Alpine Linux - User contributions [en]

FTP

2020-09-11T18:30:20Z

Junialter:

"FTP" means '''File Transfer Protocol''' one of the older file transfers protocols used over TCP/IP infrastructure, has a client/service philosophy (it needs a listening server and users are clients to make requests for files).

About FTP software Alpine Linux has only the right solutions packaged:

* The most secure and fasted FTP server as {{Pkg|vsftpd}} for the service part if you plan to install a FTP service on Alpine servers
* The most profiling and perfect client as {{Pkg|ncftp}} and also {{Pkg|lftp}} for the client part if you dessire to use at the command line
* Also you can use {{Pkg|pcmanfm}} with {{Pkg|gvfs}} plugins to handle ftp request too

'''In this document we will show you general information about FTP software related to Alpine linux'''

= The FTP service: vsftpd =

As alpine linux (simple, secure and eficientely) the provided FTP service software are {{Pkg|vsftpd}}

{{Pkg|vsftpd}} are not so used due common hosting panels does not handle it's configurations management.. in contrash {{Pkg|vsftpd}} are secured respect rest of others without so much updates.

=== FTP server: About vsftpd package ===

'''It was the most secured FTP server'''. It is the default FTP server in the NimbleX and Slackware Linux distributions and many others.

{{Note|As for minimal FTP's and fast server purposes are very recommended due it easy configuration process and perfect performance without much configuration.}}

{| class="wikitable"
|-
! Feature/Artifac !! Value/Name !! Observations
|-
| Main package name || vsftpd || <code><nowiki>apk add vsftpd</nowiki></code>
|-
| Manpages and DOCs packages || vsftpd-doc || <code><nowiki>apk add vsftpd-doc</nowiki></code>
|-
| Configuration file || {{Path|/etc/vsftpd/vsftpd.conf}} || It's not close to alpine, just vanilla provived!
|-
| Default place for files || {{Path|/var/lib/ftp}} || cos anonnimous are default, is home for daemon user
|-
| Log files (error, access, etc) || {{Path|/var/log/vsftpd.log}} || Defined in vsftp.conf also
|-
| User running the service || vsftpd || Others Linux used "ftp" alpine has as a group
|-
| Group to common to || vsftpd || Used to share things amont others daemons or services, like redis or apache files
|-
| Programed on || C || Main engine code in C
|}

==== Important Limitations ====

'''No SFTP support, BUT ''has support for FTPS''.'''

=== Install vsftpd ===

The installation does not work out of the box, cos enable by default anonimous and ipv4 only.

Per user ftp files can be supported by special directive in the vsftp.conf file using <code>user_sub_token</code> to somethign like {{Path|/home/$USER/public_ftp}} directory by example if we enable it (process are described below in further section "vsftpd configuration".

{{Pkg|vsftd}} is available in the Alpine Linux repositories. To install, simple launch the commands below:

<pre>
<nowiki>
apk add vsftpd

rc-update add vsftpd default

rc-service vsftpd restart
</nowiki>
</pre>

=== vsftpd Configuration ===

By default alpine vsftpd package does not provide any special configuration, just vanilla provided so we must specify what we want!

Configurations depends of the purpose of the FTP nature to serve, the most common cases are anonymously ftp service, user system ftp service and virtual users ftp service..

For production purposes the [[Production FTP virtual users: vsftpd + MySQL]] wiki page will explain in details all the needs for a virtual users case, there's the [[Production FTP user service: vsftpd]] wiki page with futher information to use with system users and lets encrypt certificates.

Due to the minimalism of alpine linux, '''unfortunately the vsftpd packaging only provided vanilla configurations not close to alpine or easy admin maintenance''', see the [[Production VSFTP system: vsftpd + MySQL + SFTP]] wiki page to goin in deep about configuring lighttpd web server.

==== Controlling vsftpd ====

'''''Start vsftpd''''': After the installation {{Pkg|vsftpd}} is not running. As we said in first section, was started already but if you want to start {{Pkg|vsftpd}} manually use:

{{Cmd|rc-service vsftpd start}}

You will get a feedback about the status.

<pre>
* Caching service dependencies ... [ ok ]
* Starting vsftpd... [ ok ]
</pre>

'''''Stop vsftpd''''': If you want to stop the web server use ''stop'' in the same way of previous command:

{{Cmd|rc-service vsftpd stop}}

'''''Restart lighttpd''''': After changing the configuration file lighttpd needs to be restarted.

{{Cmd|rc-service vsftpd restart}}

'''''Proper Runlevel''''': By default no services are added to start process, sysadmin must know what we want and what will services do, also other main reason are due in dockers there's no runlevels per se and Alpine linux are mostly used in dockers containers. You must added the servide only to the default runlevel, not to boot, because need networking activated

{{Cmd|rc-update add vsftpd default}}

=== Testing vsftpd ===

This section is assuming that vsftpd is running. Well, at the moment there is no user ftp allowed available but the server is up and running.

{{Cmd|nc -zv 127.0.0.1 21}}

Note that we used "127.0.0.1" if you are using alpine as the only machine for all as your main desktop/pc/machine.

If you are using alpine remotelly as web server and just install it the package, chnage <code><nowiki>127.0.0.1</nowiki></code> with ip of the alpine machine. The "webserveripaddres" are the ip address of your setup/server machine.

The common response will be '''OPEN''' if server are running.

=== See also about vsftpd ===

* [[Production Lets Encrypt: dehydrated]]
* [[Production FTP user service: vsftpd]]
* [[Production FTP virtual users: vsftpd + MySQL]]
* [[Production VSFTP system: vsftpd + MySQL + SFTP]]
* [[Alpine newbie developer]]
* [[Alpine newbie lammers]]

= The FTP clients: lftp, pcmanfm and ncftp =

The FTP protocol need also a client support to property used. Alpine Linux provides two packages for command line and batch procesing of FTP protocol, apart of the {{Pkg|firefox}} package: the {{Pkg|lftp}} and the {{Pkg|ncftp}} packages.

* Gui programs:
** {{Pkg|pcmanfm}} check [[#Gui_FTP_client:_About_pcmanfm_package]]
** {{Pkg|firefox}}
* Cli programs:
** {{Pkg|lftp}} check [[#Cli_FTP_client:_About_lftp_package]]
** {{Pkg|ncftp}}

So then, '''commonly a web browser (firefox) supports FTP protocol''' so our FTP server just configured can be '''browsed using the address <code><nowiki>ftp://<webserveripaddres></nowiki></code> The "webserveripaddres" are the ip address of your setup/server machine.'''

== Cli FTP client: About lftp package ==

LFTP is a sophisticated file transfer program supporting a number of network protocols (ftp, http, sftp, fish, torrent).

* Has job control and..
* uses the readline library for input.
* It has bookmarks,
* Has built-in mirror command
* Can transfer several files in parallel.

{| class="wikitable"
|-
! Feature/Artifac !! Value/Name !! Observations
|-
| Main package name || lftp || <code><nowiki>apk add lftp</nowiki></code>
|-
| Manpages and DOCs packages || vsftpd-doc || <code><nowiki>apk add lftp-doc</nowiki></code>
|-
| Configuration file (system) || {{Path|/etc/lftp.conf}} || It's not close to alpine, just vanilla provived!
|-
| Configuration file (user) || {{Path|~/.lftprc}} || if found the first to parse!
|-
| Configuration file (user) || {{Path|~/.lftp/rc}} || second attempt to parse if first not found!
|-
| Programed on || C || Main engine code in C
|}

=== Installing lftp ===

Is provided in main repository since 3.6, so '''is a team supported package ready for production''' deploys.

<pre>
<nowiki>
apk add lftp
</nowiki>
</pre>

=== Configuring lftp ===

The main configuration file, <code><nowiki>/etc/lftp.conf</nowiki></code> comes with various examples and comments. On startup, lftp executes <code>/etc/lftp.conf</code> and then <code>~/.lftprc</code> and <code>~/.lftp/rc</code>. You can use those files to set system-wide and user-specific settings.

In your configuration file, simply use the command set followed by the name of the setting, followed by its value. Use on/off for boolean values. Check this example:

<pre>
<nowiki>
set ftp:ssl-force on
set ssl:verify-certificate on
set ftp:use-feat off
set ftp:ssl-protect-data on
</nowiki>
</pre>

You can set specific settings for specific servers only. Simply append a slash (/) and the server name to the setting.

<pre>
<nowiki>
set ftp:use-feat off /example.com
set ftp:ssl-force on /example.com
</nowiki>
</pre>

{{Note|The closure for `dns:', `net:', `ftp:', `http:', `hftp:' domain variables is currently just the host name as you specify it in the `open' command (with some exceptions where closure is meaningless, e.g. dns:cache-size). For some `cmd:' domain variables the closure is current URL without path. For other variables it is not currently used. See examples in the sample lftp.conf.}}

=== General lftp usage examples ===

By default, lftp is silent about the operations it performs in the background. If you need some more output, e.g. for debugging purposes, you can use the 'debug' command (without the 'set' command):

* debug 5 will display the full debug output.
* debug 3 will only display greeting messages and error messages.

Note that if you use the -d switch from the command line, the debug setting will be overruled and the full debug output will be displayed.

If you prefer some commands to be called by another name, you can set aliases:

<pre>
<nowiki>
alias dir ls
alias less more
alias zless zmore
alias bzless bzmore
alias reconnect "close; cache flush; cd ."
alias edit "eval -f "get $0 -o ~/.lftp/edit.tmp.$$ && shell \\"cp -p ~/.lftp/edit.tmp.$$ ~/.lftp/edit.tmp.$$.orig && vim ~/.lftp/edit.tmp.$$ && test ~/.lftp/edit.tmp.$$ -nt ~/.lftp/edit.tmp.$$.orig\\" && put ~/.lftp/edit.tmp.$$ -o $0; shell rm -f ~/.lftp/edit.tmp.$$*"
</nowiki>
</pre>

The last alias (edit) should be all in one line. It allows you to get a remote file, edit it with vim (change as needed), and place the edited file back on the server. This is very convenient!

* '''Example usage'''

Below is an example of a mult-part download over the SFTP protocol:

<nowiki>$ lftp -e 'pget -c -n 5 /path/to/file' sftp://username@server</nowiki>

short explanation:

* -e: lftp option to execute command
* pget: is the command for partial download
* -c: pget option to resume
* -n: pget option for number of parts

== Gui FTP client: About pcmanfm package ==

PCMAnfM is a filemanager.. that by the usage of the {{Pkg|gvfs}} gio we can use with ftp servers as graphical clients, is easy to use just open the pcmanfm program and then:

# From the bar menu open the "go" menu
# Then choose "Connect to a server"
# Choose the FTP protocol and input username (path is optional)
# After a while you will input the password

Check the picture for furter reference:

[[File:Ftp-gui-pcmanfm_at_2020-09-11_14-13-03.png]]

= See Also =

* [[Alpine newbie developer]]
* [[Alpine newbie lammers]]
* https://pkgs.alpinelinux.org/packages?name=tftp-hpa related to [[PXE boot]]

[[Category:Newbie]]
[[Category:Server]]
[[Category:Web_Server]]
[[Category:Development]]

MariaDB

2020-04-23T07:49:00Z

Junialter: /* Initialization */ Streamlined language a bit and optimized the documentation by removing redundant information.

[https://mariadb.org/ MariaDB] is a community-developed fork of the MySQL relational database management system intended to remain free under the GNU GPL. It is notable for being led by the original developers of MySQL, who forked it due to concerns over its acquisition by Oracle.

== Instalation ==

Alpine Linux has dummy counterparts packages for those that are not close to that change from ''mysql'' to ''mariadb'' naming packages.

Take in consideration that the user <code>mysql</code> was created during instalation of packages, in the initialization section two users will be created in database init: <code>root</code> and <code>mysql</code>, and in that point only if are in their respective system accounts, will be able to connect to the database service.

<pre><nowiki>
apk add mysql mysql-client
</nowiki></pre>

That will install the most used ones.. <code>mariadb-cient</code> and <code>mariadb-server</code>, rest of packages are brief described here for more information, here are listed in orden of relevance for production server

{| class="wikitable"
|-
! MySQL name package !! Since Alpine: !! Brief usage !! Related package
|-
| mysql || v2 || it's a dummy package to easy install of mariadb || mariadb
|-
| mysql-client || v2 || it's a dummy package to easy install of commands tools || mariadb-client
|-
| mariadb || v2 || server equivalent to mysql-server || mariadb-common
|-
| mariadb-client || v2 || connection command line and tools || mariadb-common
|-
| mariadb-doc || v3.0 || manpages are there! || man man-pages
|-
| mariadb-connector-odbc || edge || coding or making OS level connections, to any DB without libs install || .
|-
| mariadb-connector-c || v3.8 || coding connection on C sources || mariadb-connector-c-dev
|-
| mariadb-backup || v3.8 || to external backup devices, not widely used, in past was inside mariadb package || .
|-
| mariadb-server-utils || v3.8 || server commands not widely used, in past was inside mariadb package || .
|-
| mariadb-dev || v3.1 || Need for compilations depends on source code || .
|-
| mariadb-test || v3.3 || testing suite from MariaDB tools || .
|-
| mariadb-mytop || v3.9 || data performance monitoring || .
|-
| mariadb-plugin-rocksdb || v3.9 || plain key-value event relational for data || .
|-
| mariadb-static || v3.8 || static libs for static non depends linking in builds || .
|-
| mariadb-embedded || v3.9 || the libmysqld identical interface as the C client || mariadb-embedded-dev
|-
| mariadb-embedded-dev || v3.9 || use the normal mysql.h and link with libmysqld instead of libmysqlclient || mariadb-dev
|-
| mariadb-openrc || v3.8 || separate scripts, in past was embebed on server package || .
|}

== Initialization ==

The alpine package of MySQL/MariaDB are like normal tarball of MySQL one, admins must know what they want.. there's no automatic window-like installation here.

The ''datadir'' located at <code>/var/lib/mysql</code> must be owned by the mysql user and group. You can modify this behavior but must edit the service file at <code>/etc/init.d</code> directory. Also, you need to set <code><nowiki>datadir=<YOUR_DATADIR></nowiki></code> under section <code>[mysqld]</code> at the config file.

# Initialize the main mysql database, and the data dir as standardized to <code>/var/lib/mysql</code> by the rc script.<br>/etc/init.d/mariadb setup
# Then you can start the service but there's no root password set until this point.<br>/etc/init.d/mariadb start
# Secure the installation by running<code>mysql_secure_installation</code>
# Setup permissions for manage others users and databases

== Configuration ==

In order to finish setup into '''MariaDB''' now provide '''this script called <code>mysql_secure_instalation</code> that also are present as <code>mariadb-secure-installation</code>''', too. This script provides minimal and security setup to the database, and here are the questions made explained:

# '''Enter current password for root (enter for none):''' If you have previously set up a root password, provide it here and press enter. If correctly entered, the response will be <code>OK, successfully used password, moving on...</code>
# '''Switch to unix_socket authentication [Y/n]''' Setting the root password or using the Unix_socket ensures that only admins can log into engine database. MySQL 5.6 and MariaDB 10.2 introduced socket authentication, where system users are the same as the MySQL/MariaDB users. For production servers you should disable this by answering "n", which will give you the response <code>... skipping.</code>
# '''Change the root password? [Y/n]''' This gives you the opportunity to change the root password to a stronger one if necessary. If this is not needed, enter 'n'.
# '''Remove anonymous users? [Y/n]''' Remove anonymous users created to log in using socket authentication. For production systems, disallow this by answering 'Y', resulting in: <code>... Success!</code>.
# '''Disallow root login remotely? [Y/n]''' Normally, root should only be allowed to connect from 'localhost' in order to protect from password sniffing attempts over the network. Enter 'Y' to get: <code>... Success!</code>.
# '''Remove test database and access to it? [Y/n]''' By default, MariaDB comes with a database named 'test' that anyone can access. If this is not needed, 'Y'. The response will be: <code>... Success!</code>.
# '''Reload privilege tables now? [Y/n]''' Reloading the privilege tables will ensure that all changes made so far will take effect immediately. Answer 'Y' and the response will be: <code>... Success!</code>.

After responding to each question, restart the service with <code>rc-service mariadb restart</code>

=== Configuration files and customization ===

Due today were influenced by systemd standardization, the famous <nowiki>my.cnf</nowiki> are not more the main config file for the server engine. Now only few variables are defined there and all the settings are provided by independent files into the <code>/etc/my.cnf.d/</code> directory, user own config files are under <code>~/.my.cnf</code> config file of each home dir, and are read after global ones; so then we have:

{| class="wikitable"
|-
! Config file !! Path and name !! Versions of Alpine !! Contents to configure
|-
| my.cnf || <nowiki>/etc/mysql/my.cnf</nowiki> || v2 to v3.8 || All the directives, Global config file
|-
| mariadb-server.cnf || /etc/my.cnf.d/mariadb-server.cnf || since 3.9 || First Global config file, main directives
|-
| .my.cnf || <nowiki>$HOME</nowiki> || all || user name only config directives
|}

Newer system Alpine packages can set in independent files in any case those commands always works and where are not apply just will ignore the output:

* On older Alpine system must set config files for MAX ALLOWED PACKETS to minimun proper amount:

<pre>
<nowiki>
sed -i "s|.*max_allowed_packet\s*=.*|max_allowed_packet = 100M|g" /etc/mysql/my.cnf
sed -i "s|.*max_allowed_packet\s*=.*|max_allowed_packet = 100M|g" /etc/my.cnf.d/mariadb-server.cnf
</nowiki>
</pre>

* Only allow local connections on cases where there's only one server or no expected to connect from others:

<pre>
<nowiki>
sed -i "s|.*bind-address\s*=.*|bind-address=127.0.0.1|g" /etc/mysql/my.cnf
sed -i "s|.*bind-address\s*=.*|bind-address=127.0.0.1|g" /etc/my.cnf.d/mariadb-server.cnf
</nowiki>
</pre>

* If are not in domain controller, dont search for hostnames to improve performance responses (ideal for local only servers):

<pre>
<nowiki>
sed -i "s|.*skip-networking.*|skip-networking|g" /etc/mysql/my.cnf
sed -i "s|.*skip-networking.*|skip-networking|g" /etc/my.cnf.d/mariadb-server.cnf
</nowiki>
</pre>

* Set default charset to UTF8MB4, in newer versions (since Alpine v3.9), just added a new file to added thus customization, but older versions (below Alpine v3.8)of the package does not have a charset section, so you must added manually to the main configuration in each respective section:

<pre>
<nowiki>
cat > /etc/my.cnf.d/mariadb-server-default-charset.cnf << EOF
[client]
default-character-set = utf8mb4

[mysqld]
collation_server = utf8mb4_unicode_ci
character_set_server = utf8mb4

[mysql]
default-character-set = utf8mb4
EOF
</nowiki>
</pre>

== Updating or comming from upgrading ==

Mayor Upgrades beetween Alpine linux version are so easy as change the repository version, but the MySQL/MariaDB engine need some extra steps when this are performed:

Upgrade databases on major releases
Upon a major version release of mariadb (for example mariadb-10.1.10-1 to mariadb-10.1.18-1), it is wise to upgrade databases:

# keep the old database (mysql sheme) structure of the engine daemon, currently this are not more the case, today this not make sense anymore
# upgrade the MariaDB/MySQL packages, of course with must be done if the upgrade process to mayor alpine version does not!
# run the <code>mysql_upgrade -u root -p</code> script, providing the password or root, (from the new package version) against the old still-running database (mysql sheme). This will produce some error messages; however, the upgrade will succeed.
# Restart the service

If are unable to run ''mysql_upgrade'' because MySQL cannot start try run MySQL in safemode with <code>mysqld_safe --datadir=/var/lib/mysql/</code> command and then run the <code>mysql_upgrade -u root -p</code> script.

= Relevant important notes =

== File system notes about the databases managed ==

'''BTRFS Notes'''

If the database (in <code>/var/lib/mysql</code>) resides on a Btrfs file system, you should consider disabling '''Copy-on-Write''' for the directory before creating any database (schemes), after initialization you can enabled again. But .. on every database creation (scheme creation), you must disabled again, to avoid corrupted data.

'''ZFS Bock sizes'''

ZFS, unlike most other file systems, has a variable record size, or what is commonly referred to as a block size. By default, the recordsize on ZFS is 128KiB, which means it will dynamically allocate blocks of any size from 512B to 128KiB depending on the size of file being written. Most RDBMSes work in 8KiB-sized blocks by default. Although the block size is tunable for MySQL/MariaDB use an 8KiB block size by default.

It is usually desirable to tune ZFS instead to accommodate the databases, using a command such as <code>zfs set recordsize=8K /var/lib/mysql</code> (or change /var/lib/mysql to the mount point where /var/lib/mysql resides) and in the interest of saving memory, it is best to simply disable ZFS's caching of the database's file data and let the database do its own job with <code>zfs set primarycache=metadata /var/lib/mysql</code> (or change /var/lib/mysql to the mount point where /var/lib/mysql resides).

But beware, these kinds of tuning parameters are only if RDBMSes are setup in dedicated partitions, if your root and of course database are all in one partition, dont do that. Separate ones.

= See Also =

* [[PotsgreSQL]]
* [[Production LAMP system: Lighttpd + PHP + MySQL]]
* [[Alpine newbie developer]]
* [[Alpine newbie lammers]]

[[Category:Newbie]]
[[Category:Server]]
[[Category:Database]]
[[Category:Development]]
[[Category:Security]]
[[Category:Production]]

KVM

2020-03-02T11:09:49Z

Junialter: /* Networking */

[https://www.linux-kvm.org/page/Main_Page KVM] is an free and open source virtualization solution in a kernel module. Although it is often simply referred to as KVM, the actual hypervisor is [https://www.qemu.org QEMU]. QEMU runs from user-space, but can integrate with KVM, providing better performance by leveraging the hardware from kernel-space. QEMU can virtualize x86, PowerPC, and S390 guests, amongst others. [https://libvirt.org Libvirt] is a management framework that integrates with QEMU/KVM, [https://wiki.alpinelinux.org/wiki/LXC LXC], [https://wiki.alpinelinux.org/wiki/Xen_Dom0 Xen] and others.

== Installation ==
The following commands provide '''libvirt''' as well as '''QEMU with emulation for x86_64''' and '''qemu-img''', a necessary component for using various disk formats such as qcow2. Without qemu-img, only raw disks are available. It can also convert images between several formats like vhdx and vmdk.
{{Cmd|<nowiki># apk add libvirt-daemon qemu-img qemu-system-x86_64
# rc-update add libvirtd</nowiki>}}

== Networking ==
By default, libvirt uses NAT for VM connectivity. If you want to use the default configuration, you need to load the tun module.
{{Cmd|# modprobe tun}}

If you prefer bridging a guest over your Ethernet interface, you need to make a [https://wiki.alpinelinux.org/wiki/Bridge#Configuration_file bridge].

It's quite common to use bridges with KVM environments but when IPv6 is used, Alpine will assign itself a link-local address as well as an SLAAC address in case there's a router sending Router Advertisements. You don't want this because you don't want to have the KVM host an IP address in every network it serves to guests. Unfortunately you cannot just disable IPv6 for the bridge via sysctl because it might not be up at boottime when sysctl fires. There's a workaround though which is to put a post-up hook into the /etc/network/interfaces file like this:
auto brlan
iface brlan inet manual
bridge-ports eth1.5
bridge-stp 0
post-up ip -6 a flush dev brlan; sysctl -w net.ipv6.conf.brlan.disable_ipv6=1

== Management ==
For (non-root) management, you will need to add your user to the libvirt group.
{{Cmd|# addgroup user libvirt}}

You can use libvirt's virsh on the CLI. It can execute commands as well as run as an interactive shell. Read its manual page and/or use the "help" command for more info. Some basic commands are:

{{Cmd|<nowiki>virsh help
virsh list --all
virsh start $domain
virsh shutdown $domain</nowiki>
}}

The libvirt project provides a GUI for managing hosts, called virt-manager. It handles local systems as well as remote ones via SSH.
{{Cmd|<nowiki># apk add dbus polkit virt-manager
# rc-update add dbus</nowiki>}}

In order to use libvirtd to remotely control KVM over ssh PolicyKit needs a .pkla informing it that this is allowed.
Write the following file to /etc/polkit-1/localauthority/50-local.d/50-libvirt-ssh-remote-access-policy.pkla
{{Cmd|<nowiki>[Remote libvirt SSH access]
Identity=unix-group:libvirt
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes</nowiki>
}}

[[Category:Virtualization]]

KVM

2020-03-02T10:10:02Z

Junialter: /* Networking */

[https://www.linux-kvm.org/page/Main_Page KVM] is an free and open source virtualization solution in a kernel module. Although it is often simply referred to as KVM, the actual hypervisor is [https://www.qemu.org QEMU]. QEMU runs from user-space, but can integrate with KVM, providing better performance by leveraging the hardware from kernel-space. QEMU can virtualize x86, PowerPC, and S390 guests, amongst others. [https://libvirt.org Libvirt] is a management framework that integrates with QEMU/KVM, [https://wiki.alpinelinux.org/wiki/LXC LXC], [https://wiki.alpinelinux.org/wiki/Xen_Dom0 Xen] and others.

== Installation ==
The following commands provide '''libvirt''' as well as '''QEMU with emulation for x86_64''' and '''qemu-img''', a necessary component for using various disk formats such as qcow2. Without qemu-img, only raw disks are available. It can also convert images between several formats like vhdx and vmdk.
{{Cmd|<nowiki># apk add libvirt-daemon qemu-img qemu-system-x86_64
# rc-update add libvirtd</nowiki>}}

== Networking ==
By default, libvirt uses NAT for VM connectivity. If you want to use the default configuration, you need to load the tun module.
{{Cmd|# modprobe tun}}

If you prefer bridging a guest over your Ethernet interface, you need to make a [https://wiki.alpinelinux.org/wiki/Bridge#Configuration_file bridge].

It's quite common to use bridges with KVM environments but when IPv6 is there Alpine will assign itself a link-local address as well as an SLAAC address in case there's a router sending Router Advertisements. You don't want this because you don't want to have the KVM host an IP address in every network it serves to guests. Unfortunately you cannot just disable IPv6 for the bridge via sysctl because it might not be up at boottime when sysctl fires. There's a workaround though which is to put a post-up hook into the /etc/network/interfaces file like this:
auto brlan
iface brlan inet manual
bridge-ports eth1.5
bridge-stp 0
post-up ip -6 a flush dev brlan; sysctl -w net.ipv6.conf.brlan.disable_ipv6=1

== Management ==
For (non-root) management, you will need to add your user to the libvirt group.
{{Cmd|# addgroup user libvirt}}

You can use libvirt's virsh on the CLI. It can execute commands as well as run as an interactive shell. Read its manual page and/or use the "help" command for more info. Some basic commands are:

{{Cmd|<nowiki>virsh help
virsh list --all
virsh start $domain
virsh shutdown $domain</nowiki>
}}

The libvirt project provides a GUI for managing hosts, called virt-manager. It handles local systems as well as remote ones via SSH.
{{Cmd|<nowiki># apk add dbus polkit virt-manager
# rc-update add dbus</nowiki>}}

In order to use libvirtd to remotely control KVM over ssh PolicyKit needs a .pkla informing it that this is allowed.
Write the following file to /etc/polkit-1/localauthority/50-local.d/50-libvirt-ssh-remote-access-policy.pkla
{{Cmd|<nowiki>[Remote libvirt SSH access]
Identity=unix-group:libvirt
Action=org.libvirt.unix.manage
ResultAny=yes
ResultInactive=yes
ResultActive=yes</nowiki>
}}

[[Category:Virtualization]]