VPS vs VM vs VPC: what each term means

VPS, VM and VPC in one paragraph

A VM (virtual machine) is a computer made of software: a hypervisor splits one physical server into several independent machines, and each one runs its own kernel. A VPS (virtual private server) is one of those virtual machines rented to you as a product, with an operating system, root access and a monthly price. A VPC (virtual private cloud) is not a server at all. It is a private network you define inside a cloud account, and you place resources into it. VM is the technology. VPS is the product. VPC is the network around the product.

Two of these words describe a machine. The third describes a network. Almost all of the confusion comes from that mismatch, because people compare them as if they were three products on one shelf.

What a VM is

A hypervisor is the layer that pretends to be hardware. It hands each guest a virtual CPU, a block of memory, a virtual disk and a virtual network card, then keeps the guests from seeing each other. KVM, Xen, Hyper-V and VMware ESXi are the common ones on servers. Modern hypervisors lean on CPU virtualisation extensions (Intel VT-x, AMD-V), so guest instructions run on the real CPU at close to native speed instead of being interpreted.

The part that matters for a sysadmin is the kernel. A VM boots its own kernel, so you choose the distribution, you load kernel modules, and you set sysctl values that apply to nobody but you. That is different from a container (LXC, Docker), which shares the host kernel and only gets its own view of processes and files.

You can see the answer on any Linux box in one command.

systemd-detect-virt

kvm means you are a virtual machine on a KVM hypervisor. lxc or openvz means you are in a container on somebody else's kernel. none means the metal is yours. If the command is missing, lscpu | grep -i hypervisor shows the same thing from CPU flags.

What a VPS is

A VPS is a commercial wrapper around a VM. The technology underneath is virtualisation, and the word "VPS" adds the things that make it sellable: an OS image you can reinstall, an IP address, a bandwidth allowance, a control panel, a price per month and somebody to email when the host dies. "Private" is there to separate it from shared hosting, where hundreds of sites share one operating system and one PHP configuration.

Because VPS is a product name and not a technical term, it does not always mean a full VM. Some budget plans sell containers under the same word. The difference shows up the first time you need the kernel. On a container based plan, sudo modprobe wireguard fails with RTNETLINK answers: Operation not supported or modprobe: FATAL: Module wireguard not found, because the kernel is the host's and you are not allowed to change it. On a KVM plan the module loads and the tunnel comes up. If you plan to run Docker, a VPN, custom kernels, or virtual machines of your own inside the server, check the virtualisation type before you buy. Running virtual machines inside a VPS needs KVM with nested virtualisation switched on at the host, which is a smaller set of plans again.

What a VPC is

A VPC is a software defined network inside a cloud provider. You give it an address range in CIDR notation, such as 10.0.0.0/16, then carve subnets out of it, attach route tables, and put firewall rules (security groups) in front of the resources inside. It has no CPU, no memory and no disk. There is nothing to log into. Deleting every server in a VPC leaves the VPC sitting there, empty and usually free.

What a VPC buys you is private addressing. Two servers in the same VPC talk over addresses like 10.0.1.15 on the provider's internal fabric, so that traffic never touches the public internet and is not billed as internet egress. A database can then listen on its private address only, and no port is exposed to the world at all.

ip -4 addr show

An address inside 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 is private. A public address on the same box means the server is directly reachable from the internet, whatever network object it sits in.

Does a VPC make my server private?

No, and this is the most expensive misunderstanding of the three terms. A VPC controls routing and addressing. It does not decide whether the internet can reach a machine. If an instance has a public IP and the security rules allow port 22 from 0.0.0.0/0, it is exposed exactly as much as any other server, VPC or not. The isolation you get from a VPC is the ability to give a resource no public address at all, plus rules that say which subnets may talk to which.

The three words also promise different kinds of isolation. A VM isolates compute: the hypervisor separates CPU time and memory, so another guest cannot read your RAM. That isolation is weaker for disk and network, where a busy neighbour on the same host can still slow you down. A container based VPS shares one kernel, so a kernel level bug is a shared risk. A VPC isolates nothing about compute at all. It only shapes the network.

The pricing mental model

A VPS is usually sold as a fixed monthly price for a fixed machine. You know the bill before the month starts, and the disk and the transfer allowance are included in it. That predictability is the main reason people pick a VPS over a cloud instance for a small workload.

A cloud VM is metered. The instance bills per hour or per second, and the disk, the snapshots, the load balancer and the outbound traffic bill separately. The VPC itself is normally free, but the managed pieces attached to it are not: a NAT gateway that lets private instances reach the internet is billed per hour and per gigabyte, and traffic between availability zones is billed too. As of July 2026, the major clouds still place every new instance into a default VPC automatically, so you are using one whether or not you asked for it.

Which one do you actually need

• One server for a website, an app, a game server or a VPN: a VPS. The first ten minutes on a new VPS matter more than the label on the plan.
• Several servers that must reach each other on private addresses: a VPC, or the private network feature your VPS provider offers under a different name.
• A workload that must survive a whole datacentre going away: a cloud with multiple zones, which means VMs inside a VPC.
• Full control of the kernel, or your own hypervisor on top: a KVM based VPS or a dedicated server, and check the disk type behind the plan while you are comparing.

Most single server projects never need a VPC. The private network feature bundled with a VPS covers the same job for a handful of machines.

FAQ

Is a VPS the same thing as a VM?

A VPS is a VM that somebody sells you. Every VPS built on KVM, Xen or VMware is a virtual machine, but not every virtual machine is a VPS, because the VM running on your laptop under VirtualBox is nobody's product. Some cheap plans labelled VPS are containers rather than full VMs, so confirm with systemd-detect-virt before you depend on kernel access.

Can I put a VPS inside a VPC?

Not usually, because a VPC is a construct of one cloud provider and it only holds resources created in that same account. A VPS from an independent provider lives on that provider's network. If you need private links between the two, you build a VPN tunnel between them instead, and the VPS then reaches the private subnets through it.

Why is my cloud bill higher than an equivalent VPS?

The instance price is only part of it. Storage, snapshots, outbound traffic, load balancers and NAT gateways are separate line items in a metered cloud, and a NAT gateway alone can cost more per month than a small VPS. A fixed price VPS folds the disk and a transfer allowance into one number, which is why the same workload often looks cheaper there.

How do I check whether my server has real kernel access?

Run systemd-detect-virt and read the answer. kvm, xen or vmware mean you have your own kernel and modprobe works. lxc, lxc-libvirt or openvz mean you share the host kernel, and commands that load modules or write to /proc/sys will fail with Operation not supported. A second confirmation is uname -r, which on a container plan often reports a kernel version your distribution never shipped.