Virtual machines

Creating one

A new VM asks for four things: what it is called, how many vCPUs and how much memory it gets, how large its disk is to be, and where it comes from. The source decides how much else there is to do.

• A cloud image is already installed. cloud-init turns it into this machine at the first boot — user, password and SSH keys are set before anybody logs in.
• An installer ISO has no system on it yet. Phillux reads the image, works out how it boots and what it carries, and writes the answer file that this installer reads. Nobody has to sit in front of it.
• An empty disk is the way for anyone who wants to do it by hand — the machine boots into the firmware and waits.

The disk lies on a storage that carries the content type VM disks. Which storages those are is offered in the field; one that cannot hold disks is not on the list.

Windows without firmware fiddling

A Windows 11 guest needs UEFI, Secure Boot and a TPM 2.0, and on most platforms those are three separate settings in three separate places. Here they follow from the choice of operating system: pick Windows 11 and the machine is built that way.

The driver medium is the other half. A Windows setup does not know virtio and shows an empty disk list; Phillux offers the virtio driver ISO as a second drive so the installer finds the disk.

The console in the browser

A VM's console is the raw VNC stream QEMU already serves, passed through one to one as a WebSocket — the protocol noVNC speaks in the browser. There is no second process bridging it and no second port to open in a firewall.

A screenshot of the running machine can be taken without opening the console at all, which is what a task log or a list view uses to show that a guest really did come up.

Snapshots, clones and what they cost

A snapshot is taken, rolled back and deleted from the machine itself. Cloning makes a second guest out of a finished one.

What stays hidden until it hurts is the cost. A VM snapshot lives inside the qcow2 file and makes it grow: the old blocks have to stay, because that is where a rollback goes. qemu does not say which snapshot is holding which blocks — that number does not exist. So Phillux reports the two numbers that are true: how much memory each snapshot captured, and how far the file has grown in total.

A rule can clear away what nobody is coming back to. What it never touches is a snapshot belonging to a lab stage: take one of those away and the stage is still listed, still clickable and no longer restorable.

Asking the guest something, without a network

A command can be run inside a running VM through the qemu guest agent — a service in the guest that listens on a virtio channel. The channel is in every domain Phillux defines; the agent is not in every image, and a guest without it is reported as such rather than quietly returning nothing.

There is deliberately no SSH here. SSH needs an address, an open port, a key and an account that exists — a guest on a sealed-off lab network has none of that, and that is exactly where a question has to be answerable.

Leaving again

An export writes the machine out for another host: an OVA for VMware or VirtualBox that carries vCPUs, memory and firmware along, or a bare disk as qcow2, VMDK, VDI, VHDX or raw. Each target says what has to happen on the receiving side, because an export nobody can bring in is worth nothing.

Exporting is a permission of its own and not part of cloning. Whoever may make one and download it holds the whole disk of that guest in their hands.