Linux migration · parity attestation

Move the workload off the dying platform.
Prove it still matches.

vrtmv reads your Linux workload — a VM image, a live running system, or a bare-metal server — reconstructs what it actually runs, and rebuilds it as a virtual machine on a modern, supported platform by way of Ansible — emitting a signed parity report as the audit trail.

Read-only. Never boots the source.
Agentless. Works on a cold image.
Provenance-graded. Every mapping has a source.
vrtmv migrate — CentOS 7 → AlmaLinux 9
$ vrtmv migrate --image prod-web01.vmdk --target alma9 -o ./out mount prod-web01.vmdk → read-only loop, root LV activated probe CentOS Linux 7.9 (x86_64) · rpm Berkeley DB inv 359 packages · ifcfg-bond0 detected xlate resolved 40 canonicals via Translation Index cond 1 blocking step · 4 caveats recorded write roles/vrtmv_migration/tasks/main.yml write vrtmv-attestation.json (signed)✓ migration plan + parity attestation written to ./out
Why now

Two deadlines are colliding

CentOS Linux is end-of-life and the post-acquisition VMware price shock is pushing fleets off vSphere at the same time. Both force the same hard question: can you move the workload and prove the replacement is equivalent?

EOL
CentOS Linux 7 & 8 are out of support — no security patches for production fleets still running them.
10×
Renewal quotes reported after the VMware acquisition, accelerating hypervisor exits across regulated industries.
0
Tools that hand an auditor a signed, line-by-line statement of what changed in the move — until now.
How it works

Three stages, any Linux source in, an audit trail out

A VM image, a live host, or a bare-metal server — vrtmv captures its true state and reasons from it, then rebuilds the workload as a virtual machine via Ansible.

01

Read the source

Mounts a cold VM image (VMDK / qcow2 / raw) read-only at the block layer — LVM roots activated, partitions inspected — or captures a live host or bare-metal server. Either way it reads the real package database (rpm BDB/ndb/sqlite or dpkg) and on-disk config. Nothing is installed; the workload is never disrupted.

02

Map through the Index

Every package, service, repository, account and MAC-policy is resolved against the curated Translation Index to its equivalent on the target distribution — with confidence graded and on-disk conditions evaluated locally, so host state never leaves the box.

03

Emit role + signed report

Outputs an Ansible role that rebuilds the workload as a virtual machine on the target OS, and a signed parity attestation: what mapped cleanly, what carried caveats, and what couldn't be resolved — stated honestly, ready for an auditor.

The deliverable

The output is evidence, not a guess

  • Every translation carries its confidence grade and the provenance of the rule behind it.
  • Conditions that can't be known from a cold image are reported as unknown — never silently assumed true.
  • Gaps are first-class: unresolved packages and untranslated canonicals are listed, not hidden.
  • The report is signed and reproducible — the same image yields the same attestation.
"target": "almalinux 9", "source": "centos 7", "canonicals_translated": 40, "caveats": [ { "canonical": "cpkg:iproute", "note": "bonded host detected; NetworkManager-team required on target — verify before cutover" } ], "gaps": { "unresolved": 301 }, "basis": "base-translation; not full parity", "signature": "ed25519:…"
Architecture

A client you run, an index you can't copy

The curated knowledge stays server-side. The client does the analysis on your image; the Index answers translation queries over an authenticated API — the licensing and trust boundary.

›_

The engine

A single self-contained CLI: cold-image probe, inventory, conditional evaluation, and renderer. Runs where your image is — on-prem, air-gapped network edge, or a migration jump host.

The Translation Index

A curated PostgreSQL knowledge base of cross-distribution mappings — packages, services, repos, accounts, MAC policy — each row carrying verifiable provenance and an honest confidence grade.

The API

The only thing that touches the Index. Authenticated, metered, and the account boundary — so the curated asset never ships to the client and every lookup is accountable.

On the roadmap

From source to a running OpenShift VM

The rebuilt virtual machine doesn't have to stop at an Ansible role. vrtmv is adding automated tooling to hand the migrated VM straight to Red Hat OpenShift Virtualization — provisioning it as an OpenShift VM, with the same parity attestation travelling alongside as the deployment record.

One path, end to end

VM image, live host, or bare metal → reconstructed as a VM via Ansible → deployed to OpenShift Virtualization — each step attested. (In development.)

See it migrate a real CentOS 7 host

The live demo runs the actual engine against a real CentOS 7 package database, translates it through the Index over the live API, and shows you the Ansible role and the signed parity report it produces.