audit-grade linux migration

Move the workload off the dying platform.
Prove it still matches.

The moment

Two deadlines are colliding

CENTOS EOL

The OS is out of support

CentOS Linux 7 and 8 no longer receive security patches. Regulated fleets are running unsupported production hosts right now.

HYPERVISOR EXIT

vSphere & Nutanix got expensive

Post-acquisition VMware renewal shock — and rising Nutanix costs — are pushing organizations off their hypervisors, many to KVM and cloud, on a compressed timeline.

Both force the same question at once: can you move the workload — and prove the replacement is equivalent?

The gap

Moving is a solved problem. Proving equivalence isn't.

  • Conversion tools copy disks between hypervisors. They say nothing about whether the rebuilt OS still does the same thing.
  • Re-platforming a distro (CentOS → AlmaLinux/RHEL/Ubuntu) is manual, tribal, and error-prone — package names, repos, services, MAC policy all drift.
  • When the auditor asks "what changed, and how do you know it's equivalent?" — there is no artifact to hand them.
The migration is risky precisely because it's undocumented. vrtmv turns the migration into evidence.
What vrtmv does

Any Linux source in. An audit trail out.

image · live · bare‑metalPROBETRANSLATEATTESTVM via Ansible

vrtmv reads any Linux source — a VM image, a live running system, or bare metal — reconstructs what it actually runs, rebuilds it as a virtual machine via Ansible, and signs a parity report proving what changed.

How · 01 probe

It reasons from the bytes, not from a login

  • Read-only at the block layer. The source is never booted, never altered — safe for forensics and audit.
  • Agentless. Nothing is installed on the source. Works on a cold VMDK / qcow2 / raw image, LVM roots included.
  • Reads the real state: the rpm Berkeley-DB / ndb / sqlite or dpkg database, plus on-disk config — including EL7's hard Berkeley-DB path.
probe CentOS Linux 7.9 (x86_64) rpm Berkeley DB mount read-only loop + LVM root activated inv 344 packages ifcfg-bond0 detected
How · 02 translate · the asset

The Translation Index

A curated knowledge base of cross-distribution mappings — packages, services, repositories, accounts, MAC policy — that turns "what this host runs" into "what it must run on the target."

PROVENANCE

Every mapping cites a real, verifiable source. No fabricated rules.

CONFIDENCE

Each row graded high / medium / low / untested — honestly.

CONDITIONAL

Rules evaluate against on-disk state locally — host data never leaves.

How · 03 attest · the wedge

The output is evidence, not a guess

  • An Ansible role that rebuilds the workload as a VM on the target OS.
  • A signed parity attestation: what mapped cleanly, what carried caveats, what couldn't be resolved.
  • Unknowable-from-cold conditions are reported as unknown — never silently assumed true.
  • Reproducible: same image → same attestation.
"packages_translated": 82 "caveats": [{ "canonical": "cpkg:iproute", "note": "bonded host → NetworkManager-team required on target" }] "gaps": { unresolved: 2 } "signature": "ed25519:…"
Capabilities

More than a package translator

PLATFORM EXIT

Off VMware & Nutanix

Reads the disk directly — VMDK / qcow2 / OVA / raw — with no vendor exporter. Pull VMs straight out of VMware or Nutanix AHV.

DATA

Carries the data, too — attested

Finds the data no package owns, then emits an attested byte-copy runbook — a sha256 manifest that proves the copy is byte-identical — and export/import steps for databases. Part of the plan, not a separate project.

PUNCHLIST

Operator decision punchlist

The calls only a human can make, called out — with community field notes queryable from the Index as input, never guidance.

COVERAGE

100+ releases, back to 2000

100+ Linux releases across 16 families — 8,700+ package mappings and 46,000+ translations harvested from the real archives, not guessed. The legacy hosts other tools abandoned still have a path.

Architecture

Your data never leaves your environment

your imageengine (runs in your env)→ package names only →hosted mapping API
  • The client runs entirely inside your network and does all the analysis on your own image — on-prem, air-gapped edge, or a jump host.
  • It asks the hosted API for one thing: what each package maps to on the target. We maintain the mapping intelligence so you don't have to.
  • Only package identifiers cross the line — your configs, inventory and secrets stay home. The API is authenticated and metered.
Roadmap

From source to a running OpenShift VM

image · live · bare‑metalvrtmv + Ansiblevirtual machineOpenShift Virtualization
  • Automated tooling to hand the rebuilt VM straight to Red Hat OpenShift Virtualization — provisioned as an OpenShift VM.
  • The parity attestation travels with it as the deployment record — the same evidence, end to end.
In development — the migration + attestation pipeline ships first; OpenShift deployment is the next axis.
Why it holds up

Built to survive an audit

HONEST GAPS

Unresolved packages and untranslated canonicals are listed, not hidden. Absence is reported as absence.

UNKNOWN ≠ FALSE

A condition that can't be known from a cold image is flagged unknown — the audit-defensible default.

SIGNED + REPRODUCIBLE

The report is signed and deterministic. The same disk yields the same evidence, every time.

Market · TAM

A ~$16B market — that Broadcom is shrinking by price

~$16B
/yr — Broadcom's VMware revenue run-rate (FY24)
~30M
VMs on VMware — revenue ÷ ~$500/VM/yr blended
$599–999
per instance — $200–400 migrate + $399–599/yr recurring ARR (lower per-instance as pack size grows) — our wedge into the churn
$16B ÷ ~$500/VM~30M VMs→ ~20% exit →~6M VMs migrating~$600M migration TAM
The price hikes that grow Broadcom's revenue are the same hikes that push VMs off the platform — the churn is our market.
Migration target

Migrations to Red Hat Enterprise Linux are free

No per-migration fee, at any scale, when the target is RHEL — the modern, supported landing OS for regulated estates. The easiest path off the dying platform is also the cheapest.

Terms and conditions apply — contact sales.

live

See it migrate a real CentOS 7 host

The demo runs the actual engine against a real rpm database, translates over the live API, and shows you the role and the signed parity report.

demo.vrtmv.com

Audit-grade Linux migration with parity attestation.

vrtmv.com  ·  demo.vrtmv.com

vrtmv_