Building a Secure and Versatile Lab on Your PC: Linux Base and Hypervisor Approach

Modern professionals often need to run multiple operating systems, containers, DevOps tools, AI workloads, pentesting environments, and even graphic applications like Photoshop or video editing software—all on a single PC. Achieving this requires proper virtualization, isolation, and security measures. This guide will help you understand the choices and build a robust lab environment.

Linux Base vs Proxmox VE

Linux Base

• Definition: Linux is installed directly on bare metal hardware.

• Examples: Ubuntu, Debian, Fedora.

• Purpose: Linux becomes your main workstation for coding, AI, DevOps, and pentesting.

• Virtualization Options: KVM/QEMU, VirtualBox, Docker, Podman.

Pros:

• Full native performance for Linux applications.

• Flexible: install any VM or container setup.

• Works as a full-fledged workstation.

Cons:

• VM and isolation management require manual setup.

Proxmox VE

• Definition: Debian-based Linux distribution optimized as a hypervisor.

• Focus: Running virtual machines (KVM) and containers (LXC).

• Management: Web interface for VM, container, network, and snapshot management.

Pros:

• Ideal for running multiple VMs and lab environments.

• Strong isolation between virtual machines.

• Built-in snapshots, backups, and network segmentation.

Cons:

• Less convenient as a main workstation; most work happens inside VMs.

Virtualization and Isolation

Virtual Machines (VM)

• Examples: KVM/QEMU, VirtualBox, VMware, Proxmox VE.

• Use cases: Windows for Photoshop/video editing, Kali Linux for pentesting, Linux for AI/DevOps.

• GPU passthrough: Allows VMs to directly use your GPU for high performance.

• Benefits: Full isolation between operating systems; snapshots for easy rollback.

Containers

• Examples: Docker, Podman, LXC.

• Features: Lightweight, fast startup, but less isolated by default.

• Security enhancements:

  • Podman rootless for running containers without root privileges.

  • Kata Containers / gVisor for microVM-level isolation.

  • AppArmor / SELinux for process restrictions.

  • Network namespaces for network isolation.

Network and Security

• Use virtual firewalls (pfSense, OPNsense) inside Proxmox or Linux.

• Segment networks for different use cases:

  • DevOps services

  • Pentesting labs

  • AI/Windows applications

• Protects the main system from accidental attacks or misconfigurations.

Storage

• Disk encryption: LUKS/dm-crypt for full data protection.

• File systems: ZFS for snapshots, compression, and backups.

• VM snapshots: Rollback to any previous state easily.

Running Multiple Operating Systems

Options for working with multiple OSes:

1. VM via Hypervisor (KVM/Proxmox)

   • Linux as the main workstation

   • Windows VM for Photoshop/editing

   • Kali Linux VM for pentesting

   • Full isolation and parallel operation

2. Dual Boot

   • Linux and Windows on separate disks/partitions

   • Max performance for each OS

   • Cannot run simultaneously

3. Linux inside Windows via WSL2

   • Suitable for development and DevOps

   • Limited isolation; not recommended for pentesting

4. GPU virtualization (vGPU / mdev)

   • Share GPU across multiple VMs

   • Requires compatible hardware

Example Ideal Lab Setup

Base OS:

• Linux (Ubuntu/Debian/Fedora) on bare metal.

Virtual Machines:

• Windows VM with GPU passthrough for Photoshop/video editing

• Kali Linux VM for pentesting

• Ubuntu AI VM for local AI and API work

• DevOps VM running Dokploy for containerized services

Containers:

• Podman rootless + Kata Containers for microservices with enhanced isolation

Network:

• pfSense virtual firewall → network segmentation and isolation

Storage:

• LUKS encrypted disks + ZFS snapshots for reliability

Key Recommendations

Goal	Recommended Setup
Workstation + security	Linux base + KVM/Podman/gVisor
Mini-server/lab with multiple VMs	Proxmox VE
Maximum Windows performance	Dual Boot or Windows VM with GPU passthrough
Balance security and versatility	Linux base + Proxmox/KVM VM inside

---

Working Lab Setup Example(From VeilStack)

1. Base OS

• Install Ubuntu on bare metal for the main Linux environment.

2. Virtual Machines

• Install QEMU/KVM for VM management.

• Create VMs for:

  • Windows 10/11 (lightweight, for editing and Photoshop)

  • Kali Linux / Parrot Security Lite (pentesting)

  • Other test OSes as needed

• GPU passthrough for high-performance Windows/AI workloads.

3. Containers and DevOps

• Install Dokploy for container orchestration and production-like services.

• Use Podman rootless or Kata Containers/gVisor for stronger isolation.

4. IDEs and Coding

• VSCode or cloud IDEs (Gitpod, GitHub Codespaces).

• Development can run in containers or VMs for additional security.

5. VPN and Networking

• Configure VPN (WireGuard/OpenVPN) via Ubuntu settings.

• Segment networks for DevOps, pentesting, and main OS tasks.

6. Browsing

• Use Brave or Firefox as the primary browser.

• Optionally isolate browser sessions in a VM or container.

7. Graphics and Editing

• Light video editing on Linux (Kdenlive, DaVinci Resolve).

• Heavy editing in Windows VM with GPU passthrough.

• Optionally, macOS in QEMU for testing or specialized editing (non-official).

8. Extensibility and Testing

• Easily deploy new VMs or containers for testing:

  • Pentesting

  • DevOps experiments

  • AI/ML workloads

  • Any other OS or application tests