You inherit a broken VM. Or a random qcow2 shows up in a backup dump. You need to yank /etc/hostname, fix a bad fstab line, or list packages inside a Windows image. The mainstream advice is losetup plus kpartx plus mount, which falls over the moment you meet LVM, LUKS, RAID, XFS from a newer kernel, a GPT partition table on a raw file, or anything not on a Linux host.

libguestfs boots a tiny purpose-built appliance under KVM in the background, opens the image inside that guest kernel, and hands you back files, streams, or an interactive shell. Your host kernel never touches the guest filesystem. No loop mounts, no root, no risk of a rogue XFS driver eating your uptime.

The one-shot commands are the killer feature — every operation you'd normally script around mount has a virt-* tool that's pipe-friendly and read-only by default:

# Peek inside without mounting anything on the host
virt-cat    -a fedora.qcow2 /etc/os-release
virt-ls -la -a fedora.qcow2 /var/log
virt-df -h  -a fedora.qcow2
virt-filesystems --all --long -h -a fedora.qcow2

# "What is this image?" — full inventory: OS, packages, users, drivers
virt-inspector -a mystery.img | less

# Batch-edit a hundred images' /etc/hosts, in place
for img in /var/lib/libvirt/images/*.qcow2; do
  virt-edit -a "$img" /etc/hosts -e 's/old\.host/new.host/'
done

# Stream a whole directory out as tar — no staging, no scratch space
virt-tar-out -a server.img /var/log - | tar tvf -

When the one-shots aren't enough, drop into guestfish. It's a REPL over the same appliance with ~300 filesystem primitives:

$ guestfish --rw -a broken.qcow2

><fs> run
><fs> list-filesystems
/dev/sda1:       xfs
/dev/vg0/root:   ext4
/dev/vg0/swap:   swap
><fs> mount /dev/vg0/root /
><fs> mount /dev/sda1 /boot
><fs> edit /etc/fstab
><fs> download /var/log/journal/... /tmp/out.journal
><fs> sh "rpm -qa --root=/sysroot | sort"

Why this beats losetup+mount:

• Format-agnostic. Reads qcow2, vmdk, vhd, vhdx, raw, ISO, and remote images over NBD/SSH/HTTP URIs. No conversion step.
• Handles hostile layouts. LVM inside LUKS inside GPT? Fine. Btrfs subvolumes, MD-RAID, ZFS pools? Fine. Windows dynamic disks? Fine.
• Filesystem support the host lacks. The appliance ships its own kernel and drivers — NTFS, HFS+, UFS, exFAT, whatever — so your host kernel version doesn't gate you.
• Unprivileged. No sudo, no loop-device exhaustion, no leftover mounts to clean up.
• Read-only by default on inspection tools; you have to pass --rw to break something.

A few power moves worth memorizing:

# Rescue mode: dropped into a shell WITH the guest disk mounted at /sysroot
virt-rescue -a broken.qcow2

# Sanitize a golden image before cloning: strips SSH host keys,
# machine-id, MAC-address config, bash history, logs, DHCP leases…
virt-sysprep -a template.qcow2

# Shrink a fat qcow2 back to its actual data size
virt-sparsify --in-place bloated.qcow2

# Resize a partition + FS in one shot during a disk grow
virt-resize --expand /dev/sda2 old.img new.img

The whole toolkit lives in the libguestfs-tools package on Debian/Ubuntu, guestfs-tools on Fedora. Learn six commands and you'll never kpartx again.