From my understanding one of the reasons Spice is faster than VNC is because Spice is caching the image while VNC doesn’t.
#Spice for Newbies
#Spice Protocol
5. Caching
Spice implements client image caching in order to avoid redundant transmissions to the client. Caching applies to any kind of image data sent to the client, including pixmaps, palettes and cursors. Each image arrives from the driver with a unique id and a cache hint. Non-identical images have different ids, while identical images share the same id. The cache hint recommends the server to cache the image. Pixmap cache is shared among all the displays. Cache is defined per connection and synchronized between the server and the client, i.e., in each moment the server knows exactly which images are in the client cache. Moreover, the server is the one to decide whether an item should be added or removed from the cache. The client cache size is set by the client and transferred to the server through the display channel initialization message. The server monitors the current cache capacity and when it lacks space it removes the least recently used cache items until there is enough available cache space. The server sends an invalidate command with these items and the client removes them.
Considering I got swap. core dumps and everything disabled #Anti-forensics Precautions when using Kicksecure VMs in Live Mode.
Is the spice cache able to contain a view of the VM screen and does it ever get written on host disk somewhere by qemu/libvirt/spice?