0

I have a Docker image based on Ubuntu Xenial. Inside that container I try to start FreeBSD VM by using Vagrant and VirtualBox (Note: host OS for Docker is VM based on Vagrant and VirtualBox). VM is being provisioned fine, however, Vagrant can not ssh there. I also tried ssh with debug within container:

# ssh -vvv -p 2222 vagrant@127.0.0.1
OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g  1 Mar 2016
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 19: Applying options for *
debug2: resolving "127.0.0.1" port 2222
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 127.0.0.1 [127.0.0.1] port 2222.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2
ssh_exchange_identification: read: Connection reset by peer

The same from host OS:

# ssh -p 1111 vagrant@127.0.0.1
ssh_exchange_identification: read: Connection reset by peer

I run container with the next parameters:

docker run --privileged -v /dev:/dev -p 1111:2222 vm:latest

I tried to run lightweight image like it was described here and everything started successfully.

Any suggestions/ideas regarding it?

  • Could you explain why you start a VM in a docker container? – 030 Oct 2 '17 at 10:23
  • Because I don't want to make garbage etc within my desktop OS and I don't have a hardware where I could test it. Therefore my approach was in using VM for this. – user54 Oct 2 '17 at 10:40
  • @030 It's actually a VM in a docker container in a VM. Just so you understand all of the gore. – Briansbum Oct 2 '17 at 13:54
  • @030 Yes, but why not run just a docker container? – 030 Oct 2 '17 at 14:03
0

It looks like issue with ssh timeout is related to nested visualization restrictions. Thus, despite of enabling visualization in BIOS VM in container will still not be provisioned. I found similar answer here.

Once I started Docker container on host OS, issue has gone away and VM successfully provisioned.

  • 4
    This answers boils down to "I've absolutely no idea why it doesn't work, but let's say its an obscure feature in the BIOS"... – Tensibai Oct 2 '17 at 12:57
  • It doesn't work because my case assumes nested virtualization usage. VBOX doesn't support nested virtualization, here is a ticket regarding it: virtualbox.org/ticket/4032 – user54 Oct 2 '17 at 14:33
  • And in this very specific ticket there's this comment: " Even with VirtualBox it is possible to execute VirtualBox without VT-x/AMD-V as a guest of VirtualBox with VT-x/AMD-V enabled." – Tensibai Oct 2 '17 at 15:15
  • Partly yes, it may be achieved by specifying 1 CPU only, but it doesn't guarantee that the rest of VM functional will be workable. In some cases depending on distro and architecture may be no issues but in others such restrictions like ssh access etc exist. – user54 Oct 2 '17 at 17:41
  • This doesn't make sense for me, VTX instructions are specific interruptions at processor level, this has nothing to do with the number of core (hopefully or hyperv first revision Wouldn't have existed, windows kernel at this time had no clue about those instructions but allowed 4vcpu vm) When playing Frankenstein nesting virtualization layers you have to learn deeply what it involves, there's no problem for me not understating it fully, it is a problem when you present it as a definitive answer on a question no one can reproduce because you eluded all versions of software and spec details – Tensibai Oct 2 '17 at 18:22

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.