Alessandro makes some very astute points about virtual appliances. I would say that I agree with him, but let me do so while making some points. Alessandro's primary concern is that people will treat virtual appliances too much like, well, an appliance. He is pointing out that a lot of vendors will simply install an operating system, slap their app on top, and say, "BHAM! It's an appliance!" Except, of course, it is not. An appliance is something along the lines of an IronPort or Netscaler. These are truly hardware appliances. These devices are the bread and butter of their respective companies (okay, Citrix bought Netscaler last year and it owns more stuff, granted), and these companies are dedicated to updating their appliances' software.
That is not to say that a VM can't also be an appliance -- but only if the company backing it has the resources to dedicate to patches and updates. Something that most of these virtual appliance manufacturers do not. If you download a virtual appliance that uses Ubuntu as its operating system and you still have to write a script that calls apt-get to check for updates every day then congratulations, you have deployed a new server. There should only be one place you get patches from when it comes to an appliance, and that is the vendor who provides the appliance. For example, ESX runs a modified version of Red Hat Enterprise Linux (RHEL) 3 as its console OS, but you never have to download updates from Red Hat -- VMware provides them to you.
Virtual appliances are a great idea, but I think that too many companies are making mad dashes towards the appliances' creation without properly scoping out the long-term investment virtual appliances can and do entail.
This was first published in January 2007