On a KVM host, a vCPU is just a thread that the Linux scheduler runs on any free physical core. That flexibility lets providers sell more vCPUs than cores exist, which is called CPU overcommit. CPU pinning does the opposite: it ties a vCPU to specific cores for consistent performance. This guide explains both.
Before you start
- Root on a KVM host with libvirt for the pinning steps.
- On a VPS you can only measure the effect (steal time), not change the host.
How vCPUs map to physical CPUs
Check the host layout with lscpu: sockets, cores per socket, threads per core and NUMA nodes. A host with 2 sockets × 16 cores × 2 threads exposes 64 logical CPUs. Each VM vCPU competes for those 64 threads.
CPU overcommit
Most VMs are idle much of the time, so a host can safely run, for example, 2–4 vCPUs per logical CPU for general web workloads. Problems start when many VMs are busy at once: vCPUs wait in the queue.
Inside a guest this waiting shows as steal time. Run top and look at st, or:
vmstat 1 5Sustained steal above a few percent means the host is contended. See high CPU and RAM usage troubleshooting.
RAM overcommit
RAM is riskier to overcommit than CPU. If guests actually use more memory than the host has, the host swaps or the OOM killer stops a VM. Techniques such as KSM (merging identical pages) and the virtio balloon reclaim some memory, but production hosts usually keep RAM close to 1:1.
Pin vCPUs with virsh
- Choose host cores on the same NUMA node, avoiding core 0 which the host uses for interrupts.
- Pin each vCPU live and persistently:
virsh vcpupin db01 0 4 --live --config
virsh vcpupin db01 1 5 --live --config- Pin the emulator threads away from them:
virsh emulatorpin db01 2-3 --live --config. - Verify with
virsh vcpuinfo db01.
For full isolation, also remove those cores from the host scheduler with the kernel parameter isolcpus or a systemd CPUAffinity setting, and pin memory with <numatune>.
When to pin, when not to
- Pin: databases, real-time audio, game servers, VMs with dedicated-core plans, NFV.
- Do not pin: general-purpose VPS fleets; the scheduler balances better and pinning reduces density.
Frequently asked questions
Does a dedicated vCPU plan mean pinning?
Usually it means the provider does not overcommit those cores, often enforced with pinning, but check the plan details.
Is hyper-threading a full core?
No. Two threads share one core's execution units, so a vCPU on a sibling thread is weaker than a full core.
What overcommit ratio is safe?
It depends on workload. Monitor host load and guest steal time rather than relying on a fixed number.