Simple Docker KVM container
Generic container for launching a Virtual Machine inside a Docker container.
Features: - Non libvirt dependant. - It uses QEMU/KVM to launch the VM directly with PID 1. - It attaches to the VM as many NICs as the docker container has. - The VM gets the original container IPs. - Uses macvtap tun devices for best network throughput. - Outputs serial console to stdio, thus visible using
Partially based on RancherVM project.
AUTO_ATTACHis set to
yes, then all the container interfaces are attached to the VM. This is the typical use case.
AUTO_ATTACHis set to
no, a list of interfaces have to be declared in the
ATTACH_IFACESvariable. This is useful when launching the container with
net=hostflag, and only a subset of network interfaces need to be attached to the container.
$ docker run \ --name kvm \ -td \ --privileged \ -v /path_to/image_file.qcow2:/image/image \ -e AUTO_ATTACH=yes \ bbvainnotech/kvm:latest
Before running the container, it is needed to create the networks:
$ docker network create --driver=bridge network1 --subnet=172.19.0.0/24 $ docker network create --driver=bridge network2 --subnet=172.19.2.0/24
Then, create the container and attach the network prior to start the container: ``` $ docker create \ --name containername \ -td \ --privileged \ --network=network1 \ -v /pathto/imagefile.qcow2:/image/image \ -e AUTOATTACH=yes \ bbvainnotech/kvm:latest
$ docker network connect network2 containername $ docker start containername ```
$ docker run \ --name container_name \ -net=host \ -td \ --privileged \ -v /path_to/image_file.qcow2:/image/image \ -e AUTO_ATTACH=yes \ bbvainnotech/kvm:latest
bashkeyword as argument to the container will launch a bash shell:
$ docker run \ -ti \ --privileged \ -v /path_to/image_file.qcow2:/image/image \ -e AUTO_ATTACH=yes \ bbvainnotech/kvm:latest bash
If the container has more than one IP configured in a given interface, the user can select which one to use. The
SELECTED_NETWORKenvironment variable is used to select that IP. This env variable must be in the form IP/MASK (e.g. 184.108.40.206/24). If this env variable is not set, the IP to be given to the VM is the first in the list for that interface (default behaviour).
This usecase is found when working with Kubernetes: Kubernetes assigns two IP addresses to the docker eth0 interface.
When this env variable is set to
yes, the entrypoint will scan all the vNICs present in the Docker container, and it will configure the hosted VM to get as many vNICs as the host container.
If this variable is set to
no, only the interface names specified in the env variable
$ATTACH_IFACESwill be connected to the guest VM. Interfaces shall be separated by spaces (eg.
AUTO_ATTACHis set to
noand no interfaces are defined, the VM will start with no NICs (and thus no vtap devices connected to container interfaces).
This var controls the invocation parameters for
dnsmasqdaemon, used to give IP addresses to the VM. See dnsmasq's man page for info about available options.
It's specially useful the following options when debugging dnsmasq behaviour:
When this env varable is set to
yes, the verbosity is increased.
This container uses macvlan devices to setup network connectivity. If an old kernel or limited host is used, it is possible to use linux bridge by setting the variable
--privileged) is needed in order for KVM to access to macvtap devices see issue #3 for further information.
qemu-kvm: -netdev tap,id=net0,vhost=on,fd=3: vhost-net requested but could not be initialized qemu-kvm: -netdev tap,id=net0,vhost=on,fd=3: Device 'tap' could not be initialized
you will need to load the
vhost-netkernel module in your dockerhost (as root) prior to launch this container:
# modprobe vhost-net
This is probed to be needed when using RancherOS.
Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.