QEMU Storage Daemon: production-quality and secure?

QEMU Storage Daemon: production-quality and secure?

[Demi Marie Obenour]

[-- Attachment #1.1.1: Type: text/plain, Size: 314 bytes --]

When used as a vhost-user server, is the QEMU Storage Daemon suitable
for production use with untrusted guests and images?  Does it have
decent performance?

I'm wondering because Cloud Hypervisor has support for various formats,
but that adds complexity.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: QEMU Storage Daemon: production-quality and secure?

[Markus Armbruster]

Cc: qemu-block and maintainer.

Demi Marie Obenour <demiobenour@gmail.com> writes:

> When used as a vhost-user server, is the QEMU Storage Daemon suitable
> for production use with untrusted guests and images?  Does it have
> decent performance?
>
> I'm wondering because Cloud Hypervisor has support for various formats,
> but that adds complexity.

Re: QEMU Storage Daemon: production-quality and secure?

[Kevin Wolf]

Am 18.05.2026 um 08:23 hat Markus Armbruster geschrieben:
> Cc: qemu-block and maintainer.
> 
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
> > When used as a vhost-user server, is the QEMU Storage Daemon suitable
> > for production use with untrusted guests and images?  Does it have
> > decent performance?

I think this is actually two questions:

Is qemu-storage-daemon production quality and secure? It is really just
a very thin wrapper around the components that QEMU itself uses. The
part that is distinct is basically just parsing the command line, after
that it's exactly the same as QEMU itself (well, exactly the same as a
subset of QEMU, obviously). So I wouldn't worry about that part.

The other question is about the performance of the vhost-user-blk
export. It's been a while since I benchmarked exports, but when I
did for my KVM Forum 2024 talk [1], performance wasn't bad, though it
looked like it wasn't quite perfect either: vdpa-blk (VDUSE) performed
slightly better, so if you can use that instead, it's worth a look.

Kevin

[1] https://gitlab.com/qemu-project/kvm-forum/-/raw/main/_attachments/2024/slides_out_of_process_storage_backends_hGZBfpS.pdf