mkcloud: use cache=unsafe for VMs