diff --git a/metropolis/vm/smoketest/BUILD.bazel b/metropolis/vm/smoketest/BUILD.bazel
new file mode 100644
index 0000000..7fe529d
--- /dev/null
+++ b/metropolis/vm/smoketest/BUILD.bazel
@@ -0,0 +1,43 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@io_bazel_rules_docker//container:container.bzl", "container_image")
+load("//metropolis/node/build:def.bzl", "node_initramfs")
+load("//build/static_binary_tarball:def.bzl", "static_binary_tarball")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/metropolis/vm/smoketest",
+    visibility = ["//visibility:private"],
+)
+
+node_initramfs(
+    name = "initramfs",
+    files = {
+        "//metropolis/vm/smoketest/payload": "/init",
+    },
+)
+
+go_binary(
+    name = "smoketest",
+    data = [
+        ":initramfs",
+        "//metropolis/test/ktest:linux-testing",
+        "@qemu//:qemu-x86_64-softmmu",
+    ],
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
+
+static_binary_tarball(
+    name = "smoketest_layer",
+    executable = ":smoketest",
+)
+
+container_image(
+    name = "smoketest_container",
+    base = "@go_image_base//image",
+    entrypoint = ["/app/metropolis/vm/smoketest/smoketest_/smoketest"],
+    tars = [":smoketest_layer"],
+    visibility = ["//visibility:public"],
+    workdir = "/app",
+)
diff --git a/metropolis/vm/smoketest/main.go b/metropolis/vm/smoketest/main.go
new file mode 100644
index 0000000..d9ff7e3
--- /dev/null
+++ b/metropolis/vm/smoketest/main.go
@@ -0,0 +1,77 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// This is a small smoke test which will run in a container on top of Metropolis Kubernetes. It exercises Metropolis'
+// KVM device plugin,
+package main
+
+import (
+	"bytes"
+	"io/ioutil"
+	"log"
+	"net"
+	"os"
+	"os/exec"
+)
+
+func main() {
+	testSocket, err := net.Listen("unix", "@metropolis/vm/smoketest")
+	if err != nil {
+		panic(err)
+	}
+
+	testResultChan := make(chan bool)
+	go func() {
+		conn, err := testSocket.Accept()
+		if err != nil {
+			panic(err)
+		}
+		testValue, _ := ioutil.ReadAll(conn)
+		if bytes.Equal(testValue, []byte("test123")) {
+			testResultChan <- true
+		} else {
+			testResultChan <- false
+		}
+	}()
+
+	baseArgs := []string{"-nodefaults", "-no-user-config", "-nographic", "-no-reboot",
+		"-accel", "kvm", "-cpu", "host",
+		// TODO(lorenz): This explicitly doesn't use our own qboot because it cannot be built in a musl configuration.
+		// This will be fixed once we have a proper multi-target toolchain.
+		"-bios", "external/qemu/pc-bios/qboot.rom",
+		"-M", "microvm,x-option-roms=off,pic=off,pit=off,rtc=off,isa-serial=off",
+		"-kernel", "metropolis/test/ktest/linux-testing.elf",
+		"-append", "reboot=t console=hvc0 quiet",
+		"-initrd", "metropolis/vm/smoketest/initramfs.lz4",
+		"-device", "virtio-rng-device,max-bytes=1024,period=1000",
+		"-device", "virtio-serial-device,max_ports=16",
+		"-chardev", "stdio,id=con0", "-device", "virtconsole,chardev=con0",
+		"-chardev", "socket,id=test,path=metropolis/vm/smoketest,abstract=on",
+		"-device", "virtserialport,chardev=test",
+	}
+	qemuCmd := exec.Command("external/qemu/qemu-x86_64-softmmu", baseArgs...)
+	qemuCmd.Stdout = os.Stdout
+	qemuCmd.Stderr = os.Stderr
+	if err := qemuCmd.Run(); err != nil {
+		log.Fatalf("running QEMU failed: %v", err)
+	}
+	testResult := <-testResultChan
+	if testResult {
+		return
+	} else {
+		os.Exit(1)
+	}
+}
diff --git a/metropolis/vm/smoketest/payload/BUILD.bazel b/metropolis/vm/smoketest/payload/BUILD.bazel
new file mode 100644
index 0000000..52b27e1
--- /dev/null
+++ b/metropolis/vm/smoketest/payload/BUILD.bazel
@@ -0,0 +1,15 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "go_default_library",
+    srcs = ["main.go"],
+    importpath = "source.monogon.dev/metropolis/vm/smoketest/payload",
+    visibility = ["//visibility:private"],
+    deps = ["@org_golang_x_sys//unix:go_default_library"],
+)
+
+go_binary(
+    name = "payload",
+    embed = [":go_default_library"],
+    visibility = ["//visibility:public"],
+)
diff --git a/metropolis/vm/smoketest/payload/main.go b/metropolis/vm/smoketest/payload/main.go
new file mode 100644
index 0000000..2ea6485
--- /dev/null
+++ b/metropolis/vm/smoketest/payload/main.go
@@ -0,0 +1,36 @@
+// Copyright 2020 The Monogon Project Authors.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"os"
+
+	"golang.org/x/sys/unix"
+)
+
+func main() {
+	if err := unix.Mount("devtmpfs", "/dev", "devtmpfs", 0, ""); err != nil {
+		panic(err)
+	}
+	testPort, err := os.OpenFile("/dev/vport1p1", os.O_RDWR, 0)
+	if err != nil {
+		panic(err)
+	}
+	testPort.WriteString("test123")
+	testPort.Close()
+	unix.Reboot(unix.LINUX_REBOOT_CMD_POWER_OFF)
+}