Runbook hardens shared Linux hosts against cache covert channels
Original title: Hardening a shared Linux host against cache covert channels
The guide covers KVM, Firecracker and QEMU: separate cores, disable KSM, keep CPU mitigations, and partition L3 with resctrl.
A late-October 2026 runbook walks operators from a default Linux KVM host to one where trust domains share as little hardware as the machine allows. It says turning off SMT and pinning domains to their own cores closes more channels than cache partitioning, which does little while tenants still share a core. The author says shared hardware only lowers bandwidth and raises cost; agents that must never communicate should use separate physical hosts.
- Commands assume a recent mainline kernel, cgroup v2, systemd 261 or later and util-linux 2.41 or later.
- Step 1 turns SMT off so tenants do not share L1, L2, TLB or branch predictors.
- Kernel Samepage Merging is disabled because it shares identical pages across VMs.
- resctrl CAT, MBA, CMT and MBM partition and monitor the last-level cache and memory bandwidth.
- PMU and RAPL are called out as covert-channel receivers to restrict.
From the original article
14 min read at gctl.io
🧹 Step 4: keep the CPU-bug mitigations on, and flush on switch The previous post explained how agents in separate microVMs passed secrets to each other through the CPU cache, why no kind of VM stops that on its own, and what a layered defence looks like. It stayed at the level of what to do.
By gctl.io via atmosx · gctl.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.