Передумови
Використовуйте виділений Linux evaluation host. Публічне self-hosted deployment має administrative access до KVM і libvirt, тому не починайте на production hypervisor і не expose на untrusted network.
Вимоги до хоста
| Requirement | Verification |
|---|---|
| KVM-capable Linux host | test -e /dev/kvm |
| Running libvirt daemon | virsh -c qemu:///system list --all |
| Docker with Compose v2 | docker compose version |
| Host image directory | /var/lib/libvirt/images exists and has enough space |
| Source-ISO directory | /opt/openfactory/iso exists, or set an explicit host path |
| Promoted-image directory | /var/lib/libvirt/images/.openfactory-golden exists if installer-only images will be used |
| Free capacity | Enough CPU, memory, and disk for the containers plus every concurrent guest |
qemu-img також потрібен на host, якщо promote installed QCOW2 у immutable golden-image path.
Access check
Підтвердіть, що operator може use Docker і Docker daemon може mount libvirt socket і /dev/kvm. Typical KVM permission repair:
sudo usermod -aG kvm "$USER"Log out and back in before retesting. Do not work around permission failure, роблячи /dev/kvm або libvirt socket world-writable.
Network and security decision
Before startup вирішіть, хто може reach host port 80. Default Compose file без TLS termination і intended для trusted evaluation network. Bind або filter port на host firewall; do not publish on internet.
Also decide:
- which operators may upload or launch images;
- how evaluation data will be removed afterward;
- whether guest networks may reach the host, local network, or internet;
- which source ISOs and golden images are licensed and approved for use.
Inputs to record
Record Git commit being evaluated, host distribution, Docker version, libvirt/QEMU versions, chosen directories, available capacity, and network exposure. Ці факти роблять failures reproducible і не дають mistake evaluation result for qualification of another host.