Linux migration · parity attestation

Move the workload off the dying platform.
Hand the auditor proof it still matches.

vrtmv reads your Linux workload — a VM image, a live running system, or a bare-metal server — reconstructs what it actually runs, and rebuilds it as a virtual machine on a modern, supported platform by way of Ansible. Every migration ships with a cryptographically signed parity report (ed25519) as the audit trail — and lets you re-check the instance for drift against that baseline any time after it lands.

Read-only. Never boots the source.
Agentless. Works on a cold image.
Provenance-graded. Every mapping has a source.
Free to RHEL. No fee when you migrate to Red Hat.
vrtmv migrate — CentOS 7 → AlmaLinux 9
$ vrtmv migrate --image prod-web01.vmdk --target alma9 -o ./out mount prod-web01.vmdk → read-only loop, root LV activated probe CentOS Linux 7.9 (x86_64) · rpm Berkeley DB inv 359 packages · ifcfg-bond0 detected xlate resolved 40 canonicals via Translation Index cond 1 blocking step · 4 caveats recorded write roles/vrtmv_migration/tasks/main.yml write vrtmv-attestation.json (signed)✓ migration plan + parity attestation written to ./out
Why now

Two deadlines are colliding

CentOS Linux is end-of-life, and the post-acquisition VMware price shock — with the same calculus now hitting Nutanix — is pushing fleets off their hypervisors at the same time. Both force the same hard question: can you move the workload and prove the replacement is equivalent?

EOL
CentOS Linux 7 & 8 are out of support — no security patches for production fleets still running them.
10×
Renewal quotes reported after the VMware acquisition — and rising Nutanix costs — accelerating hypervisor exits across regulated industries.
0
Tools that hand an auditor a signed, line-by-line statement of what changed in the move — until now.
How it works

Three stages, any Linux source in, an audit trail out

A VM image, a live host, or a bare-metal server — vrtmv captures its true state and reasons from it, then rebuilds the workload as a virtual machine via Ansible.

01

Read the source

Mounts a cold VM image (VMDK / qcow2 / raw) read-only at the block layer — LVM roots activated, partitions inspected — or captures a live host or bare-metal server. Either way it reads the real package database (rpm BDB/ndb/sqlite or dpkg) and on-disk config. Nothing is installed; the workload is never disrupted.

02

Map through the Index

Every package, service, repository, account and MAC-policy is resolved against the curated Translation Index to its equivalent on the target distribution — with confidence graded and on-disk conditions evaluated locally, so host state never leaves the box.

03

Emit role + signed report

Outputs an Ansible role that rebuilds the workload as a virtual machine on the target OS, and a signed parity attestation: what mapped cleanly, what carried caveats, and what couldn't be resolved — stated honestly, ready for an auditor. Download it any time from your customer portal.

Capabilities

More than a package translator

vrtmv carries the whole workload across — the platform it runs on, the data it holds, and the judgment calls in between.

Off VMware — and Nutanix

The cold-image probe reads the disk directly — VMDK, qcow2, OVA, raw — so it doesn't depend on the source platform's tooling. Pull a VM straight out of VMware or Nutanix AHV and rebuild it wherever you're headed, with no vendor exporter in the loop.

Brings your data — and attests it

Rebuilding the OS is half the job. vrtmv finds the data no package owns and emits an attested byte-copy runbook — with a sha256 manifest that proves the copy is byte-identical — while routing databases to a proper export/import (their files can't be raw-copied). It plans and hashes locally and never moves a byte itself; data migration is part of the plan, not a separate project.

An operator decision punchlist

Every migration surfaces a punchlist — the calls only a human can make, called out instead of buried. For each, you can query the Index for community field notes: anecdotes from operators who've made the move, collected and presented as input, never as guidance.

Coverage that reaches back in time

100+ Linux releases across 16 distribution families, back to the year 2000 — 8,700+ package mappings and 46,000+ cross-distro translations, each harvested from the real distro archives, not guessed. The migrations that hurt most are the oldest ones, so the Index reaches all the way back: the legacy hosts other tools abandoned still have a path forward.

Re-verify parity after the move

A migration is a moment; parity is a state. Any time after cutover — before an audit, after a change — vrtmv re-checks a migrated instance for drift against its signed baseline: packages, services, config, accounts. The attestation stays something you can re-verify, not a one-day snapshot. Drift monitoring is the ongoing half of what vrtmv sells.

The deliverable

The output is evidence, not a guess

  • Every translation carries its confidence grade and the provenance of the rule behind it.
  • Conditions that can't be known from a cold image are reported as unknown — never silently assumed true.
  • Gaps are first-class: unresolved packages and untranslated canonicals are listed, not hidden.
  • The report is signed and reproducible — the same image yields the same attestation.
"target": "almalinux 9", "source": "centos 7", "canonicals_translated": 40, "caveats": [ { "canonical": "cpkg:iproute", "note": "bonded host detected; NetworkManager-team required on target — verify before cutover" } ], "gaps": { "unresolved": 301 }, "basis": "base-translation; not full parity", "signature": "ed25519:…"
Architecture

Your data never leaves your environment

The client runs entirely inside your network and does all the analysis on your own image. It asks our hosted API for one thing — what each package maps to on the target. We handle the mapping intelligence; your configs, inventory, and secrets stay home.

›_

You run the engine

A single self-contained CLI that runs wherever your workload lives — on-prem, air-gapped edge, or a migration jump host. It reads the image, builds the inventory, and renders the plan locally. Nothing about your machine is uploaded.

We maintain the Index

A curated knowledge base of cross-distribution mappings — packages, services, repos, accounts, MAC policy — each row with verifiable provenance and an honest confidence grade. You get expert mapping intelligence without curating it yourself.

🔒

Only identifiers cross the line

The client sends package names to look up and gets answers back — never your data. The API is authenticated and metered, so your account is private and accountable, and the workload itself never crosses the boundary.

On the roadmap

From source to a running OpenShift VM

The rebuilt virtual machine doesn't have to stop at an Ansible role. vrtmv is adding automated tooling to hand the migrated VM straight to Red Hat OpenShift Virtualization — provisioning it as an OpenShift VM, with the same parity attestation travelling alongside as the deployment record.

One path, end to end

VM image, live host, or bare metal → reconstructed as a VM via Ansible → deployed to OpenShift Virtualization — each step attested. (In development.)

See it migrate a real CentOS 7 host

The live demo runs the actual engine against a real CentOS 7 package database, translates it through the Index over the live API, and shows you the Ansible role and the signed parity report it produces.