Install virtualization software on EC2

Nested virtualisation is a very tricky problem, which can bring further issues to the surface; for example, Xen-on-Xen virtualisation works up to a point but opens a security hole, which is why we don't have our base Xen configured to permit it. For the new Nitro system, KVM has a nesting capability, but I don't know (yet) whether our specific KVM implementation allows it (I'll edit this piece when I've found out more).

If a customer wants to have an environment where they have control over a virtualisation layer that sits on top of their own environment (for example, so they can instrument the hypervisor in ways that CloudWatch doesn't), then their best option is to get one of the new bare-metal instances, and install an OS and layered hypervisor of their choice on that.