Series E · The Machine Inside The Machine

VM Lineage · Turtles All The Way Down

where it came from · and how deep the nesting really goes

Two halves: the lineage of the virtual machine (first hypervisor 1967 → healed in hardware 2005), and the embedding stack — how many machines-inside-machines your code actually sits within — with an honest accounting of where WSL2 and Docker really land (they're not the same kind of thing).

§1 The Lineage · first hypervisor → healed in silicon

1967
first hypervisor

CP-40 · IBM Cambridge Scientific Center

The first OS to implement complete virtualization — each user got a full virtual S/360. Ran 14 simultaneous VMs; privileged instructions trapped to the control program, which simulated them. Trap-and-simulate is the seed of everything.

1968

CP-67 / CMS

CP-40 ported to the S/360-67 — the first widely available VM architecture, given to key time-sharing customers.

Aug 1972
first product

VM/370

The first VM operating system IBM shipped as an official product — and the first hardware-assisted virtualization (System/370). The production hypervisor mainframes ran for decades.

1974
the theory

Popek & Goldberg

The doctrinal test: an architecture is efficiently virtualizable iff its sensitive instructions are a subset of its privileged instructions — every instruction that could expose machine state must trap to the supervisor. The rule every CPU is measured against for 30 years.

~1985–98
the crack

The x86 Dark Age

Virtualization vanished from PCs: x86 broke the Popek-Goldberg rule17 sensitive instructions failed silently in user mode instead of trapping. The measure-level crack: a specific count of instructions that wouldn't behave.

1998
heal (software)

VMware · binary translation

Healed x86 by rewriting kernel code on the fly to force the missing traps — making x86 virtualization commercially viable for the first time. The old rule satisfied by translation.

2005–06
heal (hardware)

Intel VT-x · AMD-V

The hardware finally added the traps x86 lacked — healing the Popek-Goldberg violation in silicon. VMs became fast and ubiquitous; the entire cloud runs on this. (Xen, 2003, bridged the gap just before.)

"hypervisor" = "hyper" (above) + "visor" (supervisor) = the layer that supervises the supervisors (the OSes). The crack is always an instruction count; the heal absorbs the old rule as a constraint the new layer satisfies. Same crack→heal staircase as gravity and sandboxing.

§2 Turtles All The Way Down · the embedding stack

How many machines-inside-machines does your code sit within? Pick a setup — the stack builds with accurate depth:

the accuracy point you asked for: a VM and a container are different kinds of embedding.

WSL2 is a real VM — a genuine Linux kernel running in a lightweight Hyper-V virtual machine. It virtualizes hardware and has its own kernel. That's a true nesting level.

A Docker container is NOT a VM — it's OS-level isolation (namespaces + cgroups) that shares the host kernel. It virtualizes the operating system's view, not the hardware. Lighter, but a different kind of boundary.

So "Docker is a VM" is a common misconception: plain Docker on Linux adds zero VMs. Only Docker Desktop on Windows/Mac adds a real VM — because it runs the Docker engine inside WSL2 (a VM). That's why the same "docker run" is a different depth on Windows than on Linux.

§3 Unbounded · why it's really turtles

A VM can run a VM can run a VM — nested virtualization is real (VT-x can expose itself to a guest). So embedding depth isn't fixed; it's arbitrarily extendable, a self-similar stack of machines each believing it owns "the" hardware. The name says it: a hypervisor supervises supervisors, and that can itself be supervised. Bounded only by the friction tax each layer adds — every embedding level costs performance, the conversion-cost at every boundary.

VM = virtualizes hardware (own kernel) · container = virtualizes the OS (shares kernel) · runtime/sandbox = virtualizes execution · each is a machine-in-a-machine · nesting is unbounded in principle · each turtle pays rent (performance) to the one below.
CP-40 (1967) → VM/370 (1972) → POPEK-GOLDBERG (1974) → x86 BROKE IT (17 INSTRUCTIONS) → VMWARE (1998) → VT-x/AMD-V (2005-06)
HYPERVISOR = SUPERVISOR OF SUPERVISORS · VM VIRTUALIZES HARDWARE · CONTAINER SHARES THE KERNEL
WSL2 = REAL VM · DOCKER CONTAINER = OS-ISOLATION, NOT A VM · NESTING UNBOUNDED · EACH TURTLE PAYS RENT
VM LINEAGE · TURTLES ALL THE WAY DOWN · A PURPLE PAPER · SERIES E · JUNE 2026