mrcharles
eeeca9bde9
Firecracker-class microVMs for dev: 13-microvm-setup.sh (idempotent installer) + microvm CLI + microvm-net.service (per-user tap pools, /30s, NAT). Debian 13 cloud assets in /usr/local/lib/microvm/base. Firecracker v1.16.1 installed but its KVM cap check is refused by this nested Westmere KVM; qemu -M microvm engine default, FC retry after #601. Details + UAT: https://projects.knownelement.com/issues/615
34 lines
1.2 KiB
Bash
Executable File
34 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# microvm-net.sh — host prep for microvm taps + NAT (idempotent; #615)
|
|
# Run by microvm-net.service at boot, and by 13-microvm-setup.sh.
|
|
set -euo pipefail
|
|
|
|
# tap pool: mv-<prefix><slot>; per-tap /30 inside the user's /24
|
|
POOLS=(
|
|
"reachableceo 172.30.0 r"
|
|
"reachableceo-offstage 172.30.1 o"
|
|
)
|
|
|
|
sysctl -qw net.ipv4.ip_forward=1
|
|
|
|
for entry in "${POOLS[@]}"; do
|
|
read -r user subnet prefix <<<"$entry"
|
|
for slot in 0 1 2 3; do
|
|
tap="mv-$prefix$slot"
|
|
ip tuntap add mode tap user "$user" dev "$tap" 2>/dev/null || true
|
|
ip addr replace "$subnet.$((4*slot+1))/30" dev "$tap"
|
|
ip link set "$tap" up
|
|
done
|
|
done
|
|
|
|
# NAT for both pools (iptables-nft; coexists with docker chains)
|
|
iptables -t nat -C POSTROUTING -s 172.30.0.0/23 -j MASQUERADE 2>/dev/null || \
|
|
iptables -t nat -A POSTROUTING -s 172.30.0.0/23 -j MASQUERADE
|
|
iptables -C FORWARD -s 172.30.0.0/23 -j ACCEPT 2>/dev/null || \
|
|
iptables -A FORWARD -s 172.30.0.0/23 -j ACCEPT
|
|
iptables -C FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null || \
|
|
iptables -A FORWARD -d 172.30.0.0/23 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
|
|
|
echo "microvm-net: taps + NAT ready"
|
|
ip -br addr | grep '^mv-'
|