VirtualBox runs alongside Hyper-V on the same laptop using VirtualBox 7's Hyper-V backend. All 37 VMs sit on 2TB of NVMe and a 9.3TB external drive for the larger images.
I group them by what they're actually for.
Kali Linux — 8GB RAM, 2 CPUs. The standard penetration testing distro. Full tool suite pre-installed. I keep a clean snapshot and reset to it after each lab session.
Parrot Security — 8GB RAM, 4 CPUs. A Kali alternative with a lighter desktop and a reputation for being more stable in day-to-day use. I run both because some tools behave differently between the two.
Parrot Home — 4GB RAM, 4 CPUs. The desktop variant without the full pen-test suite. Useful as a general-purpose Linux environment with good privacy defaults.
BlackArch — 4GB RAM, 2 CPUs. Arch-based security distro with a larger tool repository than Kali. Slower to set up, more targeted tools available.
Tails — 4GB RAM, 2 CPUs. Amnesic OS built for privacy. Boots from RAM, leaves nothing on disk. I test Tails in a VM for workflow validation before recommending it to people who actually need it.
Whonix Gateway + Whonix Workstation + Whonix — the full Whonix setup. The Gateway VM routes all traffic through Tor. The Workstation connects to the internet only through the Gateway. A clean two-VM architecture for anonymised research.
pfSense — 1GB RAM, 2 CPUs. The firewall I wrote about comparing to OPNsense. Running it as a VM lets me test rule changes without risking the production network.
OPNsense — 256MB RAM, 1 CPU. My recommended firewall for new builds. Minimal RAM allocation because I'm testing config, not pushing real traffic through it.
RouterOS — 4GB RAM, 4 CPUs. MikroTik's OS for testing CHR (Cloud Hosted Router) configurations. RouterOS logic differs enough from other firewall platforms that hands-on testing saves time later.
OpenWrt — 256MB RAM, 1 CPU. Embedded router OS. I test package installations and custom configs here before flashing real hardware.
Kemp LoadMaster VLM — 2GB RAM, 2 CPUs. Kemp's virtual load balancer. Pairs with my IIS cluster in Hyper-V for end-to-end load balancing lab work.
TrueNAS — 2GB RAM, 2 CPUs. ZFS storage testing. I validate pool configurations and scrub behaviour here before making changes on real NAS hardware.
OpenMediaVault — 2GB RAM, 2 CPUs. Debian-based NAS OS. A simpler alternative to TrueNAS for smaller deployments.
Home Assistant — 4GB RAM, 1 CPU. Home automation testing environment.
Wazuh and Wazuh v4.8.2 OVA — 8GB RAM, 4 CPUs each. Two Wazuh SIEM instances. One tracks the current stable release, the other is the official OVA for comparison. Covered in the cybersecurity homelab guide.
Raspberry Pi OS Pi 5 — 8GB RAM, 2 CPUs. Testing Pi 5 software configurations before deploying to physical hardware.
StartOS — 4GB RAM, 2 CPUs. A privacy-focused self-hosting OS. I keep this for evaluating its app ecosystem.
The collection grew organically. Some I evaluated for specific use cases, others I installed to answer questions clients or colleagues asked.
| VM | RAM | Use |
|---|---|---|
| Ubuntu | 8GB | General baseline |
| Kubuntu | 4GB | KDE desktop evaluation |
| Xubuntu | 4GB | Lightweight XFCE builds |
| Ubuntu-MATE | 4GB | MATE desktop |
| ZorinOS | 6GB | Windows-to-Linux migration demos |
| ElementaryOS | 8GB | macOS-style UX evaluation |
| POP OS | 4GB | NVIDIA driver handling |
| Wubuntu | 4GB | Windows 11 visual style |
| Raspbian | 4GB | Pi software testing |
| Slax | 4GB | Minimal live system |
| PuppyLinux BionicPup | 2GB | Ultra-lightweight builds |
MacOS and MacOS Catalina 10.15.5 — 9GB and 8GB RAM respectively. Running macOS in VirtualBox requires specific patches. I keep these for testing software that only runs on macOS, and for demystifying Apple hardware to Windows-only colleagues.
Android — 8GB RAM, 4 CPUs. x86 Android image for mobile app testing without a physical device.
ReactOS — 4GB RAM, 2 CPUs. An open-source Windows-compatible OS. Interesting for understanding the NT architecture and testing legacy Windows software compatibility.
AtlasOS — 8GB RAM, 4 CPUs. A debloated Windows 7 build designed for performance. Useful for testing legacy software that refuses to run on anything newer.
Tiny11 — 4GB RAM, 2 CPUs. A stripped-down Windows 11 image that runs in about 2GB RAM. Worth knowing about for low-spec deployments.
A USB drive fast enough to run VMs from makes rotating through these images much easier when the NVMe is full.
As an Amazon Associate, IT Lad earns from qualifying purchases made through links on this page. Read the full affiliate disclosure.