I'm running Proxmox (Debain underneath really) which has a meltdown-spectre checker package available, I followed a debian guide I believe for implementing the microcode and the results are mostly in the green now.

I haven't looked into it but as far as I know I don't think I need to worry about this for the VMs but I could be wrong.