title: Ensuring virtual TPM is unique across instances
body: <p>My code (C++ on Linux) needs to uniquely identify the machine (vm guest/container/physical) that it is running on, and I have been researching TPM (2) for this purpose.  Since each physical TPM has a unique EK it seems that I could use the TPM API to verify the machine actually running on is the one expected.</p>
  <p>However, with VM's/containers, it seems like a virtual TPM can be copied along with the guest/container to another hypervisor/host.  In that case, I assume the EK is copied along with it and this defeats the ability to unique identify the machine (vm guest/container/physical) on which my code runs.</p>
  <p>Is this correct?  Or do virtual TPM's somehow connect to the host TPM to ensure uniqueness?  If someone wanted to bypass my check, I assume running a TPM simulator would have the same effect?</p>