VPS vs VM vs VPC: what each term means

VPS, VM and VPC in one paragraph

A VM (virtual machine) is a computer made of software: a hypervisor splits one physical server into several independent machines, and each one runs its own kernel. A VPS (virtual private server) is a server rented to you as a product, with an operating system, usually root access, and a monthly price. Most VPS plans are virtual machines, but some hosts sell containers that share the host kernel under the same name. A VPC (virtual private cloud) is not a server at all. It is a private network you define inside a cloud account, and you place resources into it. VM is the usual technology. VPS is the product. VPC is the network around the product.

Two of these words describe a machine. The third describes a network. Almost all of the confusion comes from that mismatch, because people compare them as if they were three products on one shelf.

What a VM is

A hypervisor is the layer that pretends to be hardware. It hands each guest a virtual CPU, a block of memory, a virtual disk and a virtual network card, then keeps the guests from seeing each other. KVM, Xen, Hyper-V and VMware ESXi are the common ones on servers. Modern hypervisors lean on CPU virtualisation extensions (Intel VT-x, AMD-V), so guest instructions run on the real CPU at close to native speed instead of being interpreted.

The part that matters for a sysadmin is the kernel. A VM boots its own kernel, so you choose the distribution, you load kernel modules, and you set sysctl values that apply to nobody but you. That is different from a container (LXC, Docker), which shares the host kernel and only gets its own view of processes and files.

You can see the answer on any Linux box in one command.

systemd-detect-virt

kvm means you are a virtual machine on a KVM hypervisor. lxc or openvz means you are in a container on somebody else's kernel. none means no supported virtualisation was detected. If the command is missing, lscpu | grep -i hypervisor shows hypervisor information, but does not identify containers.

What a VPS is

A VPS is a commercial wrapper around an isolated server, most often a VM. The technology underneath is virtualisation, and the word "VPS" adds the things that make it sellable: an OS image you can reinstall, an IP address, a bandwidth allowance, a control panel, a price per month and somebody to email when the host dies. "Private" is there to separate it from shared hosting, where hundreds of sites share one operating system and one PHP configuration.

Because VPS is a product name and not a technical term, it does not always mean a full VM. Some budget plans sell containers under the same word, and OpenVZ, a container platform behind many of them, describes its containers as "also known as virtual private servers." The difference shows up the first time you need the kernel. On a container based plan the kernel is the host's and you are not allowed to change it. sudo modprobe wireguard fails if it cannot find the module in the container's module directory, even if the host has already loaded it; loading a missing module also requires permission to change the host kernel. If the host kernel has no WireGuard support, creating the interface (ip link add dev wg0 type wireguard) fails with RTNETLINK answers: Operation not supported. wg-quick then falls back to a userspace implementation (wireguard-go by default) if one is installed, printing "Missing WireGuard kernel module. Falling back to slow userspace implementation." That fallback still needs the container to be allowed to use the TUN device, which not every host permits, and without a userspace binary wg-quick stops at the error. On a KVM plan the kernel is yours: you install WireGuard, load the module if it is not already loaded, configure the interface, and the tunnel comes up. If you plan to run Docker, a VPN, custom kernels, or virtual machines of your own inside the server, check the virtualisation type before you buy. Running virtual machines inside a VPS needs KVM with nested virtualisation switched on at the host, which is a smaller set of plans again.

What a VPC is

A VPC is a software defined network inside a cloud provider. On most clouds you give it an address range in CIDR notation, such as 10.0.0.0/16, then carve subnets out of it (Google Cloud skips the network wide range and gives each regional subnet its own range). You attach route tables and put firewall rules (security groups) in front of the resources inside. It has no CPU, no memory and no disk. There is nothing to log into. Deleting every server in a VPC leaves the VPC sitting there, empty and usually free.

What a VPC buys you is private addressing. Two servers in the same VPC talk over addresses like 10.0.1.15 on the provider's internal fabric, so that traffic never touches the public internet and is not billed as internet egress. A database can then listen on its private address only, and no port is exposed to the world at all.

ip -4 addr show

An address inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 is private. A public address alone does not make the server reachable from the internet: routing and firewall rules must allow access too.

Does a VPC make my server private?

No, and this is the most expensive misunderstanding of the three terms. A VPC controls routing and addressing. It does not decide whether the internet can reach a machine. If an instance has a public IP, its subnet routes to the internet, and the security rules allow port 22 from 0.0.0.0/0, it is exposed exactly as much as any other server, VPC or not. On a default VPC that route to the internet is already in place. The isolation you get from a VPC is the ability to give a resource no public address at all, plus rules that say which subnets may talk to which.

The three words also promise different kinds of isolation. A VM isolates compute: the hypervisor separates CPU time and memory, so another guest cannot read your RAM. That isolation is weaker for disk and network, where a busy neighbour on the same host can still slow you down. A container based VPS shares one kernel, so a kernel level bug is a shared risk. A VPC isolates nothing about compute at all. It only shapes the network.

The pricing mental model

A VPS is usually sold as a fixed monthly price for a fixed machine. You know the bill before the month starts, and the disk and the transfer allowance are included in it. That predictability is the main reason people pick a VPS over a cloud instance for a small workload.

A cloud VM is metered. The instance bills per hour or per second, and the disk, the snapshots, the load balancer and the outbound traffic bill separately. The VPC itself is normally free, but the managed pieces attached to it are not: a NAT gateway that lets private instances reach the internet bills by the hour, and how its traffic is charged depends on the provider. AWS adds a charge for every gigabyte the NAT gateway processes, while OVHcloud says its Public Cloud Gateway is charged hourly and per usage, with traffic included. On AWS, traffic that crosses availability zones is billed too, while Azure does not charge for traffic between its zones in the same region. As of October 27, 2026, the AWS VPC guide says you have a default VPC in each region, while the AWS VPC FAQ says accounts created before March 18, 2013 can use default VPCs in enabled regions where they have not previously launched EC2 instances or provisioned ELB, RDS, ElastiCache or Redshift resources. A deleted default VPC can be recreated but not restored. Google Cloud gives every new project a default network unless an administrator turns that off, and Azure creates a virtual network alongside a new VM if you do not pick an existing one. Either way your cloud VM sits inside one of these networks whether or not you asked for it.

Which one do you actually need

• One server for a website, an app, a game server or a VPN: a VPS. The first ten minutes on a new VPS matter more than the label on the plan.
• Several servers that must reach each other on private addresses: a VPC, or the private network feature your VPS provider offers under a different name.
• A workload that must survive a whole datacentre going away: a cloud with multiple zones, which means VMs inside a VPC.
• Full control of the kernel, or your own hypervisor on top: a KVM based VPS (with nested virtualisation enabled if you want the hypervisor) or a dedicated server, and check the disk type behind the plan while you are comparing.

Most single server projects never need a VPC. The private network feature bundled with a VPS covers the same job for a handful of machines.

FAQ

Is a VPS the same thing as a VM?

Usually, but not always. Every VPS built on KVM, Xen or VMware is a virtual machine, but not every virtual machine is a VPS, because the VM running on your laptop under VirtualBox is nobody's product. Not every VPS is a VM either: plans built on OpenVZ or LXC are containers that share the host kernel, and OpenVZ itself calls its containers virtual private servers. Confirm with systemd-detect-virt before you depend on kernel access.

Can I put a VPS inside a VPC?

Not usually, because a VPC is a construct of one cloud provider; AWS also supports sharing its subnets across accounts in the same organization. A VPS from an independent provider lives on that provider's network. If you need private links between the two, you build a VPN tunnel between them instead, and the VPS then reaches the private subnets through it.

Why is my cloud bill higher than an equivalent VPS?

The instance price is only part of it. Storage, snapshots, outbound traffic, load balancers and NAT gateways are separate line items in a metered cloud, and a NAT gateway alone can cost more per month than a small VPS. A fixed price VPS folds the disk and a transfer allowance into one number, which is why the same workload often looks cheaper there.

How do I check whether my server has real kernel access?

Run systemd-detect-virt and read the answer. kvm, xen or vmware (or amazon on newer EC2 instances) mean you have your own kernel and modprobe can load modules into it. lxc, lxc-libvirt or openvz mean you share the host kernel; loading modules requires host kernel privileges, while namespaced settings under /proc/sys, including network settings, remain configurable when the host permits it. A second confirmation is uname -r, which on a container plan often reports a kernel version your distribution never shipped.