Proxmox - A dedicated KVM platform for Whonix?

[hellresistor]

Just to say, working in Proxmox server

[nurmagoz]

Views on Proxmox (pros/cons)

I have installed proxmox and generally played with it, Here are some of what i find worth to be mentioned: Advantages Importing distro is by just wget .iso URL to proxmox import path, Then it will be readable to proxmox. (Verification of the .iso should be done manually asaik) Proxmox used by many big hosting companies, having whonix compatible with it will give whonix easy installation for those servers Proxmox is debian plus kvm which whonix have expert with both of them not somethin…

[LightTemplar]

I am trying to start it there too. Could you please tell me, where to turn off the time syncing? While system checking in the workstation, I’ve got “kvm-clock tsc hpet acpi_pm detected”.

[Patrick]

@LightTemplar

While system checking in the workstation, I’ve got “kvm-clock tsc hpet acpi_pm detected”.

Unrelated to timesync.

How to turn of this check is already explained in the very message which mentions it. That however doesn’t fix the original reason for the check.

How to fix the root issue? Users won’t be able to fix this. No developers are working on this.

@LightTemplar

Could you please tell me, where to turn off the time syncing?

sdwdate Disable Autostart

[LightTemplar]

@Patrick

Users won’t be able to fix this. No developers are working on this.

Does it mean, that my Whonix Workstation will have a weakness? Or it’s safe to just turn the check off?

[Patrick]

The warning is there on purpose, is correct, not a false-positive.

[LightTemplar]

So, after an year, full of events, I’m here again
And even with solution for PVClock, if someone will need it:

1. Edit or create /etc/pve/virtual-guest/cpu-models.conf, add there a new CPU type. This simple one will work:

cpu-model: pvclockoff
        flags -kvmclock;-tsc

2. Then use this CPU in the VM CPU options.
3. ACPI you can turn off in plain VM options.
4. I also set to no the option Use local time for RTC.

Adding flags to qm.conf doesn’t work, you need to create a custom CPU type.
Documentation used:
https://pve.proxmox.com/wiki/Manual:_cpu-models.conf
Possible flags you can find via console: qemu-system-x86_64 -cpu help

I’m open to critique. I’m not a pro in virtualization, so I could easily overlook something.

[cryptomus]

What I’d really like to see is Whonix LXC container tarballs put up on Turnkey Linux so it would show up as a template in Proxmox. I’ve messed around with OVA’s and QCOW imports and have had troubles over and over.

An LXC container is ideal for Whonix CLI gateway as a separate offering, and then maybe an ISO for the main OS. LXC containers are fast and very lightweight compared to KVM, making it ideal for the gateway at least.

[nurmagoz]

@cryptomus

I’ve messed around with OVA’s and QCOW imports and have had troubles over and over.

Yeah thats why it needs a contributors for this feature.

Also check:

Views on Proxmox (pros/cons)

I have installed proxmox and generally played with it, Here are some of what i find worth to be mentioned: Advantages Importing distro is by just wget .iso URL to proxmox import path, Then it will be readable to proxmox. (Verification of the .iso should be done manually asaik) Proxmox used by many big hosting companies, having whonix compatible with it will give whonix easy installation for those servers Proxmox is debian plus kvm which whonix have expert with both of them not somethin…

[cryptomus]

Views on Proxmox (pros/cons)

On disadvantages first bullet point. Proxmox is free. The no-subscription repository has all needed updates for a fully functioning system. The lack of subscription only indicates the lack of a support contract and is reflected in logs when attempting to obtain support. It’s meant to be headless, so CLI-only with a web interface is quite workable. I would add to this thread that Proxmox has excellent support for something Qubes does NOT support out of the box, that’s LXC containers, plus al…

[Patrick]

Unless you are contributing it, this is highly unlikely to happen.