- Users - libvirt List Archives

RBD pool not starting "An error occurred, but the cause is unknown"
by me＠vk4msl.com 16 Feb '26

16 Feb '26

Hi all, I've been battling this for about a year now. I've deployed virtual machine hosts running AlpineLinux 3.23 (recently updated from 3.21) which ships `libvirtd` 11.10.0, Ceph 19.2.3 and QEMU 10.1.3. (For reference: previous thread is archived at https://www.spinics.net/linux/fedora/libvirt-users/msg14421.html) I have two RBD pools defined: one is a "high availability" pool which replicates a copy of each block on every node, the other (previously used with OpenNebula) just makes sure there are at least 2 copies of blocks across the nodes (preferrably 3). They're called "ha-images" and "opennebula-images" respectively. "ha-images" starts without issue. It has a configuration like the following: ``` <pool type="rbd"> <name>ha-images</name> <uuid>6beab982-52b3-495b-a4a7-ab7ebb522ef5</uuid> <capacity unit="bytes">16003182362624</capacity> <allocation unit="bytes">184657756160</allocation> <available unit="bytes">6658209792000</available> <source> <host name="172.31.252.1" port="6789"/> <host name="172.31.252.2" port="6789"/> <host name="172.31.252.5" port="6789"/> <host name="172.31.252.6" port="6789"/> <host name="172.31.252.7" port="6789"/> <name>ha</name> <auth type="ceph" username="libvirt"> <secret uuid="c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3"/> </auth> </source> </pool> ``` No issues with it, it starts just fine. "opennebula-images" never starts, its configuration: ``` <pool type="rbd"> <name>opennebula-images</name> <uuid>fcaa2fa8-f0d2-4919-9168-756a9f4ad7ee</uuid> <capacity unit="bytes">16003182362624</capacity> <allocation unit="bytes">7893286499025</allocation> <available unit="bytes">6658213388288</available> <source> <host name="172.31.252.1" port="6789"/> <host name="172.31.252.2" port="6789"/> <host name="172.31.252.5" port="6789"/> <host name="172.31.252.6" port="6789"/> <host name="172.31.252.7" port="6789"/> <name>one</name> <auth type="ceph" username="libvirt"> <secret uuid="c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3"/> </auth> </source> </pool> ``` The `libvirt` user I created in Ceph is able to list the RBD pool: ``` lithium:~# rbd --id libvirt ls -p one | head gapmx-old-vda gapmx-old-vdb gapmx-testing-vda gapmx-testing-vdb gapmx-vda gapmx-vdb mastodon-vda mastodon-vdb mastodon-vdd mastodon-vde ``` Starting it, `libvirt` merely tells me: "An error occurred, but the cause is unknown". No logs written anywhere, no explanation. Just "computer says no". Yet, if I hand-configure my virtual machines, I can still mount RBD volumes as virtual disks within either pool. I just can't browse them via `virsh` or `virt-manager` on the `opennebula-images` pool like I can for the `ha-images` pool. Where should I be looking for the error? What did I do wrong that makes it refuse to start?

4 3

How to enable 'nesting' in the virtual machine XML config for an LXC container?
by ttk_foo＠internet.ru 12 Feb '26

12 Feb '26

The old LXC-managed container had these settings: lxc.apparmor.allow_nesting = 1 Is it possible to specify this somewhere in the libvirt/lxc container settings?

1 0

Guest to Guest Communication in NAT Network
by fc26wuqa＠studserv.uni-leipzig.de 02 Feb '26

02 Feb '26

Hi, I have a nat based network. I want to communicate between two hosts on a secure basis (not http) I have two guests, one guest is reachable to the outside internet via git.example.de. git.example.de has a DNS Entry for my supervisor. On my Supervisor I am forwarding the port 443 the respective guest. Is it possible to access a guest via its domain name (git.example.de) from a guest that is in the same network? I looked at the tcpdump, and traffic goes through to the guest, but I think its not sending anything back. When trying to curl a guest from a guest it only says: Trying 123.45.67.89:80 ... Is there anything I can do? Thank you. Best, dot

2 1

Migration pull vs. push
by johnt＠panix.com 02 Feb '26

02 Feb '26

The migration examples I've found I was able to repeat the steps successfully. They follow the pattern of what I am calling a "push". You are logged into the source hypervisor you want to migrate from and run something like "virsh migrate --live <local VM name> qemu://<Destination Hypervisor>/system" My question is if libvirt support a "pull" migration? Where the user starts on the destination node and "pulls" a VM to itself from the source node. -John

3 2

virt-install - preseed.cfg
by Andrés Miranda 22 Jan '26

22 Jan '26

Hola Comunidad, necesito ayuda. Estoy creando una máquina virtual 100% headless, pero al momento de ejecutar, se detiene y me muestra el instalador en modo texto. Comparto la estructura: cat <<EOF > preseed.cfg # Localización y Teclado d-i debian-installer/locale string es_CO.UTF-8 d-i debian-installer/language string es d-i debian-installer/country string CO d-i localechooser/supported-locales multiselect es_CO.UTF-8 d-i keyboard-configuration/xkb-keymap select latam d-i keyboard-configuration/layoutcode string latam # Configuración de Red (Modo NAT/DHCP) d-i netcfg/choose_interface select auto d-i netcfg/get_hostname string machine d-i netcfg/get_domain string local d-i netcfg/link_wait_timeout string 10 d-i netcfg/dhcp_timeout string 60 # Espejo (Mirror) - Estados Unidos, Sin Proxy d-i mirror/country string manual d-i mirror/http/hostname string deb.debian.org d-i mirror/http/directory string /debian d-i mirror/http/proxy string # Configuración de APT d-i apt-setup/non-free-firmware boolean true d-i apt-setup/contrib boolean true d-i apt-setup/non-free boolean true # Cuentas de Usuario d-i d-i d-i d-i d-i d-i d-i # Zona Horaria - Bogotá, Colombia d-i clock-setup/utc boolean true d-i time/zone string America/Bogota d-i clock-setup/ntp boolean true # Particionado Automático (Todo el disco - Recomendado) d-i partman-auto/disk string /dev/vda d-i partman-auto/method string regular d-i partman-lvm/device_remove_lvm boolean true d-i partman-md/device_remove_md boolean true d-i partman-auto/choose_recipe select atomic d-i partman-partitioning/confirm_write_new_label boolean true d-i partman/choose_partition select finish d-i partman/confirm boolean true d-i partman/confirm_nooverwrite boolean true d-i partman-auto/confirm boolean true d-i partman-auto/confirm_nooverwrite boolean true # Selección de Software (SSH Server + Utilidades estándar) tasksel tasksel/first multiselect standard, ssh-server d-i pkgsel/include string build-essential d-i pkgsel/upgrade select full-upgrade popularity-contest popularity-contest/participate boolean false # Instalación del Cargador de Arranque (GRUB) d-i grub-installer/only_debian boolean true d-i grub-installer/bootdev string /dev/vda # Finalización (Reinicio automático tras terminar) d-i finish-install/reboot_in_progress note EOF sudo virt-install \ --name debian12 \ --vcpus 2 \ --memory 2048 \ --disk size=20,bus=virtio,format=qcow2 \ --os-variant debian12 \ --network network=default,model=virtio \ --graphics none \ --console pty,target_type=serial \ --location https://deb.debian.org/debian/dists/bookworm/main/installer-amd64/ \ --initrd-inject=./preseed.cfg \ --extra-args "auto=true priority=critical preseed/file=/preseed.cfg console=ttyS0,115200n8" \ --check all=off Error: Una vez ejecutado, me muestra el instalador gráfico. Saludos !

3 2

Direct passthrough of /dev/lp0
by billehhg1＠gmail.com 12 Jan '26

12 Jan '26

I want to give multiple domains access to my parallel printer. Can I share hardware parallel port with libvirt?

3 2

Qemu/libvirt with gpu acceleration on c9 ?
by lejeczek 08 Jan '26

08 Jan '26

Hi guys. Do you know if with centos9 it's possible to get graphics/video acceleration - but not as pass-through to host device "directly" ? I'm fiddling with things but without success, with different bits in guest: ... <devices> ... <graphics type='vnc'> <listen type='none'/> <gl enable='yes' rendernode='/dev/dri/by-path/pci-0000:04:00.0-render'/> </graphics> <audio id='1' type='none'/> <video> <model type='virtio' heads='1' primary='yes'>  <acceleration rendernode='/dev/dri/by-path/pci-0000:04:00.0-render'/>  </model>  <driver name='vhostuser'/> <alias name='video0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </video> Comments within XML - basically describe the issue, I hope. Is the issue steaming from Qemu/build - and if yes then, can building Qemu with some flags fix it? - or is this rather hardware side of things most likely the root cause? qemu-kvm-core-10.1.0 + libvirt-libs-11.9.0 many thanks, L.

1 0

Virtualization guest reports: kvm VS microsoft
by lejeczek 31 Dec '25

31 Dec '25

HI guys. How guest reports *Virtualization* with /hostnameclt /should not depend on the guest itself, right? Virtualization: microsoft vs Virtualization: kvm particularly if guests run off the same host with libvirtd v. 11.9.0 Is it somewhere in domain's xml - but if so I failed to spot what makes this difference - what is it? thanks, L.

1 1

Recommendations for basic libvirt access control
by Nikolaus Rath 08 Dec '25

08 Dec '25

Hello, I noticed that (at least on my Fedora installation), adding a user to the libvirt group is equivalent to giving full root access (since the user can add arbitrary block devices to VMs, and then use the VM to modify the block device). Therefore, I'd like to give users more limited permissions - but I'm a bit lost about the best way to approach that. It seems that I could: - tighten (or relax) socket permissions in the systemd config - switch off socket activation and configure socket permissions in libvirtd.conf - Configure socket-dependent permissions in libvirt - Enable policykit ACL checks, and configure permissions there. Could someone give me a recommendation what (combination?) of these options would most suitable for a simple "users can interact with their predefined VMs" model? Ideally, users would be able to configure and interact with VMs that are assigned to them, without having access to operations that are trivially root-equivalent (like adding new storage devices from the host). If that's difficult, I'd also settle for a simpler model where users can't change VM permissions at all, and are limited to starting, stopping, and connecting to the console of their VM. What's the best way to accomplish that? Best, -Nikolaus

4 4

libvirt access control
by nikolaus＠rath.org 06 Dec '25

06 Dec '25

Hello, I'm puzzled by how libvirtd manages access control. As far as I can tell, on my Fedora system it runs qemu and virtiofsd instances as user qemu. Yet, the qemu process apparently has read/write access to storage devices in /dev that only root has rw access for. Similarly, virtiofsd is able to write into shared directories that the qemu user does not have access to (confirmed by switching to qemu user with sudo). What is libvirtd (or virt-manager) doing to make this work? Then, as far as I can tell, there's lots of sockets with different permissions created by systemd in /run/libvirt (e.g. libvirt-admin-sock, libvirt-sock, libvirt-sock-ro). But since they're all passed to libvirtd as open file descriptors, I don't understand how they can give different levels of access (since libvirtd has no way of knowing which socket was used). What am I missing? Best, -Nikolaus

5 8