnable PQC encryption (ML-KEM wrapped AES-256-GCM)
discardbooleanfalseEnable TRIM/discard support (qcow2 sparse reclaim)

Network Devices #

FieldTypeDefaultDescription
typestring—NIC type: "virtio-net", "e1000", "e1000e"
networkstring"default"Virtual network name to attach to
macstring"auto"MAC address — "auto" generates 52:54:00:xx:xx:xx
modelstring= typeGuest-visible NIC model (for driver matching)
queuesinteger1Multi-queue count (VirtIO-net; typically = vCPU count)
vhostbooleantrueUse vhost-net/vhost-user acceleration
offloadobjectAll enabledTCP/UDP checksum offload, TSO, GSO, GRO
mtuinteger1500Maximum transmission unit (bytes)
pqc_tunnelbooleanfalseEncrypt all traffic with PQC tunnel (ML-KEM + AES-GCM)

Graphics & Console #

FieldTypeDefaultDescription
devices.console.typestring"virtio-console"Serial console: "virtio-console", "serial" (16550)
devices.graphics.typestring"none"GPU: "virtio-gpu", "none"
devices.graphics.vnc.listenstring"127.0.0.1"VNC listen address
devices.graphics.vnc.portintegerAuto (5900+)VNC port number
devices.graphics.vnc.passwordstringnullVNC password (optional, max 8 chars)
devices.graphics.virglbooleantrueEnable Virgl 3D acceleration (VirtIO-GPU only)

Boot Configuration #

FieldTypeDefaultDescription
boot.orderarray["disk"]Boot device priority: "disk", "cdrom", "network"
boot.uefibooleantrueUEFI firmware (OVMF); false = SeaBIOS
boot.secure_bootbooleanfalseEnable UEFI Secure Boot (requires uefi: true)
boot.kernelstringnullDirect kernel boot — path to vmlinuz
boot.initrdstringnullInitramfs path (for direct kernel boot)
boot.cmdlinestringnullKernel command line (for direct kernel boot)

PQC Configuration #

FieldTypeDefaultDescription
pqc.enabledbooleantrueEnable PQC subsystem for this VM
pqc.backendstring"auto"Backend: "auto", "quac100", "software"
pqc.attestation.enabledbooleanfalseEnable ML-DSA signed attestation reports
pqc.attestation.algorithmstring"ML-DSA-65"Signature algorithm: "ML-DSA-44", "ML-DSA-65", "ML-DSA-87"
pqc.storage_encryption.enabledbooleanfalseEncrypt storage with PQC key wrapping
pqc.storage_encryption.kemstring"ML-KEM-768"KEM for key wrapping: "ML-KEM-512", "ML-KEM-768", "ML-KEM-1024"
pqc.storage_encryption.aeadstring"AES-256-GCM"AEAD cipher: "AES-256-GCM", "ChaCha20-Poly1305"

Hypervisor-Level Settings #

These settings are configured via kernel parameters (boot command line) or the global configuration file /etc/quantavirt/quantavirt.conf, not per-VM JSON.

SettingFile Field / Boot ParamDefaultDescription
Default schedulerscheduler / sched=credit2Global vCPU scheduler
Hugepage poolhugepages / hugepages=autoPre-allocate hugepages
API listenerapi.listen / api=unixManagement API: unix socket or tcp:addr:port
Log levellogging.level / loglevel=infoHypervisor log verbosity
VM storage pathstorage.default_path/var/lib/quantavirtDefault directory for VM images and configs
QUAC 100 modepqc.quac100 / quac100=autoQUAC 100 detection: auto, on, off

Complete Examples #

Minimal Linux Server

{
  "name": "minimal-linux",
  "cpu": { "count": 1 },
  "memory": { "size": "512M" },
  "devices": {
    "storage": [{ "type": "virtio-blk", "path": "/var/lib/quantavirt/images/minimal.qcow2" }],
    "network": [{ "type": "virtio-net", "network": "default" }],
    "console": { "type": "virtio-console" }
  }
}

High-Performance Database Server

{
  "name": "db-server",
  "cpu": {
    "count": 16,
    "model": "host",
    "topology": { "sockets": 2, "cores": 4, "threads": 2 },
    "pin": [{"vcpu":0,"pcpu":0},{"vcpu":1,"pcpu":1}],
    "numa_node": 0
  },
  "memory": { "size": "64G", "hugepages": true, "hugepage_size": "1G", "prealloc": true },
  "devices": {
    "storage": [
      { "type": "virtio-blk", "path": "/dev/nvme0n1p4", "format": "raw", "cache": "none", "io": "native", "queues": 16 }
    ],
    "network": [
      { "type": "virtio-net", "network": "internal", "queues": 16, "vhost": true, "mtu": 9000 }
    ]
  }
}

PQC-Secured Confidential VM

{
  "name": "confidential-vm",
  "cpu": { "count": 4, "model": "EPYC" },
  "memory": { "size": "8G", "encrypted": true },
  "devices": {
    "storage": [
      { "type": "virtio-blk", "path": "/var/lib/quantavirt/images/confidential.qcow2", "encrypted": true }
    ],
    "network": [
      { "type": "virtio-net", "network": "secure", "pqc_tunnel": true }
    ]
  },
  "pqc": {
    "enabled": true,
    "backend": "quac100",
    "attestation": { "enabled": true, "algorithm": "ML-DSA-87" },
    "storage_encryption": { "enabled": true, "kem": "ML-KEM-1024", "aead": "AES-256-GCM" }
  },
  "security": {
    "type": "sev-snp",
    "policy": { "debug": false, "migrate": false, "single_socket": true }
  }
}