- Users - libvirt List Archives

[libvirt-users] Issues with nwfilter rules
by Kevin 10 Dec '11

10 Dec '11

Hi All, I have two kvm guests running with a bridged configuration bound separately to br0 and br1 on my Fedora 15 host. I'm attempting to create some nwfilter rules on br1 and am running into a bunch of problems that have me scratching my head. libvirt version: 0.8.8-7 What I've noticed on the second host is as follows: - Most all nwfilter rules that I create for the host on br1 don't work as I would expect. If I create a rule for TCP dest port 22 with direction set to 'in', I would expect I could connect to the host via SSH from another host, but I only see a SYN and not a full connection. If I set the direction to 'inout', SSH seems to work. - A nwfilter rule for UDP dest port 53 with direction set to 'out' or 'inout' doesn't allow lookups to an outside DNS server. - In the configuration of one VM, the source Virtual network device lists "Host device vnet0 (Bridge 'br0') and the other lists "Host device eth1 (Bridge 'br1')". I don't see anything different in the two hosts XML configuration files that describe the difference, but I'm concerned that the second VM on br1 is misconfigured. I notice a few iptables rules with "PHYSDEV match --physdev-in vnet1" listed in them, should these really read "PHYSDEV match --physdev-in br1" given the configuration virt-manager is reporting? I would appreciate any pointers. -Kevin

1 0

[libvirt-users] http://libvirt.org/archdomain.html - page is empty
by pitnvrsk＠rambler.ru 09 Dec '11

09 Dec '11

Hello. I have found in section Architecture -->Domain management architecture an empty page. http://libvirt.org/archdomain.html Respectfully, Peter.

2 1

[libvirt-users] FYI: SpecVirt results using libvirt + KVM
by Daniel P. Berrange 09 Dec '11

09 Dec '11

Some folks may be aware of the SpecVirt benchmark, where KVM is giving the competition something to worry about :-) http://www.spec.org/virt_sc2010/results/ >From the POV of libvirt uses though, there has been one annoyance with the previously submitted results though, in that they have been invoking the KVM command line directly. This has made it harder for people who are deploying KVM using libvirt to replicate the optimal configurations. I'm pleased to be able to point out that the latest result published for KVM by IBM has in fact been done using libvirt! You can clearly see how the guests are being configured with libvirt and the results demonstrate that using libvirt to manage KVM does not involve sacrificing any of the performance that KVM offers: http://www.spec.org/virt_sc2010/results/res2011q4/ This can only continue to get better as our communities work together to add more performance related features to both libvirt and KVM :-) Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|

1 0

[libvirt-users] lxc capabilities
by Chris Haumesser 08 Dec '11

08 Dec '11

I'm experimenting with the libvirt lxc driver, and wondering if there is some way to control the capabilities assigned to the container processes. With lxc-tools, I can specify a configuration option, lxc.cap.drop, which causes the container processes to drop the specified privileges. My libvirt containers seem to run with cap_sys_module,cap_sys_boot,cap_sys_time,cap_audit_control,cap_mac_admin which is rather more permissive than I'd like. In particular, cap_sys_boot allows a container to reboot the host machine. I am running libvirt-0.9.2 from squeeze-backports on debian squeeze. Cheers, -C-

2 5

[libvirt-users] read-only rootfs for lxc containers
by Chris Haumesser 08 Dec '11

08 Dec '11

And speaking of running out of a shared read-only root, I get the following error when I attempt it: error: Failed to start domain hw error: internal error guest failed to start: PATH=/bin:/sbin TERM=linux LIBVIRT_LXC_UUID=38320e75-1ba0-d85a-6138-532a3a66f13d LIBVIRT_LXC_NAME=hw /bin/bash 2011-12-08 15:31:41.945: 1: info : libvirt version: 0.9.7 2011-12-08 15:31:41.945: 1: error : lxcContainerPivotRoot:345 : Failed to create /mnt/vmroot/.oldroot: Read-only file system 2011-12-08 15:31:41.945: 2666: info : libvirt version: 0.9.7 2011-12-08 15:31:41.945: 2666: error : lxcControllerRun:1210 : error receiving signal from container: Input/output error XML: http://pastebin.com/Q0p5irBH Cheers, -C-

2 3

[libvirt-users] tmpfs mounts for lxc container
by Chris Haumesser 08 Dec '11

08 Dec '11

I intend to share a single read-only filesystem root among a number of LXC containers. With lxc-tools, I can specify tmpfs bind mounts within the container, for directories that need to be writable, like /var/run and /var/lock. Is there a simple way to do this with libvirt, or do I need to mount the tmpfs in the host first, and specify it as a filesystem in the xml? Cheers, -C-

2 1

[libvirt-users] lxc errors on 0.9.7
by Chris Haumesser 08 Dec '11

08 Dec '11

I'm testing 0.9.7 now with lxc, and get the following error when trying to start a container: 2011-12-07 22:49:26.293: 1997: error : lxcControllerRun:1158 : unsupported configuration: Expected exactly one TTY fd My configuration is very simply: hw 38320e75-1ba0-d85a-6138-532a3a66f13d 102400 102400 1 exe /bin/bash destroy restart destroy /usr/lib/libvirt/libvirt_lxc If I try to add any different type of console, I get an error that only pty consoles are supported. What am I missing? -C-

4 5

[libvirt-users] Custom firewall rules
by Hansa 08 Dec '11

08 Dec '11

Hi, Normally Im using webmin to manage my firewall. Webmin fw however breaks the iptable rules invoked by libvirt. Is there a fw tool (beside iptables console command) which can be used without breaking libvirts rules? -Hansa

1 1

[libvirt-users] libvirt and LXC
by Ivars Strazdiņš 05 Dec '11

05 Dec '11

Hi there, I'm fairly new to libvirt and LXC, please forgive my ignorance. I was looking for a graphical tool to manage LXC containers and noticed that libvirt has support for LXC. Actually, I expected libvirt to be able to display and manage LXC hosts much like KVM. But it does not happen this way. The only thing I can see with virsh/virt-manager is storage pool with LXC containers, but not much else. No information on running/stopped containers or networking. libvirt is 0.9.7 on both LXC server and client I use to connect to the server. I use lxc+ssh for connection. Am I missing something obvious here? Some configuration file? libvirt documentation does not mention any. Kind regards, Ivars

2 1

[libvirt-users] virt-manager / libvirtd connection options
by Shaun Glass 05 Dec '11

05 Dec '11

Good Day, I had previously posted an issue last week where I had qemu/kvm running on RHEL 6.1 and could not create any vm's when connecting from virt-manager running on another machine. Seems virt-manager checks the host it is running on for the capability of creating vm's as opposed to the machine it has connected to. Nobody could give me an answer to why that happens or how to fix. I have in the meantime setup convirture on the RHEL 6.1 machine but would prefer to use virt-manager. Can anyone offer any suggestions to what is the best way to connect from a remote client to the RHEL 6.1 machine running qemu/kvm. The method I was trying to use was ssh with publickey login. Regards

1 0