Which self-hosted virtualization platform fits your team
If your team is leaving VMware and wants a self-hosted platform you run yourselves, Proxmox VE fits most small and mid-sized estates that want one product for KVM virtual machines, LXC containers and software-defined storage. XCP-ng fits teams that already run Xen or XenServer, or that want a type-1 hypervisor managed through Xen Orchestra with a commercial support option from Vates. OpenStack fits organizations that need a private cloud with APIs, multi-tenant projects and integration with Ceph, and that have the staff to operate it. The right choice depends less on feature lists than on how many hosts you run, who will patch them and how much of the operating model you want to own.
Licensing differs more than the marketing suggests. *Proxmox VE* code is licensed under AGPL-3.0, and its subscriptions are priced per CPU socket and differ only in support level and access to the enterprise repository. The xcp repository behind XCP-ng is GPL-2.0, and Vates sells support and add-ons such as XOSTOR. OpenStack projects must be Apache-2.0, so the core code is permissive, but a production cloud still depends on your deployment tooling, your storage backend and your own operating time. Ask each vendor which repositories, packages and add-ons your production configuration actually uses, and confirm the license of each before you assume the whole stack is open source.
The team question decides most of these cases. Proxmox VE needs a three-node cluster, shared storage and watchdog-based fencing before high availability works reliably, so confirm that your hardware and network can meet those conditions. XCP-ng suits a smaller operations team that wants a single hypervisor and Xen Orchestra for management, and V2V warm migration from ESXi is worth testing against your own hosts, since ESXi 6.x is not supported for V2V. OpenStack, deployed with Kolla-Ansible or OpenStack-Ansible, rewards a platform team with cloud experience and a plan for six-monthly release upgrades. Before you commit, run a pilot against your real storage and identity sources, and get a written scope for migration, hardening and support.
Which virtualization platform suits each scenario
This table maps common situations to the platform that fits best, with the condition under which the alternative is the better choice. Read each row as a starting position, then check the licensing, support and operating effort against your own environment before deciding.
| Scenario | Best fit and reason | Choose the alternative when |
|---|---|---|
| Small cluster leaving VMware, with an in-house Linux team | Proxmox VE. It runs KVM and LXC on one platform, the core features are the same in every subscription tier, and the software can be used without a subscription, which keeps the entry cost of a test or non-production cluster low. | Your production workloads need vendor-backed support tickets and response times from day one, since a paid subscription is then needed per CPU socket. Check the support tier against your change windows. |
| Team that wants commercial support priced per host | XCP-ng with Xen Orchestra and a Vates support subscription. Vates sells support per host or per plan, and the hypervisor and Xen Orchestra are described as open source with no license fees. | Your procurement expects per-socket subscriptions like Proxmox VE, or you need an open-source platform with a broader community ecosystem. Confirm the Vates plan that matches your host count and SLA needs in writing. |
| Multi-tenant private cloud with self-service APIs | OpenStack. It controls compute, storage and networking through common APIs with shared authentication, and Keystone supports federation with SAML 2.0 and OpenID Connect for tenant identity. | You have a small estate, no cloud team and no need for tenant APIs. OpenStack's modular design adds operating effort that a single-cluster hypervisor avoids. Plan for a dedicated team and a deployment method such as Kolla-Ansible or OpenStack-Ansible. |
| Team already running Ceph for storage | Proxmox VE or OpenStack, both of which can use Ceph. Proxmox VE lists Ceph RBD and CephFS as network storage, and OpenStack can back Glance, Cinder and Nova disks with Ceph block devices, so the existing cluster is reused. | Ceph adds its own operating load, so if you do not already run it, a simpler shared storage design may suit a small cluster better. Confirm the Ceph release lifecycle against your upgrade plan before choosing. |
| Existing VMware estate that must move in waves | XCP-ng with Xen Orchestra, because its V2V tool performs warm migration from the ESXi API, replicating while the source VM runs and syncing changed blocks at shutdown. | Your ESXi hosts are version 6.x, which current Xen Orchestra releases do not support for V2V, or your source platform is outside the documented import paths. Test the migration on a copy before committing. |
| Team that needs a single platform for virtual machines and containers | Proxmox VE, which integrates KVM virtual machines with LXC containers and software-defined storage in one management layer. | Your container workload is Kubernetes-based and needs its own control plane and GitOps practices. Run Kubernetes on the hypervisor you choose and keep the two lifecycles separate. |
| Team that must demonstrate high availability | Proxmox VE with at least three cluster nodes, shared storage and watchdog-based fencing, as its High Availability guidance describes. Each node also needs redundant hardware for quorum to hold. | You cannot provide three nodes, shared storage or fencing hardware. In that case, a single-host design with tested backups may be the honest choice. Confirm the fencing and quorum design with the vendor before relying on it. |
Proxmox VE, XCP-ng and OpenStack in brief
Proxmox VE, XCP-ng and OpenStack solve different problems, so the cards below start with what each one is and who it is built for. Read them together to decide which platform matches your team's operating model, licensing constraints and scale before comparing the details that follow.
Proxmox VE, a single platform
Proxmox VE is an open-source server management platform from Proxmox Server Solutions that integrates the KVM hypervisor and Linux Containers (LXC) with software-defined storage and networking on one platform. It is licensed under the GNU Affero General Public License, version 3. Its architecture is multi-master, so every node in a cluster can perform management tasks, and the Proxmox Cluster File System replicates configuration to all nodes. Check whether your team wants one management layer for VMs, containers and storage, and whether you will run the enterprise or no-subscription repository in production.
XCP-ng, a Xen-based hypervisor
XCP-ng is a Xen-based virtualization platform that began as an open source version of Citrix XenServer. It is a type-1 hypervisor that boots on bare metal and combines the Xen hypervisor, the dom0 control domain, the XAPI toolstack and QEMU for guest I/O. It is managed through Xen Orchestra and backed by Vates, which sells commercial support subscriptions. Its xcp repository is licensed GPL-2.0. Check whether your team is comfortable with the Xen and XAPI stack, and whether you need a vendor-backed SLA from Vates.
OpenStack, a cloud operating system
OpenStack is a cloud operating system that controls pools of compute, storage and networking through APIs with common authentication. It is built as a modular set of projects and services, and official projects must be licensed under the Apache License, Version 2.0. The OpenInfra Foundation hosts the project as part of the Linux Foundation. Its six-month release cadence and deployment tooling, including Kolla-Ansible and OpenStack-Ansible, mean the platform is best judged as a private cloud program rather than a hypervisor swap. Confirm the operating effort your team can sustain before committing.
Proxmox VE's governance and support model
Proxmox VE subscriptions are priced per CPU socket and include the Enterprise Repository, with tiers that differ only in support level. The software itself can be used without a subscription. Because the license is AGPL-3.0 and support is sold separately, your cost model recurs through support rather than through software licensing. Ask Proxmox for the support tier that matches your ticket volume and response expectations, and confirm whether your audit evidence needs the enterprise repository.
XCP-ng's commercial support layer
XCP-ng and Xen Orchestra are open-source projects with no license fees, according to Vates. Commercial support subscriptions add SLAs, and Vates also sells add-ons such as XOSTOR hyperconverged storage. This split means the open-source platform and the vendor support are separate purchases. Ask Vates which support plan includes the SLA terms your change process requires, and whether add-ons like XOSTOR are needed for your storage design.
OpenStack's identity federation
Keystone, the OpenStack identity service, supports federation over the SAML 2.0 and OpenID Connect protocols and can also federate one Keystone to another. Mapping rules match federated users from a trusted identity provider to OpenStack groups, roles and projects. Identity design is therefore a day-one decision in OpenStack, not a later add-on. Plan who maps to which project before you deploy, and confirm your identity provider meets the federation protocols you need.
What Proxmox VE, XCP-ng and OpenStack cost to license and support
Proxmox VE is licensed under the GNU Affero General Public License version 3, and the software can be used without a subscription. The paid item is a yearly subscription priced per CPU socket, and it is the same software at every tier. The tiers differ in support entitlements and access to the enterprise repository, which the Proxmox documentation recommends for production. According to the Proxmox VE pricing page, the yearly prices per socket are 120 euros for Community (no support tickets), 370 euros for Basic (3 tickets, 1 business day response), 550 euros for Standard (10 tickets, 4-hour response) and 1,100 euros for Premium (unlimited tickets, 2-hour response).
- Recurring per socket: Each subscription renews yearly, so a cluster with more sockets costs more every year, and the cost scales with hardware, not with guest count.
- Software features are identical: Choosing a tier buys response time and ticket volume, not extra functions, so the decision turns on how fast you need help.
- Free path exists: The no-subscription repository is described for testing and non-production use, so a production cluster without a subscription runs on a repository the vendor does not position for production.
- Support is separate from your staff: Subscription tickets cover the product, while your team or a partner still handles hardware, networking and day-to-day operations.
- One-time items: Migration, storage design and high availability testing are project work quoted separately, not part of the subscription.
Before budgeting, confirm the current socket count of every node, whether the enterprise repository is required by your change process, and which response time your on-call model needs. Confirm current prices with Proxmox, since these figures come from the pricing page as published.
XCP-ng has no license fee for the hypervisor or for Xen Orchestra, which Vates describes as open-source projects with no limits and no license fees. Vates sells commercial support subscriptions that add service level agreements, and it prices those plans and add-ons separately. Vates lists its VMS plans in US dollars: Essential at $2,000 per year and Essential+ at $4,000 per year for up to 3 hosts, Pro at $1,000 per host per year with a 3-host minimum, and Enterprise at $1,800 per host per year with a 4-host minimum and 24/7 support. Per the Vates pricing and support page, XOSTOR hyperconverged storage is an add-on at $800 to $1,200 per host per year.
- Free core, paid support: The hypervisor and Xen Orchestra cost nothing to license, so the recurring spend is the support plan you choose.
- Per-host versus flat pricing: Essential plans are flat up to 3 hosts, while Pro and Enterprise scale per host, so host count changes which plan is cheaper.
- Storage is optional and billed separately: XOSTOR is an add-on priced per host per year, so it adds recurring cost only if you adopt it.
- Migration is largely self-run: Xen Orchestra includes V2V warm migration from VMware, which needs HTTP access to the ESXi API, but ESXi 6.x hosts are not supported by current versions for V2V, so older estates need a separate plan.
- Support windows: XCP-ng 8.3 LTS was released on October 7, 2024 and is supported until November 30, 2028, which sets the period your support plan must cover.
Ask Vates for a written quote that states the plan, host count, minimum host terms, currency and whether XOSTOR is included. Confirm the VMS plan terms are current, and whether an ESXi version in your estate is covered by V2V before you commit.
OpenStack's code is free to use, and official projects must be licensed under the Apache License, Version 2.0. The license fee is zero, so the cost sits in people, the distribution you choose and any vendor support. The OpenInfra Foundation hosts the project within the Linux Foundation, but it does not sell a per-host subscription that replaces the operating effort. The deployment guides for the 2026.1 release describe Kolla-Ansible, which deploys in Docker containers, and OpenStack-Ansible, which deploys in LXC containers or on bare metal. Your choice of method shapes the team you need.
- People are the main cost: Engineers who deploy, upgrade and secure the control plane, networking and storage are paid through payroll or a services contract, and that cost recurs.
- Distribution or vendor support is optional: A commercial distribution or support contract adds recurring fees set by the vendor, so request the scope and price in writing.
- Upgrade cadence: OpenStack releases every six months, and stable branches are maintained for approximately 18 months, so upgrades are a recurring project rather than a one-time install.
- Skip-level upgrades reduce work: SLURP releases allow upgrades between SLURP releases in addition to adjacent releases, which lowers how often you must touch production.
- Identity and storage add integration work: Keystone federation with SAML 2.0 or OpenID Connect and Ceph-backed Glance, Cinder and Nova need design and testing, which is project effort rather than licensing.
Ask any partner for a fixed-scope quote covering design, deployment, upgrade support and handover, and state which OpenStack release it covers. Confirm the support window of your chosen release and the staff hours your team can commit each year.
What team each platform needs to operate it
Proxmox VE is the lightest of the three to start, but its high availability feature is not a small-team shortcut. The Proxmox VE High Availability wiki calls for at least three cluster nodes for reliable quorum, shared storage for guests, redundant hardware, and watchdog-based fencing so that a failed node is reset before its guests restart elsewhere. Whoever operates it needs to own the cluster file system, the storage backend (LVM, ZFS, Ceph RBD or NFS, depending on design), and the fencing configuration, and must test a node failure before go-live. A single admin with Linux and storage experience can run a non-HA cluster. Confirm with your own hardware team whether the three-node HA design, shared storage and watchdog hardware are already in place, because those are the costs that decide whether HA is affordable at all.
XCP-ng suits a small team that wants a Xen-based hypervisor managed through Xen Orchestra, with the operating burden centered on the hosts and the management VM. The skills you need are XAPI and Xen Orchestra administration, host patching, and backup planning. Version planning matters more than with Proxmox VE: the XCP-ng releases page lists XCP-ng 8.3 LTS, released October 7, 2024 and supported until November 30, 2028, while 8.2 LTS support ended September 16, 2025. A team that installs 8.3 now has a defined window to plan the next major upgrade. Ask Vates which Xen Orchestra and support tier your environment needs, since commercial support adds SLAs but is optional for the open-source projects.
OpenStack asks the most of the team, and it is the right choice mainly when you need a private cloud with API-driven self-service across many tenants, projects and hosts. Plan for a platform team that can run a release cycle: OpenStack ships every six months, and the 2026.2 Hibiscus release came out on September 30, 2026. Stable branches are maintained for roughly 18 months, so an install that is not upgraded will age out. Deployment is a project in itself: Kolla-Ansible deploys OpenStack in Docker containers with Ansible, and OpenStack-Ansible deploys into LXC containers or on bare metal. Pick one tool, staff it, and budget for Ceph, Keystone federation and Neutron networking. Teams with a few hosts and a handful of VMs will usually find Proxmox VE or XCP-ng a better fit for the operating effort.
How to choose and pilot a virtualization platform
This sequence turns a shortlist of Proxmox VE, XCP-ng and OpenStack into a decision backed by your own workload counts, storage and network constraints, support requirements and a pilot on hardware you control.
Count workloads and project growth
The platform owner and the infrastructure lead list the VMs and containers to migrate, grouped by criticality, operating system and storage footprint, then estimate how many hosts and sockets the next three years will need. This matters because Proxmox VE subscriptions are priced per CPU socket per year, Vates prices XCP-ng commercial support per host with minimums, and OpenStack scales through a multi-service control plane. Done means a written inventory with host and socket counts that you can carry into every quote.
Decide the storage and network model
The infrastructure architect decides whether guests will run on local storage, network storage such as NFS or iSCSI, or software-defined storage. Proxmox VE supports LVM, directories and ZFS locally, and Ceph RBD, CephFS and iSCSI or NFS over the network. XCP-ng offers XOSTOR as a paid add-on. OpenStack can back Nova, Cinder and Glance with Ceph. Confirm with each vendor which storage backends their support covers before you commit. Done means a one-page diagram of storage pools, VLANs and bonding that each candidate can meet.
Confirm license and support needs
Procurement and the CISO list which support level, response time and repository access the organization requires, then compare them against the published tiers. Proxmox VE tiers share the same software and differ in tickets, response time and enterprise repository access, and the software runs without a subscription. Vates documents open-source hypervisor and Xen Orchestra with commercial support adding SLAs. Ask each vendor, in writing, which support terms apply to your host count and whether AGPL or GPL obligations affect your internal modifications. Done means a signed-off support requirement that names the tier you would buy.
Assess the team's operating skills
The engineering manager maps who will patch hosts, manage clusters, run storage and troubleshoot networking, then identifies gaps. Proxmox VE is managed from a web interface on each cluster node, XCP-ng is managed through Xen Orchestra, and OpenStack deployments usually involve Kolla-Ansible or OpenStack-Ansible plus Keystone for identity. Record who can operate each stack without outside help. Done means a skills matrix with named owners and a list of training or DeployOpen-delivered implementation work you would need to cover the gaps.
Run a pilot on non-production hardware
The platform team builds a pilot cluster on spare or lab hardware using the open-source path: the Proxmox VE no-subscription repository, the freely available XCP-ng and Xen Orchestra builds, or a minimal OpenStack deployment. Proxmox documents the no-subscription repository for testing and non-production use, so keep the pilot off production repositories. Use the same storage and network design from step two. Done means a running cluster with representative guests and a documented build log that records every deviation from the production design.
Measure migration and failover behavior
The migration lead moves a representative set of VMs from a copy of your VMware estate using each tool's documented path, such as Xen Orchestra V2V for warm migration from ESXi, and records downtime, data copied and rollback steps. The platform team also tests host failure. Proxmox VE high availability needs at least three nodes, shared storage and watchdog-based fencing, so confirm that setup works in the pilot. Ask vendors to confirm that their migration tool supports your ESXi version, since the XCP-ng documentation says ESXi 6.x hosts are not supported for V2V. Done means recorded test results for each candidate, including the failure cases.
Decide and document the exit path
The steering group compares the pilot results, the support quotes and the skills matrix, then selects one platform or rejects all of them. The decision record names the migration plan, the support tier, the upgrade path and how you would leave the platform later, including the data export and format conversion steps. Upgrade timelines differ: Proxmox VE follows its Debian base, XCP-ng 8.3 LTS is supported until November 30, 2028, and OpenStack releases every six months with SLURP releases for skip-level upgrades. Done means a signed decision record that the team can use to request a formal quote from a partner such as DeployOpen, based on the written scope.
Questions buyers ask before choosing a virtualization platform
What does a self-hosted virtualization platform cost to run?
Proxmox VE software can be used without a subscription, and its paid tiers differ only in support. Proxmox VE subscriptions are priced per CPU socket per year: Community at 120 euros (no support tickets), Basic at 370 euros (3 tickets, 1 business day response), Standard at 550 euros (10 tickets, 4-hour response) and Premium at 1,100 euros (unlimited tickets, 2-hour response), according to the Proxmox VE pricing page. XCP-ng and Xen Orchestra have no license fees, but Vates sells commercial support, and its Pro tier is priced per host per year with a 3-host minimum. Recurring costs are support, hardware, storage and staff time. Ask each vendor or partner for a quote that lists socket or host counts, support tier, and any add-ons such as shared storage software.
How long does a virtualization pilot or VMware migration take?
No supplied fact gives a duration for a pilot or migration, so treat any figure you see as unverified until a plan is written. The main drivers are the number of VMs, their storage and network dependencies, how much downtime each workload tolerates, and whether the target needs new hardware or shared storage. XCP-ng documents a V2V tool in Xen Orchestra that uses warm migration, copying data while the source VM runs and then syncing changed blocks after shutdown, which limits downtime for supported ESXi versions. Note that the XCP-ng migration documentation states ESXi 6.x hosts are not supported for V2V. Ask for a timeline built from a written inventory and a pilot on representative workloads.
What does the work need from our internal team?
The work needs people who can run hypervisors, storage, networking and backups, plus someone who owns the change process. Proxmox VE uses a multi-master cluster in which every node performs management tasks, and its Proxmox Cluster File System replicates configuration in real time, so Linux administration skills go a long way. OpenStack asks more: its Kolla-Ansible and OpenStack-Ansible guides deploy the control plane with Ansible in containers or on bare metal, and Keystone federation needs identity integration work. XCP-ng centers on XAPI and Xen Orchestra, so the team needs Xen-specific operations knowledge. Map your current skills against each platform before you choose.
Can our team run a virtualization platform without outside help?
Yes, for some teams, but the answer depends on your staffing, hours of coverage and risk tolerance. Proxmox VE and XCP-ng both run without a paid subscription, and the software can be used that way, though Proxmox documents its no-subscription repository as suited to testing and non-production use, while the enterprise repository is recommended for production. A subscription adds vendor support tickets and response times. Outside help can cover planning, installation, migration, hardening, backup and documentation. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted open-source platforms in your own infrastructure, usually under a fixed-scope written agreement. Ongoing support is available as a retainer.
Does Proxmox VE's three-node high availability requirement change the plan?
It can, because Proxmox VE high availability needs at least three cluster nodes for reliable quorum, shared storage for guests, redundant hardware and watchdog-based fencing. Fencing resets a failed node before its guests restart elsewhere, so a two-node design is not a reliable HA layout. Budget for the extra hardware, the shared storage option (such as Ceph, iSCSI or NFS) and the network redundancy in the cost estimate from the start. If you cannot meet these conditions, plan for a simpler restart model or a different platform. Confirm the design with Proxmox documentation and your own hardware vendor before purchase.
Does choosing OpenStack require specialized cloud skills?
Yes. OpenStack is a cloud operating system made of modular projects and services that control compute, storage and networking through APIs, so it asks more of the team than a single-host hypervisor. OpenStack ships a release every six months, and 2027.1 Indri, a SLURP release that allows skip-level upgrades, is estimated for March 24, 2027, according to the OpenStack releases site. Stable branches are maintained for approximately 18 months, so upgrade planning is an ongoing task. Ask whether your team can operate that upgrade cadence, and whether a smaller footprint on Proxmox VE or XCP-ng fits your needs.
How does storage choice affect the virtualization decision?
Storage determines whether live migration and high availability are possible, so decide it early. Proxmox VE supports local storage on LVM, directories and ZFS, and network storage on iSCSI, NFS, CIFS, Ceph RBD, CephFS and Proxmox Backup Server. Ceph provides block, file and object storage on one RADOS cluster, and Ceph block devices can back OpenStack Glance images, Cinder volumes and Nova guest disks. XCP-ng sells XOSTOR hyperconverged storage at $800 to $1,200 per host per year, according to the Vates pricing and support page. Ask each option for its storage cost and the operating effort it adds.
Where a support contract and outside help change the decision
A support contract matters most when a platform failure would stop production and your team cannot diagnose it alone. For Proxmox VE, the software is the same across every subscription tier, so the choice is about support entitlements and repository access, not features. The published tiers are priced per CPU socket per year, and they differ in ticket allowance and response time: Basic allows 3 tickets with a 1 business day response, Standard allows 10 tickets with a 4-hour response, and Premium allows unlimited tickets with a 2-hour response. The Community tier has no support tickets. Confirm with Proxmox which tier includes the enterprise repository you need for production patching, and check how those response times are measured against your own on-call hours.
For XCP-ng, the hypervisor and Xen Orchestra are open source with no license fees, so a commercial agreement buys service levels rather than software. Vates sells support subscriptions that add SLAs, and its Vates VMS plans are priced per host or as flat tiers for up to 3 hosts, with the Enterprise plan adding 24/7 support. Ask Vates to state the response and resolution commitments in writing, which hosts and Xen Orchestra components they cover, and whether add-ons such as XOSTOR hyperconverged storage are priced separately per host. OpenStack has no single vendor support contract that replaces internal skill. The work is distribution and operations: choosing a deployment method such as Kolla-Ansible or OpenStack-Ansible, planning six-month release upgrades, and tracking when a stable branch leaves maintenance. Some organizations buy this from a commercial distributor, and others build it in house.
Outside help from DeployOpen covers planning, implementation, hardening, backup and documentation inside your own cloud accounts, data centers or air-gapped networks. It does not replace the vendor subscription or the platform's own support. A typical written scope would name the target platform and version, the cluster size and storage design, the identity integration, the backup targets and restore tests, and the runbooks your staff will use after handover. Whatever the scope, confirm deliverables, timelines and exclusions in writing before work starts, and decide up front which party carries the pager after go-live.
How DeployOpen scopes a virtualization selection and implementation
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For virtualization, we start from the platform choice and the team that must run it, then carry the work through to a handover your staff can operate.
How we scope
- We confirm which hypervisor, management layer and storage design fit your workloads and existing VMware estate.
- We document the licensing and support subscription decision, including who pays for what and which tier applies.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any build work starts.
How we build
- We deploy the chosen platform in your cloud accounts, data centers or air-gapped network, not in ours.
- We configure networking, shared or software-defined storage, backups and high availability against your own requirements.
- We test failover, backup restores and access controls, then record the results as evidence for your review.
How we hand over
- We deliver runbooks, architecture records and configuration documentation written for your operations team.
- We walk your administrators through day-to-day tasks, upgrades and the recovery procedures they will own.
- We prepare controls and evidence for compliance assessments, while independent auditors issue any formal reports.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial handover.
- Retainers can cover version upgrades timed to the vendor's release and support windows you confirm with the vendor.
- We can re-test security controls on a schedule agreed with your team as the environment changes over time.
