Rootless virtual machines with KVM and QEMU

Please keep the storage pool solution I had mainlined. Any finagling with the XML to adjust hardcoded paths, to boot the VMs are a usability hit we cannot afford.

The problem is that storage pools are non-functional by default on a fresth Debian trixie installation.

I have written a deterministic, reproducible CI script running on Debian trixie referenced in post #72 that shows exactly that.

Additional commands are required to set up storage pools on Debian trixie. The commands required seem a bigger usability hit than the awful hardcoding for storage paths to /home/user.

Just so we are clear about the problem and to avoid a wild goose chase for a solution:

I installed libvirt and qemu inside a Whonix VM to see where the problem is. Apparently the current documented commands don’t cause virt-manger to show a qemu:///session by default and so the storage folder is never created - a symptom of that issue. Importing the XML doesn’t create this connection.

It is only when I explicitly add this type of connection in the virt-manger GUI, that it creates the appropriate folders under .local.

So TL’DR we need to figure out what libvirt config to change for it to connect to qemu session by default

1 Like

This command adds and auto connects to a qemu session and indeed generates the storage pool folder under user local from scratch. No need to fiddle about with directory creation or virsh storage pool commands

virt-manager -c qemu:///session

3 Likes

Nice, will test and report back

2 Likes

Worked but not out of the box, needs additional packages, different path (wont be created by default).. wiki adjustments. Will add them.

1 Like

I was able to run the VMs without the need for this step, any useful out of it for qemu session? because VMs are fully functional after importation without these commands (internet, sound..).

1 Like

Changes has been added for Whonix and KS wikis, explicit/hardcoded path removed.

except adding user on whonix side, which i can remove if not needed anymore.

Would be helpful if you explain what you’re doing here. What additional packages are you talking about? virt-manager should be part of the packages being downloaded for the setup.

That misses the purpose of my last post. It was necessary to automate the storage pool creation so users can move the images to an existing location. Also needed for automated setups like Kicksecure hosts, It has nothing to do with VM functionality or boot ability.

Again please explain in detail here what is going on. Why do you need to add a user account for this setup when the whole point is to be able to get this running on the default unprivileged user account?

libvirt-daemon-driver-qemu and libvirt-daemon-driver-storage Added, as VMs wont start without them.

KVM-VM settings is pointing to default storage pool which uses this path ~/.local/share/images, so now we dont need to add the path inside VM settings (which is good), BUT the path is different because we were pointing it to /.local/share/libvirt/images/ (read the above comments), but now /libvirt/ not needed. Also the path wont be created by default, so user must create the path manually. All these changes i mentioned reflected on the wiki here:

So i assume by automate you mean that the default storage pool will point to ~/.local/share/images and thats correct.

You understand me the opposite, i dont need to add user account, but in our wiki we have this step:

This part is inherited from qemu:///system wiki, so shall i remove it since we seems to not need it anymore?

1 Like

OK so apparently newer vesions of virt-manager have changed the path since I’ve added the connection years ago. That’s fine.

However this path (~/.local/share/images) was generated when running the virt-manager command to add a session connection. I reproduced it several times.

There’s a libvirt meta package that should grab the necessary ones

Preserve the instructions for adding to libvirt system connections but document it as optional. There is one major scenario where a user might want to assign a hardware device to be passed through to a VM and this would require libvirt to have root privileges. This functionality has security tradeoffs we already docuemtned, but we are not here to hand hold users who may have use cases where they need to do so.

As for the old instructions on importing and starting network XMLs, please move to wiki/Deprecated for archival.

The current VM configs work just fine wih system connections as is.

1 Like