The validated instrument software runs unchanged, in a VM, in a container, at a URL

The analyzer's vendor software was validated on Windows 7 in 2016. Validation means you don't touch it: same OS, same patch level, same DLLs, or the qualification is void.

On a rented Hoody server, PUT /api/v1/containers/{id}/kvm with kvm: true: container stopped, dedicated metal only: hands the container /dev/kvm. QEMU boots the vendor's disk image byte for byte. The VM window is a Linux GUI program like any other, so hoody-display serves it at a URL. Lab techs open it in a browser. The 2016 image never notices it left the bench PC.

The VM's disk is a file inside the container. Snapshot the container and you snapshot the validated state, the PC, and the qualification evidence together. Restore it after a bad Patch Tuesday: except Patch Tuesday never reaches it.

The validated instrument software runs unchanged, in a VM, in a container, at a URL.