audit-grade linux migration
Move the workload off the dying platform.
Prove it still matches.
The moment
Two deadlines are colliding
CENTOS EOL
The OS is out of support
CentOS Linux 7 and 8 no longer receive security patches. Regulated fleets are running unsupported production hosts right now.
HYPERVISOR EXIT
vSphere & Nutanix got expensive
Post-acquisition VMware renewal shock — and rising Nutanix costs — are pushing organizations off their hypervisors, many to KVM and cloud, on a compressed timeline.
Both force the same question at once: can you move the workload — and prove the replacement is equivalent?
The gap
Moving is a solved problem. Proving equivalence isn't.
- Conversion tools copy disks between hypervisors. They say nothing about whether the rebuilt OS still does the same thing.
- Re-platforming a distro (CentOS → AlmaLinux/RHEL/Ubuntu) is manual, tribal, and error-prone — package names, repos, services, MAC policy all drift.
- When the auditor asks "what changed, and how do you know it's equivalent?" — there is no artifact to hand them.
The migration is risky precisely because it's undocumented. vrtmv turns the migration into evidence.
What vrtmv does
Any Linux source in. An audit trail out.
image · live · bare‑metal→PROBE→TRANSLATE→ATTEST→VM via Ansible
vrtmv reads any Linux source — a VM image, a live running system, or bare metal — reconstructs what it actually runs, rebuilds it as a virtual machine via Ansible, and signs a parity report proving what changed.
How · 01 probe
It reasons from the bytes, not from a login
- Read-only at the block layer. The source is never booted, never altered — safe for forensics and audit.
- Agentless. Nothing is installed on the source. Works on a cold VMDK / qcow2 / raw image, LVM roots included.
- Reads the real state: the rpm Berkeley-DB / ndb / sqlite or dpkg database, plus on-disk config — including EL7's hard Berkeley-DB path.
probe CentOS Linux 7.9 (x86_64)
rpm Berkeley DB
mount read-only loop +
LVM root activated
inv 344 packages
ifcfg-bond0 detected
How · 02 translate · the asset
The Translation Index
A curated knowledge base of cross-distribution mappings — packages, services, repositories, accounts, MAC policy — that turns "what this host runs" into "what it must run on the target."
PROVENANCE
Every mapping cites a real, verifiable source. No fabricated rules.
CONFIDENCE
Each row graded high / medium / low / untested — honestly.
CONDITIONAL
Rules evaluate against on-disk state locally — host data never leaves.
How · 03 attest · the wedge
The output is evidence, not a guess
- An Ansible role that rebuilds the workload as a VM on the target OS.
- A signed parity attestation: what mapped cleanly, what carried caveats, what couldn't be resolved.
- Unknowable-from-cold conditions are reported as unknown — never silently assumed true.
- Reproducible: same image → same attestation.
"packages_translated": 82
"caveats": [{
"canonical": "cpkg:iproute",
"note": "bonded host →
NetworkManager-team
required on target"
}]
"gaps": { unresolved: 2 }
"signature": "ed25519:…"
Capabilities
More than a package translator
PLATFORM EXIT
Off VMware & Nutanix
Reads the disk directly — VMDK / qcow2 / OVA / raw — with no vendor exporter. Pull VMs straight out of VMware or Nutanix AHV.
DATA
Carries the data, too — attested
Finds the data no package owns, then emits an attested byte-copy runbook — a sha256 manifest that proves the copy is byte-identical — and export/import steps for databases. Part of the plan, not a separate project.
PUNCHLIST
Operator decision punchlist
The calls only a human can make, called out — with community field notes queryable from the Index as input, never guidance.
COVERAGE
100+ releases, back to 2000
100+ Linux releases across 16 families — 8,700+ package mappings and 46,000+ translations harvested from the real archives, not guessed. The legacy hosts other tools abandoned still have a path.
Architecture
Your data never leaves your environment
your image→engine (runs in your env)→ package names only →hosted mapping API
- The client runs entirely inside your network and does all the analysis on your own image — on-prem, air-gapped edge, or a jump host.
- It asks the hosted API for one thing: what each package maps to on the target. We maintain the mapping intelligence so you don't have to.
- Only package identifiers cross the line — your configs, inventory and secrets stay home. The API is authenticated and metered.
Roadmap
From source to a running OpenShift VM
image · live · bare‑metal→vrtmv + Ansible→virtual machine→OpenShift Virtualization
- Automated tooling to hand the rebuilt VM straight to Red Hat OpenShift Virtualization — provisioned as an OpenShift VM.
- The parity attestation travels with it as the deployment record — the same evidence, end to end.
In development — the migration + attestation pipeline ships first; OpenShift deployment is the next axis.
Why it holds up
Built to survive an audit
HONEST GAPS
Unresolved packages and untranslated canonicals are listed, not hidden. Absence is reported as absence.
UNKNOWN ≠ FALSE
A condition that can't be known from a cold image is flagged unknown — the audit-defensible default.
SIGNED + REPRODUCIBLE
The report is signed and deterministic. The same disk yields the same evidence, every time.
Market · TAM
A ~$16B market — that Broadcom is shrinking by price
~$16B
/yr — Broadcom's VMware revenue run-rate (FY24)
~30M
VMs on VMware — revenue ÷ ~$500/VM/yr blended
$599–999
per instance — $200–400 migrate + $399–599/yr recurring ARR (lower per-instance as pack size grows) — our wedge into the churn
$16B ÷ ~$500/VM→~30M VMs→ ~20% exit →~6M VMs migrating→~$600M migration TAM
The price hikes that grow Broadcom's revenue are the same hikes that push VMs off the platform — the churn is our market.
Migration target
Migrations to Red Hat Enterprise Linux are free
No per-migration fee, at any scale, when the target is RHEL — the modern, supported landing OS for regulated estates. The easiest path off the dying platform is also the cheapest.
Terms and conditions apply — contact sales.
live
See it migrate a real CentOS 7 host
The demo runs the actual engine against a real rpm database, translates over the live API, and shows you the role and the signed parity report.
demo.vrtmv.com
Audit-grade Linux migration with parity attestation.
vrtmv.com · demo.vrtmv.com