Debian活用/仮想マシン設定

設定

nftables

$ sudo systemctl reload nftables
$ sudo systemctl restart lxc-net
$ sudo systemctl restart docker
$ sudo nft list ruleset

libvirt

$ sudo adduser USER libvirt
$ newgrp libvirt

$ sudo virsh net-list --all
$ sudo virsh net-autostart default
$ sudo virsh net-start default

/etc/nftables.conf

table inet filter {
        chain input {
                iifname "virbr0" udp dport {53,67} accept
                iifname "virbr0" tcp dport 53 accept
        }
        chain forward {
                iifname "virbr0" accept
                oifname "virbr0" ct state established,related accept
        }
}

$ sudo nft insert rule inet filter input iifname "virbr0" accept
$ sudo nft insert rule inet filter forward iifname "virbr0" accept
$ sudo nft insert rule inet filter forward oifname "virbr0" accept

$ osinfo-query os

$ sudo virt-install \
  --name debian \
  --memory 4096 \
  --vcpus 4 \
  --disk path=~/libvirt/debian.qcow2,size=30,bus=virtio \
  --os-variant debian13 \
  --network network=default,model=virtio \
  --graphics spice \
  --cdrom ~/libvirt/debian-13.6.0-amd64-netinst.iso

$ virt-manager

削除

$ sudo virsh list --all
$ sudo virsh shutdown NAME
($ sudo virsh destroy NAME)
$ sudo virsh undefine NAME --remove-all-storage

bridge接続

※ifupdownやconnmanなどが起動しているなら停止する。

$ sudo nmcli connection add type bridge \
  ifname br0 \
  con-name br0 \
  ipv4.method auto \
  ipv6.method auto
$ sudo nmcli connection add type ethernet \
  ifname enp37s0 \
  master br0 \
  con-name br0-slave-enp37s0
$ sudo nmcli connection down "プロファイル 1"
$ sudo nmcli connection up br0
$ sudo nmcli connection up br0-slave-enp37s0

$ nmcli device status
$ nmcli connection show

virt-managerか、設定ファイル(/etc/libvirt/qemu)で設定する。

$ sudo virsh edit debian

$ virt-xml

systemd-networkdと共存する

/etc/NetworkManager/conf.d/10-unmanaged.conf

[keyfile]
unmanaged-devices=interface-name:enp37s0;interface-name:br0

sudo systemctl restart NetworkManager
nmcli device

/etc/systemd/network/10-br0.netdev

[NetDev]
Name=br0
Kind=bridge

/etc/systemd/network/20-enp37s0.network

[Match]
Name=enp37s0

[Network]
Bridge=br0

/etc/systemd/network/30-br0.network

[Match]
Name=br0

[Network]
DHCP=yes
IPv6AcceptRA=yes

sudo systemctl enable --now systemd-networkd

sudo apt install systemd-resolved
resolvectl status

LXC(Unprivileged)

~/.config/lxc/lxc.conf

lxc.lxcpath = /lxc

• /etc/subuid
• /etc/subgid

USER:100000:65536

~/.config/lxc/default.conf

lxc.include = /etc/lxc/default.conf

lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536

$ lxc-create -n debian -t download

/lxc/debian/config

lxc.apparmor.profile = lxc-container-default-with-nesting

/etc/lxc/lxc-usernet

USER veth lxcbr0 10

/etc/nftables.conf

table inet filter {
        chain input {
                iifname "lxcbr0" udp dport {53,67} accept
                iifname "lxcbr0" tcp dport 53 accept
        }
        chain forward {
                iifname "lxcbr0" accept
                oifname "lxcbr0" ct state established,related accept
        }
}

$ lxc-start -n debian
$ lxc-attach -n debian
$ lxc-stop -n debian

削除

$ lxc-stop -n debian
$ lxc-destroy -n debian

bridge接続

/etc/lxc/lxc-usernet

USER veth br0 10

/lxc/debian/config

lxc.net.0.link = br0

Docker

sudo adduser USER docker

/etc/docker/daemon.json

{
    "data-root": "/docker"
}

/etc/nftables.conf

table inet filter {
        chain input {
                # Docker
                iifname "docker0" udp dport {53,67} accept
                iifname "docker0" tcp dport 53 accept
        }
        chain forward {
                # Docker
                iifname "docker0" accept
                oifname "docker0" ct state established,related accept
        }
}

$ docker pull debian:trixie
$ docker images
$ docker run --name debian-trixie -it debian:trixie bash
$ docker rm debian-trixie