Will it run on a VPS? Check before you buy

Will it run on a VPS? Check seven lines on the spec sheet

Whether the thing you want to run will run on a VPS is decided before you pay, by about seven lines on the plan's spec sheet. Most software is fine on any plan. The ones that fail need something specific from the host: a kernel you are allowed to touch, a device node the provider created for you, a CPU flag the hypervisor passes through, or an outbound port that nobody drops.

Japanese domestic providers publish unusually detailed spec sheets, so most of these answers are already written down somewhere on the page. The work is knowing which line answers which question, and what to ask support when no line answers it at all. These are the compatibility checks that genuinely differ between offers.

• Virtualisation type. A KVM plan behaves like a machine. A container plan shares the host kernel and will refuse some workloads.
• Kernel modules and /dev/net/tun. WireGuard and OpenVPN need them.
• Nested virtualisation. Any VM you want to run inside your VPS needs /dev/kvm.
• CPU flags. AES-NI and AVX reach most guests and are masked on some.
• IPv6. Whether you get a routable address at all, and how large a prefix.
• GPU. Standard plans have none, and the sheet answers by omission.
• Outbound port 25. Blocked by default across much of the Japanese market.

Run every check below on the box itself, during a trial period or inside the refund window. A spec sheet describes what the provider intends to sell. The commands describe the machine you were actually given.

What the virtualisation line tells you

Look for 仮想化方式 or 仮想化技術 (virtualisation method). The value is either KVM, sometimes written 完全仮想化 (full virtualisation), or a container technology such as OpenVZ or LXC, written コンテナ型 (container type). Xen appears on older plans and behaves like KVM for everything in this guide.

On a KVM plan you get your own kernel. You can load modules, set sysctls, install a different kernel, and reboot into it. On a container plan the kernel belongs to the host and is shared with every other customer on that machine. You cannot change it, and you cannot load a module into it, because a module runs with full kernel privileges and would cross the container boundary. This single difference causes most of the "it worked on my other VPS" reports you will read in forums.

systemd-detect-virt
uname -r
free -m

kvm or qemu means full virtualisation. lxc, lxc-libvirt or openvz means a container. none on something sold as a VPS means either real hardware or a hypervisor that hides itself, so confirm with virt-what from the virt-what package. Two further signs of a container: uname -r reports a kernel version that does not match the distribution you selected, and free -m reports much more memory than you paid for, because the container is reading the host's /proc/meminfo.

The gap between the two models is wider than the gap in price, so what KVM, Xen and LXC each hand you is worth reading before you compare plans on cost alone. Docker is the common casualty. It runs on any KVM plan, and inside a container plan it works only if the provider enabled nesting for your container, so ask first rather than assuming that a Docker host on a VPS is possible there.

Can you load kernel modules and open /dev/net/tun?

This is the VPN question, and it has two halves. WireGuard needs its kernel module, which has been mainline since Linux 5.6. As of August 2026, Ubuntu 24.04 and Debian 13 both ship it with no extra package. OpenVPN and the wireguard-go userspace fallback both need the character device /dev/net/tun, which a provider has to expose to a container deliberately.

ls -l /dev/net/tun
sudo modprobe wireguard && echo ok
lsmod | grep -E 'tun|wireguard'

A healthy KVM box prints a device line like crw-rw-rw- 1 root root 10, 200 /dev/net/tun, then ok.

ls: cannot access '/dev/net/tun': No such file or directory means the device node does not exist for you. OpenVPN then stops with Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2). wg-quick up wg0 stops with RTNETLINK answers: Operation not supported, because the shared kernel offers your container no WireGuard interface type to create. modprobe: ERROR: could not insert 'wireguard': Operation not permitted is the same refusal from the other direction: the load is denied because you are not in the host's kernel namespace.

Many container plans can enable TUN/TAP per customer, so this is the most useful pre-sales question if you are buying the box for a VPN. One warning about wording. A sheet line reading VPN利用可 (VPN use permitted) is a terms-of-service statement, not a capability statement. Ask for both answers in the same message.

Is nested virtualisation available?

Nested virtualisation means running a hypervisor inside your VPS, which you need for a lab of VMs, or for any tool that starts its own microVM. It requires the host to pass the CPU virtualisation flag into your guest and to run its own kvm_intel or kvm_amd module with nested=Y. That switch lives on the hypervisor, so you cannot turn it on from inside the VPS.

sudo apt install -y cpu-checker
grep -owE 'vmx|svm' /proc/cpuinfo | sort -u
kvm-ok

vmx (Intel) or svm (AMD) in /proc/cpuinfo means the flag reached you. kvm-ok then prints INFO: /dev/kvm exists followed by KVM acceleration can be used. When the flag never arrived you get INFO: Your CPU does not support KVM extensions and KVM acceleration can NOT be used. QEMU still starts in that state, in software emulation, where every guest instruction is translated and the result is slow enough to change what the box is good for. Started with -enable-kvm it refuses outright: Could not access KVM kernel module: No such file or directory.

Most shared plans leave nesting off, because it costs performance and complicates live migration, so treat it as a feature you must confirm rather than one you expect. Nested virtualisation on a VPS covers what the extra layer costs once it is switched on.

Which CPU flags does the host pass through?

The hypervisor decides which CPU features your guest is told about. Many providers present a generic CPU model so a running VM can migrate to a host with a different processor, and a generic model advertises the lowest common set of flags. The physical chip may have AES-NI and AVX-512 while your guest is told it has neither.

uname -m
lscpu | grep -i 'model name'
lscpu | grep -owE 'aes|avx|avx2|avx512f' | sort -u

Model name: QEMU Virtual CPU version 2.5+ or Common KVM processor is the generic case. A real model string such as Intel Xeon Processor (Skylake, IBRS) or AMD EPYC-Rome Processor means more of the host's feature set is reaching you.

Two flags decide real workloads. AES-NI performs AES in hardware, so it sets your TLS (transport layer security) and disk encryption throughput. You can measure the difference on one box, because OpenSSL lets you mask the flag by hand:

openssl speed -elapsed -evp aes-128-gcm
OPENSSL_ia32cap=~0x200000200000000 openssl speed -elapsed -evp aes-128-gcm

The second run is the software path. Two runs that print similar numbers mean your guest never had AES-NI to begin with. What AES-NI is worth on a VPS puts numbers on the gap between those two paths.

AVX is the harder failure, because the software that needs it does not warn you first. MongoDB 5.0 and later require AVX, and on a host that masks it the server dies immediately with Illegal instruction (core dumped) and nothing useful in its own log. Any binary compiled with -march=native on a newer machine fails in exactly the same way.

uname -m answers a question buyers forget to ask. x86_64 is the usual answer, and aarch64 means an Arm plan, where every binary and container image you plan to run must exist for arm64. Arm and x86 VPS plans is the deciding read if the price difference tempts you.

Does the plan actually give you IPv6?

The line reads IPv6対応 (IPv6 supported) or IPv6アドレス. The word 対応 tells you the network carries IPv6. It does not tell you how much address space lands on your box, and that is the part that decides what you can build.

ip -6 addr show scope global
ip -6 route show default
ping -6 -c 3 ipv6.google.com

An interface whose only IPv6 address starts with fe80: has a link-local address and no routable IPv6, so ping -6 to a public host will fail with Network is unreachable. One global address is enough to publish an AAAA record for a website. It is not enough for containers, or for a VPN that hands an address to each peer, both of which want a /64. Some providers issue the prefix only on request, so ask for the prefix length rather than for IPv6.

An IPv6-only plan is cheaper in several markets. It also cannot reach IPv4-only services without NAT64 (network address translation between the two protocols) and DNS64 from the provider, and plenty of package mirrors and payment APIs are still IPv4-only. Confirm that translation exists before you buy on price.

Is outbound port 25 blocked?

In Japan, assume yes. OP25B (outbound port 25 blocking) has been standard practice among Japanese network operators since the mid 2000s, adopted to stop spam leaving compromised machines, and the practice carried into domestic hosting. On many plans outbound TCP 25 is dropped at the network edge. Some providers lift it after an identity check. Others never lift it.

sudo apt install -y netcat-openbsd
timeout 8 nc -vz smtp.gmail.com 25
timeout 8 nc -vz smtp.gmail.com 587

An open path prints Connection to smtp.gmail.com ... 25 port [tcp/smtp] succeeded!. A block usually prints nothing at all until timeout kills the command, because the packets are dropped silently instead of refused. Port 587 succeeding while port 25 hangs is the signature of OP25B: you can still hand mail to a relay that accepts submission on 587, and you cannot deliver directly to other mail servers.

Delivery needs one more thing that only the provider controls. A receiving server checks the reverse DNS (逆引き, the PTR record) of your IP address, and only the address holder can set it. If the provider will not set a PTR record for you, direct delivery stays unreliable even on an unblocked port. Budget for a relay service, and treat an open port 25 as a bonus rather than as your plan.

Is there a GPU on this plan?

If the spec sheet has no GPU line, the plan has no GPU. Providers selling GPU capacity say so in the plan name and in the price. What a normal plan gives you is a virtual display adapter, which exists so the web console can draw a screen, and it computes nothing.

sudo apt install -y pciutils
lspci | grep -iE 'vga|3d|display'
ls /dev/nvidia* 2>/dev/null || echo none
nvidia-smi

Cirrus Logic GD 5446, a QXL paravirtual graphic card or a Bochs display are console adapters with no CUDA support. nvidia-smi prints command not found when no driver is installed, and NVIDIA-SMI has failed because it couldn't communicate with the NVIDIA driver when a driver is installed with no device passed through to you.

This matters to two kinds of buyer. If you want to run a language model, the practical route on an ordinary VPS is to keep the box small and call a hosted model over the network, which is how an agent that runs on a VPS and calls a model API works, and it needs bandwidth rather than silicon. If you want to play or stream games, the honest answer is in what a VPS can and cannot do for gaming.

Custom ISO uploads and the OS list

Domestic Japanese providers usually publish a long OS list (提供OS or OSテンプレート) and often do not allow you to upload your own image (ISOイメージのアップロード). Read those two lines together, because together they decide what you can install at all. If the release you need is missing from the list and ISO upload is not offered, the plan cannot run it, whatever else the sheet promises.

• The exact release, not the distribution name. A sheet that says Ubuntu with no version number may be two releases behind.
• A console, VNC or serial. This is what saves you after a firewall rule locks out SSH.
• A rescue mode for a box that will not boot.
• Whether replacing the kernel or the bootloader ends your support entitlement.

On a container plan the OS list is a userspace template only. Choosing Ubuntu 24.04 there gives you Ubuntu's userland on the host's kernel, so uname -r will not match your choice and any instruction beginning "load this kernel module" fails. System containers you run yourself behave the same way, which makes them a cheap way to feel the limits before you buy a container plan. Reading a cheap VPS offer covers the rest of that page, including the lines written to be skimmed past.

What the sheet does not say, and how to ask

Some limits never appear on the page. How many customers share your physical cores is the largest one, and you only see it after you buy, as steal time from a noisy neighbour in the st column of top. Disk behaviour is another: capacity plus the letters NVMe still tells you nothing about the IOPS ceiling applied per plan. Bandwidth often reads 無制限 (unlimited) with a fair use clause underneath, and the clause holds the real number. Who administers the box is a separate question from what the box can run, and managed and unmanaged plans answers that one.

When a line is missing, ask before you pay, and keep the reply. A sales page changes without notice. A support ticket is dated evidence you can point at later. Send one message with one question per line.

• 仮想化方式は KVM ですか。(Is the virtualisation type KVM?)
• カーネルモジュールの読み込みと /dev/net/tun の利用は可能ですか。(Can I load kernel modules and use /dev/net/tun?)
• ネスト仮想化は有効ですか。(Is nested virtualisation enabled?)
• CPU は host-passthrough ですか、汎用モデルですか。(Is the CPU model passed through, or generic?)
• IPv6 アドレスのプレフィックス長を教えてください。(What IPv6 prefix length is issued?)
• 25番ポートの送信制限はありますか。解除は可能ですか。(Is outbound port 25 restricted, and can the restriction be lifted?)
• 独自の ISO イメージをアップロードできますか。(Can I upload my own ISO image?)

The ten minute check on a new box

Run this in your first session on a new VPS, before you install anything else. It answers every question above in one screen, and it costs nothing to run again on the next provider you try.

sudo apt update && sudo apt install -y virt-what cpu-checker pciutils netcat-openbsd
echo virt: $(systemd-detect-virt)
echo kernel: $(uname -r) $(uname -m)
echo tun: $(test -c /dev/net/tun && echo present || echo missing)
echo kvm: $(test -c /dev/kvm && echo present || echo missing)
echo flags: $(lscpu | grep -owE 'aes|avx|avx2|avx512f' | sort -u | xargs)
echo ipv6: $(ip -6 addr show scope global | grep -c inet6) global addresses
echo display: $(lspci | grep -icE 'vga|3d|display') devices
timeout 8 nc -vz smtp.gmail.com 25 || echo port25: blocked or filtered

Save that output. If the box turns out to be wrong for the workload, the saved text is what you attach to the refund request, and it carries more weight than a description of what you expected to get.

FAQ

How do I tell if a VPS is KVM or a container?

Run systemd-detect-virt on the box. kvm or qemu means full virtualisation with your own kernel. lxc, lxc-libvirt or openvz means a container sharing the host's kernel. Confirm with virt-what, then cross-check two things: uname -r against the kernel your distribution actually ships, and free -m against the memory you paid for. A container without lxcfs reports the host's kernel version and the host's memory, which is the clearest sign of all.

Why does WireGuard fail with "Operation not supported" on my VPS?

wg-quick up wg0 printing RTNETLINK answers: Operation not supported means the kernel you are talking to will not create a WireGuard interface for you. On a container plan this is expected, because the kernel belongs to the host and module loading is refused. Check ls -l /dev/net/tun next: without that device node, even the wireguard-go userspace implementation cannot run. Many providers will enable TUN/TAP for a container on request. On a KVM plan the module is mainline since Linux 5.6, so the same message there points at a much older kernel instead.

Can I send email from a Japanese VPS?

Often not directly. OP25B (outbound port 25 blocking) is common across Japanese networks and hosting, so outbound TCP 25 is dropped and the connection hangs rather than failing fast. Test with timeout 8 nc -vz smtp.gmail.com 25 and compare the result against port 587. Ask the provider two things: whether the port 25 restriction can be lifted, and whether they will set a reverse DNS (PTR) record for your address. Without a PTR record, direct delivery stays unreliable even where port 25 is open, so a relay on port 587 is the practical route.

Does a VPS come with a GPU?

Standard plans do not. lspci on a normal VPS shows a virtual display adapter such as a QXL or Bochs device, which exists for the web console and cannot run CUDA. nvidia-smi is either missing entirely or reports that it could not communicate with the NVIDIA driver. GPU capacity is sold as a separate product line with its own pricing, so a spec sheet that names no GPU model is telling you there is no GPU.

Which CPU flags should I check before buying?

Check aes and avx with lscpu | grep -owE 'aes|avx|avx2|avx512f'. Missing AES-NI slows every TLS handshake and every encrypted disk write, because OpenSSL falls back to a software implementation. Missing AVX stops some software from starting at all: MongoDB 5.0 and later exit with Illegal instruction (core dumped) on a host that masks it. A generic model name such as Common KVM processor in lscpu is the warning sign, since a generic model advertises only the flags every host in the fleet shares.