DevConf.CZ 2020

KubeVirt is a Kubernetes add-on, allowing to run and manage KVM machines.

It currently provides L2 connectivity to the guests in an arguably insane pipeline, including the host NIC, Linux bridge, veth pair into pod, an in-pod Linux bridge, and finally, a tap device.

In this talk we'd like to present a simpler, and more efficient method, connecting the VM directly to a host macvtap device, and the changes in qemu, libvirt and KubeVirt required to make it happen.

VirtIO proposes a common front end for device emulation in the context of virtual environments. In particular, Virtio-fs and Virtio-vsocket devices are very interesting for unikernels because they allow deploying instances with a simplified device model thus reducing the attack surface. Also, the use of these devices makes the kernel simpler. For example, when using the virtio-vsocket device, the TCP/IP Stack and the network driver are not needed anymore. During this session, we present the work done to support virtio-fs and virtio-vsocket in the context of Toro unikernel. We propose to show the benefits of using these devices not only in terms of performance against other virtio devices like virtio-net or virtio-blk but also in terms of the number of lines of code that you can throw away. We illustrate the approach by showing the work needed to port a web-server appliance that uses classical Berkeley sockets.

Do you remember Dolly the sheep? It was the first sheep successfully cloned from a somatic cell back in 1996. Everyone heard of Dolly at that time, but very few knew it was the only lamb born from 277 attempts.Cloning VMs is by far much easier than cloning sheep but there are nonetheless some details you should be aware of to have your cloned VMs run smoothly when started in the same network.
In this talk we will walk through the configuration items that should be kept unique in Linux based (virtual) machines and will investigate what may happen when their uniqueness is not enforced. Finally, we will show how to properly clone and prepare a VM using libvirt, in order to run cloned VMs side by side without any issue.

This talk will introduce GNOME Boxes and describe its newest and highly anticipated features such as GPU passthrough, Import/Export virtual machines, and remote connections with RDP.

Using AF_VSOCK you can easily allow applications in virtual machines and host to communicate with the POSIX Sockets API. The existing applications that use TCP/IP require few changes to be adapted. VSOCK is useful for lightweight VMs since TCP/IP stack and network interfaces are not involved.

virtio-vsock is a device supported by Linux and QEMU that provides AF_VSOCK address family. It requires a minimal configuration: the setup phase does not affect the guest running in the virtual machine at all, while in the host is only required to assign an ID to each guest. Common use cases are guest agents and host services.

Stefano will describe how to use AF_VSOCK with a virtio-vsock device, and how it is implemented in Linux and QEMU/KVM. He will do a live demo creating simple applications to communicate between host and guests.

Stefano will discuss the latest enhancements and the next challenges to improve virtio-vsock. He will also show useful tools and languages that support VSOCK.

Cloud-based services have introduced a new kind of workload composed mainly by short-lived, ephemeral processes. This is a significant departure from traditional virtualization workloads, where VMs (Virtual Machines) are expected to run uninterrupted for a large amount of time, even surviving Host migrations. New needs called for new optimization techniques, which in turn triggered the creation of specialized VMMs (Virtual Machine Monitors) and the adaptation of the existing ones, alongside with the development of new isolation techniques.

In this talk we'll touch the following topics:

- Quick overview of isolation techniques.
- Why lightweight VMs have different needs that traditional VMs
- Implementation of QEMU microvm
- The future
* Hotplug without ACPI (virtio-mem)
* Memory Encryption (SEV)
* HW-assissted Trusted Execution Environments (Enarx)

Do you need to go back in time to restore data from important VMs? oVirt
does not provide a time machine yet, but you can build one using oVirt
backup APIs.

Building on changed blocks tracking in Qemu, and upcoming Libvirt backup
API, oVirt will provide API to perform incremental backups. You will be
able to back up VMs more efficiently, downloading only changed blocks.
Incremental backup will be simpler and more reliable, not requiring
creating and deleting snapshots. Uploading will support on-the-fly
conversion from raw to qcow2 when restoring disks.

In this talk we will travel into the future, introducing the oVirt
incremental backup API for starting and ending backups, and the
ovirt-imageio API for downloading changed blocks. Finally, we will travel
back to the past, and show how to restore raw guest data into new disks.

Audience:
Backup vendors and virtualization administrators and developers, interested in utilizing future
incremental backup API.

Kata Containers is a way to run containers in individual virtual machines, in order to provide better isolation. Bringing this package to Fedora ran into a number of interesting issues, with enough moving parts to make things slow and difficult. This is a tale of bad interaction between the kernel (e.g. cgroupsv2), docker (e.g. docker vs. moby vs. podman) and Go (how languages with their own packaging system cause interesting issues for distros like Fedora).

Running many small virtual machines led us to also consider a "mini" version of qemu, i.e. a version stripped from anything that is unnecessary to run recent versions of Linux as guests.

How can we have compression and deduplication using VDO, the new Linux
compression layer? How can we use the latest and greatest disks drives?
We need to support disks with 4k block size.

oVirt is your best friend when you need to manage your virtualized data
center, but when it was created 10 years ago, support for 4k storage was
not considered. Can you teach an old dog new tricks? Sure you can!

In this talk we will share what we learned implementing 4k storage
support in oVirt. We will present the challenges teaching old and
stubborn code base to work with disks using 4k storage, and how we
addressed them; introducing storage format v5, moving from sectors to
bytes, detection of block size on file storage, improving testing in
storage area, adding new 4k APis to sanlock and improving qemu block
size detection.

oVirt Node had many layouts from the legacy node based on a mounted read-only ISO to read-write layers based on LVM snapshots. In this lecture, we will discuss our journey towards the next reincarnation of oVirt Node, which is based on Fedora-CoreOS. We will explain our motivation for the project, show how we used the standard tools from CoreOS to achieve it, the problems we encountered along the way (and how they were solved).