# show existing SELinux file context policies for libvirt files
sudo semanage fcontext --list | grep libvirt
  # /home/[^/]+/\.local/share/libvirt/images(/.*)?  all files  unconfined_u:object_r:svirt_home_t:s0
  # /var/lib/libvirt/images(/.*)?                   all files  system_u:object_r:virt_image_t:s0

# create a directory named "user" for image pool
mkdir -p "${HOME}/.local/share/libvirt/images/user"
# ensure SELinux label is svirt_home_t
ls -ldZ "${HOME}/.local/share/libvirt/images"

# for directories without file context policy (e.g. ~/.images), either add a policy:
sudo semanage fcontext --add --type svirt_home_t '/home/[^/]+/\.images(/.*)?'
restorecon -Rv "${HOME}/.local/share/libvirt/images"  # and restore from policy
# or set from a reference:
chcon --recursive --reference "${HOME}/.local/share/libvirt/images" "${HOME}/.images"
chcon --recursive --reference /var/lib/libvirt/images "/path/to/system/images"

# create a storage pool named "user"
virsh pool-define-as --name user --type dir --target "${HOME}/.images"
virsh pool-start user
virsh pool-autostart user
virsh pool-list --all --details
virsh pool-dumpxml user
# create a volume (--print-xml to only output XML)
virsh vol-create-as --pool user --name fedora.img --capacity 20G --allocation 20G --format raw
  # or --format qcow2
virsh vol-list --pool user --details  # list files in pool

# view default network definition
cat /usr/share/libvirt/networks/default.xml

systemctl help virtnetworkd.service
systemctl status virtnetworkd.service
sudo systemctl enable virtnetworkd.service --now # enable and start internal network
reboot now

ip addr show type bridge # check bridge virbr0
ip route # check route table entry for virbr0
firewall-cmd --get-active-zones # libvirt zone has interface virbr0
sudo firewall-cmd --zone=libvirt --list-all

ps -C dnsmasq -o pid,args # show dnsmasq processes
sudo less /var/lib/libvirt/dnsmasq/default.conf # show generated configuration for default network

# handle networks (assumes qemu:///system)
virsh net-list --all
virsh net-edit default
virsh net-start default
virsh net-autostart default
virsh net-dumpxml default
virsh net-dhcp-leases default # show DHCP leases on default network

# remove default network
virsh net-destroy default
virsh net-undefine default
sudo systemctl disable virtnetworkd.socket --now

<!-- isolated0.xml -->
<network>
  <name>isolated0</name>
  <uuid>7311c0e4-8905-4c76-9e4d-de567ffffe14</uuid>
  <bridge name='isolatedbr0' stp='on' delay='0'/>
  <mac address='00:16:3e:43:c9:08'/>
  <domain name='isolated0'/>
  <ip address='192.168.1.1' netmask='255.255.255.0'>
    <dhcp>
      <range start='192.168.1.128' end='192.168.1.254'/>
    </dhcp>
  </ip>
</network>

# generates a UUID
uuidgen
# generates a MAC (with OUI 00:16:3e, Xensource, Inc.)
printf '00:16:3e:%02x:%02x:%02x\n' $(( RANDOM % 128 )) $(( RANDOM % 256 )) $(( RANDOM % 256 ))

virsh net-define isolated0.xml
virsh net-start isolated0
ip -details address show dev isolatedbr0
virsh net-uuid isolatedbr0 # show UUID

# attach network isolated0 to a domain
#   (add --live to affect a running VM and --mac <MAC> to set MAC address)
virsh attach-interface --domain myvm --source isolated0 --type network --model virtio --config
virsh domiflist myvm # show virtual interfaces of VM
# detach network with the VM's interface MAC address
virsh detach-interface --domain myvm --type network --mac '52:54:00:47:2f:eb' --config

# show XML document of storage pool capabilities
virsh pool-capabilities

# list image pools
virsh pool-list --all --details # shows pool 'default' (on connection qemu:///system)
virsh pool-edit default # open XML document for pool "default"

# show existing SELinux file context policies for libvirt files
sudo semanage fcontext --list | grep libvirt
# add 
sudo semanage fcontext --add --seuser system_u --type virt_image_t "${HOME}/.local/share/libvirt/images(/.*)?"
cat /etc/selinux/targeted/contexts/files/file_contexts.local

# create a storage pool named "user"
virsh pool-define-as --name user --type dir --target ~/.local/share/libvirt/images
virsh pool-start --build user
virsh pool-autostart user
virsh pool-info user

sudo restorecon -RFv ~/.local/share/libvirt/images

virsh pool-destroy --pool user
virsh pool-undefine --pool user
virsh pool-list --all
rm ~/.local/share/libvirt/images/* # remove files manually

virsh help vol-create-as
virsh vol-list --pool user --details

virsh vol-create-as --pool user --name raw-disk.img --capacity 10G --format raw
virsh vol-info --pool user --vol raw-disk.img
virsh vol-delete --pool user --vol raw-disk.img

virsh vol-create-as --pool user --name qcow2-disk.qcow2 --capacity 10G --format qcow2 --allocation 0 --prealloc-metadata 
virsh vol-info --pool user --vol qcow2-disk.qcow2
virsh vol-delete --pool user --vol qcow2-disk.qcow2

virsh domblklist --details VMNAME

# convert disk to another format
qemu-img convert /path/to/qcow2-disk.qcow2 /path/to/raw-disk.img

virt-install \
  --connect 'qemu:///system' \
  --name fedora37 \
  --vcpus 2 --memory 4096 \
  --os-variant fedora37 \
  --os-type linux \
  --cdrom /var/lib/libvirt/images/Fedora-Workstation-37/Fedora-Workstation-Live-x86-64-37-1.1.iso \
  --import \
  --graphics vnc,listen=127.0.0.1,port=5901 \
  --noautoconsole \
  --disk '/var/lib/libvirt/images/fedora37.img/,size=16,format=raw' \
  --network bridge=virbr0

virsh dumpxml fedora37 > vm.xml # save VM as XML configuration
virsh define vm.xml             # create from XML configuration

virsh start fedora37
virsh console fedora37
virsh shutdown fedora37
virsh destroy fedora37 # forcefully shutdown

# top for VMs
virt-top

virsh destroy fedora37
virsh undefine --remove-all-storage fedora37

# URI format: driver[+transport]://[username@][hostname][:port]/[path][?extraparameters]
virsh --connect 'qemu+ssh://admin@homeserver/system' list --all
virsh --connect 'qemu+ssh://admin@homeserver/session' list --all
virt-manager --connect 'qemu+ssh://admin@homeserver/system' --no-fork

sudo dnf install openssh-server
systemctl enable --now sshd
mkdir ~/.ssh
vi ~/.ssh/authorized_keys # add public key of client user

sudo su - # become root

# show /sys/kernel/iommu_groups/<group>/devices/<domain>:<bus>:<slot>:<function>
find /sys/kernel/iommu_groups/ -type l | sort --version-sort
# show group of a specific device "0000:07:00.0"
readlink --canonicalize /sys/bus/pci/devices/0000\:07\:00.0/iommu_group/

# show PCI device codes and kernel drivers for each device (search for "VGA")
lspci -nnk | less
# show device codes and names for domain 7 (e.g. devices 00:07:0 00:07:1)
lspci -nn -s 7

sudo virt-host-validate qemu # ensure IOMMU is enabled by kernel
lsmod | grep vfio # check that vfio modules are loaded
dmesg | grep -i IOMMU # check for "DMAR: IOMMU enabled"
# check for errors in dracut services logs
journalctl --since today --unit 'dracut*' --grep 'fatal|error|fail'

# start a container
podman run --name CONTAINER_NAME ...

# generate service file "container-CONTAINER_NAME.service"
podman generate systemd --new --name CONTAINER_NAME --files \
  --env FOO=BAR \
  --restart-policy=always \
  --no-header
mv container-CONTAINER_NAME.service ~/.config/systemd/user/

# reload systemd and enable service
systemctl --user daemon-reload
systemctl --user enable container-CONTAINER_NAME.service
systemctl --user status SERVICE_NAME.service # inactive (dead) until next boot

podman stop CONTAINER_NAME; podman rm CONTAINER_NAME

# spawn a user session at boot
loginctl enable-linger $(id -u)
loginctl show-user $(id -u) # Linger=yes

# view logs
journalctl --user-unit=container-CONTAINER_NAME.service

# find a NodeJS image to use
podman search registry.access.redhat.com/node
podman search docker.io/library/node --list-tags --limit 10000 | less

podman pull docker://registry.access.redhat.com/ubi9/nodejs-16:1-71
ctr=$(buildah from registry.access.redhat.com/ubi9/nodejs-16:1-71)

# update configuration for interactive use
buildah config \
  --cmd '["/bin/bash", "-il"]' --entrypoint '' \
  --user root:root \
  --env HOME=/root \
  --workingdir /root/app-root/ \
  --env NODE_ENV=development \
  --env NPM_CONFIG_GLOBALCONFIG=/root/node_cache/npmrc \
  --env NPM_CONFIG_USERCONFIG=/root/node_cache/.npmrc \
  --env NPM_CONFIG_PREFIX=/root/node_cache \
  --env NPM_CONFIG_CACHE=/root/node_cache/.npm \
  --env NPM_CONFIG_INIT_MODULE=/root/node_cache/.npm-init.js \
  --env PATH='/root/node_cache/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' \
  ${ctr}

# update shell environment
buildah run ${ctr} bash -c 'cat > /etc/profile.d/extra.sh' \
<<<'export PATH=${PATH}:${NPM_CONFIG_PREFIX}/bin
alias ls="ls --color=auto -Ax --group-directories-first -1"
alias cp="cp -v"
alias rm="rm -Iv"'

buildah run ${ctr} ln -sf /usr/bin/python3 /usr/bin/python

buildah commit ${ctr} nodejs:latest
buildah rm ${ctr}

podman volume create node_cache  # will be mounted as cache directory
mkdir --mode=770 mydir           # will be mounted as working directory

# run rootless, as root in container
podman run -ti --name nodejs \
  --user 0:0 \
  -v node_cache:/root/node_cache/ \
  -v ${PWD}/mydir:/root/app-root/:Z \
  --publish 8888:8888 \
  nodejs:latest

podman start -ai nodejs  # re-start container with same state

# set container name from path, with replaced characters
NAME=$(echo ${PWD} | tr '/ ' '_-')

# start or run
if podman logs ${NAME} &>/dev/null
then
  podman start -ai ${NAME}
else
  podman run -ti --name ${NAME} \
    -v node_cache:/root/node_cache \
    -v ${PWD}:/root/app-root/:Z \
    localhost/nodejs:latest
fi

man 5 containers-transports

# copy local to remote
skopeo copy containers-storage:alpine:latest docker://docker.io/library/alpine:latest
# copy remote to local
skopeo copy docker://docker.io/library/alpine:latest containers-storage:alpine:latest
# copy remote to remote
skopeo copy \
  docker://quay.io/username/myimage:latest \
  docker://quay.io/username/myimage:v1.0.0 \
  --src-creds 'username:password' --dest-creds 'username:password'
  # or --creds='username:password'

# print image configuration
skopeo inspect --config docker://docker.io/library/hello-world:latest