Bootstrap the hosts
The Raspberry Pi boards will be bootstrapped to run MicroVMs.
Components/setup TL;DR:
- Flintlock is the entrypoint API for creating MicroVMs. It wraps firecracker and containerd to provide a usable management experience.
- Firecracker is what will actually start MicroVMs as processes
- Containerd is used to provide root volumes and kernel binaries (from snapshots of images) to the MicroVMs, as well as to store state.
- Containerd uses devicemapper to store images and snapshots. In this build I
am using a development setup with thinpool storage. If you have spare disks (as in additional to any boot disk)
for each board, you could skip the
--devflag in the command below. - Each MicroVM is created with 2 network interfaces. One of those is a macvtap
interface in bridge mode which gives the MicroVM its network access. This is something
needs to be enabled in the host kernel. (Flintlock also allows for a standard bridge/tap
setup, but we are going with
macvtaphere.)
Install
Check that KVM is enabled:
sudo apt update
sudo apt install cpu-checker
kvm-ok
# INFO: /dev/kvm exists
# KVM acceleration can be used
Load the macvlan (macvtap) module:
modprobe macvlan
lsmod | grep macvlan
# macvlan 36864 1 macvtap
If you don't have the module (likely on ubuntu 22.04), install extra linux modules for pi:
sudo apt install linux-modules-extra-raspi
If modprobe macvlan errors with
modprobe: FATAL: Module macvlan not found in directory /lib/modules/5.15.0-1015-raspi
reboot the Pi and try again afterwards.
We will use a script to bootstrap the rest. Download it onto each board:
wget https://raw.githubusercontent.com/liquidmetal-dev/flintlock/main/hack/scripts/provision.sh
chmod +x provision.sh
Run the script:
sudo ./provision.sh all -y \
--dev \
--insecure \
--grpc-address 0.0.0.0:9090
For this we are not setting up the flintlock server with any sort of auth. Since it is running on your LAN this is not really a problem, but you can add some certs if you want later. Check out the flintlock security docs for instructions.
Output
Optional: VLAN
The above instructions give you the most basic setup. If you want more control and observability of the network that the MicroVMs are created in, you can copy Claudia's exact demo setup and create a VLAN.