Probably my favorite feature of libvirt is the security and isolation features provided by sVirt. It applies a security policy via SELinux (or AppArmor) that ensures that in the event of a VM breakout exploit, the attacker can only access resources allocated to that VM. So it isolates VMs from the host and from each other. Really cool!
Linux Hypervisor Setup (Libvirt/QEMU/KVM)
11–20 of 64 posts
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#12What do you all use for quick one-command (non gui) new vm bringup? I haven't had much luck with terraform with libvirt, and I miss Vagrant but don't want to lock myself into its syntax. Maybe I should just start using it again but I feel like there has got to be a good libvirt-based way. Provisioning new test vms with userdata embedded into an kickstart-or-whatever iso that is provided to libvirt also seems clunky.…
I was playing around with this a while ago, using cloud-init and virt-install. But I found it to be quite cumbersome if you don't have some kind of metadata service that can provide cloud-init with the user-data, ie. not using the nocloud provider.
I started looking at this mock EC2 metadata service, but never did anything with it: https://github.com/sjjf/md_server
Ninja-edit: It seems like virt-install rencently abstracted the whole NoCloud-provider, this changes a lot of things: https://blog.wikichoon.com/2020/09/virt-install-cloud-init.h...
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#13What do you all use for quick one-command (non gui) new vm bringup? I haven't had much luck with terraform with libvirt, and I miss Vagrant but don't want to lock myself into its syntax. Maybe I should just start using it again but I feel like there has got to be a good libvirt-based way. Provisioning new test vms with userdata embedded into an kickstart-or-whatever iso that is provided to libvirt also seems clunky.…
I was playing around with this a while ago, using cloud-init and virt-install. But I found it to be quite cumbersome if you don't have some kind of metadata service that can provide cloud-init with the user-data, ie. not using the nocloud provider. I started looking at this mock EC2 metadata service, but never did anything with it: https://github.com/sjjf/md_server Ninja-edit: It seems like virt-install rencently abs…
We implemented our own mock ec2 metadata service for KVM cloud-init, probably the most fun project I've worked on.
The tricky part is intercepting the requests and redirecting them to your service
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#14What do you all use for quick one-command (non gui) new vm bringup? I haven't had much luck with terraform with libvirt, and I miss Vagrant but don't want to lock myself into its syntax. Maybe I should just start using it again but I feel like there has got to be a good libvirt-based way. Provisioning new test vms with userdata embedded into an kickstart-or-whatever iso that is provided to libvirt also seems clunky.…
virt-install or virt-builder.
I have some extremely clunky 50 line shell scripts around virt-install presently but was hoping to find something a little more streamlined (like the usual Vagrant or docker-machine workflow).
Do you just manually run a huge virt-install command each time?
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#15I use qemu and never really understood the need for any further abstraction such as libvirt over it's cli usage. Can anyone tell me what there is to be gained other than needing further setup, packages and systemd services?
It's not just about abstraction. VirtIO is significantly more efficient than SATA emulation, and as it is built into the Linux kernel it just works. There is also a Windows driver package that adds VirtIO support, but it's a bit tricky to get it to work when porting in an existing Windows VM. VirtIO also makes it possible to do USB relay.
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#16I use qemu and never really understood the need for any further abstraction such as libvirt over it's cli usage. Can anyone tell me what there is to be gained other than needing further setup, packages and systemd services?
It's not just about abstraction. VirtIO is significantly more efficient than SATA emulation, and as it is built into the Linux kernel it just works. There is also a Windows driver package that adds VirtIO support, but it's a bit tricky to get it to work when porting in an existing Windows VM. VirtIO also makes it possible to do USB relay.
VirtIO is very usable via QEMU, without libvirt (naturally, because in the configuration described in the article, libvirt is just calling QEMU). It is usually as simple as `qemu-system-x86_64 -drive file=/path/to/my/disk,if=virtio`.
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#17Earlier quoted context omitted.
virt-install or virt-builder.
I have some extremely clunky 50 line shell scripts around virt-install presently but was hoping to find something a little more streamlined (like the usual Vagrant or docker-machine workflow). Do you just manually run a huge virt-install command each time?
I usually use virt-builder actually. But it's like 3-4 command line options for virt-install, not 50.
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#18How annoying that this page uses a non-standard port for the WebSocket "livereload" feature (1313).
It makes my firewall pop up constantly.
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#19I use qemu and never really understood the need for any further abstraction such as libvirt over it's cli usage. Can anyone tell me what there is to be gained other than needing further setup, packages and systemd services?
I'm like you and use the qemu command line. But libvirt does make it easier to define cpu groups, thread affinities and the like and without needing to be root to do so. Something like this. There are other ways to accomplish this I think without libvirt, but it gets a little hairy.
https://www.reddit.com/r/VFIO/comments/9iaj7x/smt_not_suppor...
Re: Linux Hypervisor Setup (Libvirt/QEMU/KVM)
#20How annoying that this page uses a non-standard port for the WebSocket "livereload" feature (1313). It makes my firewall pop up constantly.
[deleted]