Johanan Liebermann johananl

KVM in runc

Running a KVM virtual machine inside a runc contianer.

These instructions assume running Vagrant with a libvirt provider.

Install the vagrant-libvirt plugin using the following:

vagrant plugin install vagrant-libvirt

	#!/bin/sh
	# Amazon Linux AMI startup script for a supervisor instance
	#
	# chkconfig: 2345 80 20
	# description: Autostarts supervisord.

	# Source function library.
	. /etc/rc.d/init.d/functions

	supervisorctl="/usr/local/bin/supervisorctl"

	# Put this file under /etc/systemd/system/redis.service

	[Unit]
	Description=Redis Container
	After=docker.service
	Requires=docker.service

	[Service]
	TimeoutStartSec=0
	Restart=always

	L0 = bare metal machine
	L1 = VM on bare metal
	L2 = VM on VM

	First, ensure virtualization is enabled on L0 as described here: https://docs.fedoraproject.org/en-US/quick-docs/using-nested-virtualization-in-kvm/#proc_enabling-nested-virtualization-in-kvm

	Next, launch L1 with the following Vagrant config (or an equivalent directly on the hypervisor):

	Vagrant.configure("2") do \|config\|
	config.vm.box = "generic/ubuntu1604"

	curl -fsSL https://download.docker.com/linux/ubuntu/gpg \| sudo apt-key add -
	sudo add-apt-repository \
	"deb [arch=amd64] https://download.docker.com/linux/ubuntu \
	$(lsb_release -cs) \
	stable"
	sudo apt-get update
	sudo apt-get install -y docker-ce
	sudo gpasswd -a $USER docker
	echo "Please re-log"

	# This is based on a Redhat blogpost:
	# https://www.projectatomic.io/blog/2014/10/libvirtd_in_containers/
	# https://github.com/projectatomic/docker-image-examples/blob/master/rhel-libvirt/libvirtd/Dockerfile
	FROM centos:7

	ENV VAGRANT_VERSION=2.2.0

	RUN yum -y install systemd libvirt-daemon-driver-* libvirt-daemon libvirt-daemon-kvm libvirt-devel qemu-kvm gcc make wget openssh-clients && yum clean all; \
	(cd /lib/systemd/system/sysinit.target.wants/; for i in *; do [ $i == systemd-tmpfiles-setup.service ] \|\| rm -f $i; done); \
	rm -f /lib/systemd/system/multi-user.target.wants/*;\

	provider "packet" {
	auth_token = "${var.auth_token}"
	}

	# Packet auth token. Generate it on your Packet account. More info:
	# https://support.packet.com/kb/articles/api-integrations
	variable "auth_token" {}

	# The Packet project ID. More info: https://support.packet.com/kb/articles/api-integrations
	variable "project_id" {}