[LXD 5.2] LXD Project usage for 100% local use case

LXD
1

Hello :wave:

I need to find a solution to provide a local virtual stack of vm/containers to developers. I assume that LXD is probably already installed on developper computers. But it is also possible to find a way for a clear environment without LXD.

The main goal of my script is to create a dedicated network and containers/vm on it. This stack will be used locally and not need to be accessible from the outside. Only outbonding networking.

I tested different things with LXD Projects (all features enable or disable) but I have difficulties to make something good.

My main installation process is:

  • ensure LXD is installed or preseed it with default bridge and storage pool (same as an LXD already installed on the system)
  • create a projet (with or without features enabled)
  • create a dedicated network bridge for this project
    • with its network range and with dnsmasq configuration
  • create a dedicated storage for this project (on the same computer without any additionnal devices)
    • btrs if the system is btrfs or dir seems ok
  • create a dedicated profile to use for the common way of not having to add/attach containers volume
    • but without eth0 device because I need to set fixed ip for each containers/vm of the project

After that I have another method to:

  • build/publish containers/vm customized using cloud-init
  • remove all containers/vm after publishing them

And finally, I have a method to:

  • init the stack of containers/vm from local project’s custom images
  • add eth0 device with the good IP address for each ones
  • start each ones

After reads here. I saw that I can’t create network of type bridge when project’s network feature is enabled. And my actual experience say me that creating and using dedicated LXD projects seem bad. I’m not sure and is the reason I opened this topic.

If anyone have advises about a way to process. And If I need to avoid using LXD project too.

Thanks in advance.

PS. I pushed my shell script on github if you want taking a look on it :wink:

2

After some other test on my script to try without LXD Project creation (just start on a fresh install of LXD initilized without network which I can only inherit the root device) I found a bad test when I try to detect if LXD is initialized.

when I take a look on the lxd init --help I don’t find how to detect if the lxd init command is already done or not. If anyone have an idea.

3

Pretty sure you can just check for the “default” profile / “storage” pool (or any check thats profiles / storage > 0)

Can always do the below to verify / get an empty system (though containers wont run without security.nesting);

lxc launch ubuntu: lxd
lxc exec lxd bash
snap install lxd
lxc profile list
4

Yes. It’s an idea.

Something like: if [[ $(lxc profile show default | grep -c 'root') -gt 0 ]]; then ...

I going to test this… Thank you

5

I think I going to review the initialization par of my script to be more simple. My idea around initiated with a preseed is not a good idea… Using inheritance from the default project should be properly definded and I don’t have to create my project from a copy of the default to ensure more control

6

How can I add my network to the networks section in a profile?

I tested command like lxc network attach-profile mynet myprofile but it add the network to devices. Like lxc profile device add ... :thinking:

7

Yea with the type: nic ?

Sorry didnt read fully, where are you seeing the network property? It doesn’t appear to be in the docs or in tab complete on the CLI? (I may be wrong)

Have you seen Linux Containers - LXD - Has been moved to Canonical? seems to go over this…

8

My network has been created by the command:

lxc network create mynet \
    --type=bridge \
    --project=myproject \
    ipv4.address=10.10.10.1/24 \
    ipv4.nat=true \
    ipv4.firewall=false \
    ipv6.address=none \
    ipv6.firewall=false \
    dns.domain="lxd" \
    dns.mode="managed" \
    dns.search="lxd" \
    dns.zone.forward="managed" \
    dns.zone.reverse.ipv4="managed" \
    dns.zone.reverse.ipv6="none"

No device created at this time…
For the moment I try to add the network to have something like in preseed. Into a networks section

9

Ok. Sorry. networks section is part of the preseed. Not part of the profile. My bad.

10

You then should attach that network to a profile (with a device that can access it I suppose, not an expert on this), as you’ve been doing? (membered, if you dont attach it to the default profile you need to attach the additional profile at creation time I.E lxc launch ubuntu: test -p default -p additionalProfile)

11

In fact I think It is not my idea to add the network device into the profile. I again confused the preseed and profile configurations between them

I going to do this at containers initalization time to provides fixed IP because the doc say that is impossible to override this setting if applied on profile…

12

Ok. It work as exepted now :slight_smile:

my working process:

lxc project create \
         test \
         -c features.images=true \
         -c features.profiles=true \
         -c features.storage.volumes=true \
         -c features.networks=false;

lxc project switch test

lxc profile create local:test-profile

lxc network create \
        test-br0 \
        --type=bridge \
        --project=test \
        ipv4.address=10.202.0.1/24 \
        ipv4.nat=true \
        ipv4.firewall=false \
        ipv6.address=none \
        ipv6.firewall=false \
        dns.domain="lxd" \
        dns.mode="managed" \
        dns.search="lxd";


lxc storage create test-storage dir source=$(pwd)/0_dir_storage

lxc profile device add test-profile root disk path=/ pool=test-storage        

# containers & vm
lxc init images:/debian/11/cloud -p test-profile c1
lxc config device add c1 eth0 nic name=eth0 network=test-br0 ipv4.address=10.202.0.11
lxc start c1

lxc init images:/debian/11/cloud -p test-profile c2
lxc config device add c2 eth0 nic name=eth0 network=test-br0 ipv4.address=10.202.0.22
lxc start c2

Thanks for help :slight_smile: