zlacker

I doubt ssh or simple sh is a matter in this case. You can do simple sh:

qvm-run --pass-io {VM_name} -- ls

Security model is not to do anything non-admin related from dom0: if you "own" dom0 you can do everything.

Allocating amount of CPU cores is a feature of VM. Not sure about dynamic though. There is dynamic flag about memory, not CPU. In practice it looks like CPU is shared among all VMs, no need of special flag for it.