I've been attempting to use the Google Cloud Platform's (GCP) layered virtualization capability, but I've had no luck. As per the GCP documentation, this is the process I followed:
Make a fresh disc using the Ubuntu 18 LTS image.
Apply the vmx license to a new image you create using the disc.
From the image, create a fresh VM instance.
Utilize the Ubuntu cpu-checker software to see if nested virtualization is supported.
gcloud compute disks create disk1 --image-project ubuntu-os-cloud --image-family ubuntu-1804-lts --zone us-central1-a
gcloud compute images create nested-vm-image --source-disk disk1 --source-disk-zone us-central1-a --licenses "https://compute.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx"
gcloud compute instances create firecracker --description firecracker --image nested-vm-image --zone us-central1-a --preemptible --machine-type e2-micro
Upon running the sudo kvm-ok command, I received this message:
INFO: Your CPU does not support KVM extensions
KVM acceleration can NOT be used
Troubleshooting
Ensure I am Using Haswell CPU
I used the gcloud compute instances describe command to confirm that my e2-micro VM was utilizing the Intel Haswell CPU, which is the minimum required for nested virtualization to work, according to the GCP documentation.
(base) ➜ ~ gcloud compute instances describe firecracker
No zone specified. Using zone [us-central1-a] for instance: [firecracker].
canIpForward: false
cpuPlatform: Intel Haswell
creationTimestamp: 'xxxxxxxxxxxxxxx'
deletionProtection: false
description: firecracker
disks:
- autoDelete: true
boot: true
deviceName: persistent-disk-0
guestOsFeatures:
- type: VIRTIO_SCSI_MULTIQUEUE
index: 0
interface: SCSI
kind: compute#attachedDisk
licenses:
- https://www.googleapis.com/compute/v1/projects/ubuntu-os-cloud/global/licenses/ubuntu-1804-lts
- https://www.googleapis.com/compute/v1/projects/vm-options/global/licenses/enable-vmx
mode: READ_WRITE
source: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/zones/us-central1-a/disks/firecracker
type: PERSISTENT
id: 'xxxxxxxxxxxxxxxxxxxxx'
kind: compute#instance
labelFingerprint: xxxxxxxxxxxxxx
machineType: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/zones/us-central1-a/machineTypes/e2-micro
metadata:
fingerprint: xxxxxxxxxxxxxxx
kind: compute#metadata
name: firecracker
networkInterfaces:
- accessConfigs:
- kind: compute#accessConfig
name: external-nat
natIP: xxxxxxxxxxx
networkTier: PREMIUM
type: ONE_TO_ONE_NAT
fingerprint: xxxxxxxxxxxxxx
kind: compute#networkInterface
name: nic0
network: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/global/networks/default
networkIP: xxxxxxxxxxxxxx
subnetwork: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/regions/us-central1/subnetworks/default
scheduling:
automaticRestart: false
onHostMaintenance: TERMINATE
preemptible: true
selfLink: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/zones/us-central1-a/instances/firecracker
serviceAccounts:
- email: xxxxxxxx@developer.gserviceaccount.com
scopes:
- https://www.googleapis.com/auth/devstorage.read_only
- https://www.googleapis.com/auth/logging.write
- https://www.googleapis.com/auth/monitoring.write
- https://www.googleapis.com/auth/pubsub
- https://www.googleapis.com/auth/service.management.readonly
- https://www.googleapis.com/auth/servicecontrol
- https://www.googleapis.com/auth/trace.append
startRestricted: false
status: RUNNING
tags:
fingerprint: xxxxxxxxxxxxxxxx
zone: https://www.googleapis.com/compute/v1/projects/xxxxxxxx/zones/us-central1-a
Tried Ubuntu 16.04 LTS
I also tried the same process with Ubuntu 16.04 LTS, according to the documentation, and received the same result as with Ubuntu 18.04 LTS.
Question
Question: How can I successfully spin up a GCP VM that supports nested virtualization? As far as I can tell, I followed the documentation's requirements, but couldn't get it to work.
I realize that the documentation doesn't explicitly indicate that they test nested virtualization with Ubuntu 18 LTS, but that doesn't necessarily mean it won't work.
