Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ditching Vagrant: VMs with KVM and Virsh on Debian

benjamintoll.com

Post reply on HN
Print view View original

31–40 of 49 posts

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#31

Post by tosti »

bonzini wrote: post #15
Intralexical wrote: post #11

Earlier quoted context omitted.

> Virt manager drives me crazy because it hides the VM files in its own directory with permissions that aren't yours forcing you to use sudo to manually manage your own fucking vm files. I just checked my `~/.local/share/libvirt/`. It doesn't do this for me, and I don't think it ever has. I do remember having to set this up at some point. Looks like this is it: https://unix.stackexchange.com/questions/799034/whats-th…

There are two ways to run the Libvirt daemon, which are unprivileged and privileged aka system. You are using unprivileged mode, the parent is using system mode which is more powerful and provides better isolation but does hide stuff in /var. For example, running QEMU as its own user and using PCI passthrough is only possible with the system daemon. You also need the system daemon to set up bridged networking, though…

Nah, just add your own directories to storage. I've always done it that way and it works just fine.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#33

Post by tredre3 »

0cf8612b2e1e wrote: post #28
nobody42 wrote: post #16

Earlier quoted context omitted.

It's usable (?) as a toy: numerous gui inconsistencies and lack of security isolation [0]. Can't say whether the of lack funding (move to Cockpit from Red Hat) is the reason, or maintainer is just an obstructionist (strictest feature policy). [0] https://github.com/virt-manager/virt-manager/issues/358

That is infuriating to read. I have been using virt-manager and sleeping soundly that it was a secure isolation level. VM guests should be considered trusted? Are you kidding me? That’s my number one usage -to operate software I do not trust.

This is a shockingly common sentiment in open-source maintainers, that all software on a machine should be trusted.

Just to name two recent (and thus inexcusable) examples on top of my head:

Systemd refused to fix a privilege escalation through their use of "less" for years because they argued any user getting to that point should be trusted. The real world doesn't work that way unfortunately. They relented when someone took the initiative to fill a CVE.

Caddy's admin interface is system-wide opened, any local user can inject configuration and take over everything. Doesn't have to be a local user; think of any service you run that can makes web requests on behalf of people (custom api endpoints, avatar fetching, etc), it can be used to take over Caddy.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#34

Post by topspin »

fulafel wrote: post #27

For many use cases you'll do fine without the libvirt tower of babel, with just the qemu/kvm cli.

Oh dear. I got called a "cave man" for suggesting such a thing. Good luck with that.

Running a VM is just a qemu-system-whatever command. They usually get pretty lengthy, but it's nonetheless an ordinary shell command.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#36

Post by regexorcist »

exabrial wrote: post #24

Honestly though... why not just systemd containers with minimal mounts, and if you're needing an ip, what not an unprivledged LXC container? The surface area is far smaller and they're way easier to inspect.

Systemd-nspawn is great. You can have any networking you like with it too, no need for LXC.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#37

Post by jen20 »

influx wrote: post #32

What are people using Vagrant for these days? The last time I encountered it was before Docker become widespread.

Anything that uses virtual machines (perhaps you're running FreeBSD inside them, for example), or where you need complex network topology.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#38

Post by pak9rabid »

zamadatix wrote: post #3

This is another area I hope I'm able to migrate to systemd. I already use nspawn for containers but vmspawn is still a bit new and limited in the options. Once it gets there though it'll be nice to have system+containers+vms under one consistent roof.

I've been using Canonical's LXD for this, under Debian Trixie. Nowadays I can usually get away with just running containers for things I need vs full-blown VMs. I guess the only downside is that in order to get the latest version of LXD installed easily you'd have to do it via snap, which I understand is a dealbreaker for many.

Re: Ditching Vagrant: VMs with KVM and Virsh on Debian

#39

Post by mike_hock »

creshal wrote: post #9
happyPersonR wrote: post #2

There used to be virt-manager Wonder if it’s still around ? Hope it’s doing well !

"around" is the best way to describe it; the libvirt/virt-manager ecosystem isn't dead, but redhat killing off ovirt/rhev support drained a lot of resources out of it. And for some bizarre reason people decided that the much less mature (both organizationally and technologically) proxmox VE is the best thing since sliced bread, so everyone who does care about linux virtualization is now trying to hammer some homelabb…

> It would be funny if it wasn't so sad.

Well it has been replaced. We don't need anything now.

Post reply on HN