Create container

CONTAINER=wireguard

# Add ubuntu-minimal repository
lxc remote add --protocol simplestreams ubuntu-minimal https://cloud-images.ubuntu.com/minimal/releases/

# Create LXD container
#lxc launch ubuntu-minimal:lts ${CONTAINER}
lxc launch ubuntu-minimal:22.04 ${CONTAINER}

# update APT packages
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt update && apt -y dist-upgrade && apt -y autoremove"

# Install WireGuard
lxc exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt install -y wireguard iptables iputils-ping"

Configure UDP 4000 port forward to wireguard container

lxc config device add ${CONTAINER} udp51820 proxy listen=udp:0.0.0.0:51820 connect=udp:127.0.0.1:51820

Configure WireGuard

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

# /etc/wireguard/wg0.conf
[Interface]
Address = 192.168.8.1/24
ListenPort = 51820
PrivateKey = aI+ohS+Jd5T5lMIDXqvLwp8g6eT6U28bQVS43t5YaU8=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE     

[Peer]
PublicKey = yD3wRcoQ94Wu9o9WaLzjfA0S2IQrD91E8xxpSiMU6yE=
AllowedIPs = 192.168.8.2/32

Enable and start WireGuard systemd sercvice

# wg-quick up wg0
sudo systemctl enable --now wg-quick@wg0.service

WireGuard Home configuration

Copy profiles between LXD cluster nodes

lxc profile copy profile-name new-lxd-server:

Export all profiles

for PROFILE in $(lxc profile list --format json | jq -r '.[].name'); do
    lxc profile show ${PROFILE} > ${PROFILE}
done

Import profiles

for PROFILE in $(ls nic* disk*); do
    lxc profile create ${PROFILE} < ${PROFILE}
done

Links
https://ubuntu.com/blog/lxd-5-easy-pieces

Docs
https://registry.terraform.io/providers/terraform-lxd/lxd/latest/docs
https://registry.terraform.io/providers/terraform-lxd/lxd/latest/docs/resources/container

Create LXD container

# terraform init
# terraform apply -auto-approve
# terraform destroy -auto-approve


terraform {
  required_providers {
    lxd = {
      source = "terraform-lxd/lxd"
    }
  }
}

provider "lxd" {
  generate_client_certificates = true
  accept_remote_certificate    = true
}

resource "lxd_container" "lxd_container_u2004" {
  name  = "u2004"
  image = "ubuntu:20.04"

  config = {
    "boot.autostart" = true
  }

  limits = {
    cpu = 2
  }
}

resource "lxd_container" "lxd_container_u2110" {
  name = "u2110"
  image = "ubuntu:21.10"
  # image = "images:ubuntu-minimal:21.10" # fixme

  config = {
    "boot.autostart" = true
  }

  limits = {
    cpu = 2
  }
}

Links
https://dev.to/smashse/snap-lxd-terraform-3f0p

Since version 4.0 LXD also natively supports virtual machines and thanks to a built-in agent, they can be used almost like containers.

lxc image list images: | grep VIRTUAL-MACHINE

lxc launch images:ubuntu/21.04 vm2104 --vm
lxc launch images:ubuntu/21.04/cloud vm2104c --vm

Links
https://linuxcontainers.org/lxd/getting-started-cli/#launch-a-virtual-machine

# create container
lxc launch ubuntu:20.04 osc
lxc shell osc

# install OpenStack CLI
apt install -y python3-openstackclient python3-neutron-vpnaas python3-octaviaclient python3-barbicanclient
openstack complete | sudo tee /etc/bash_completion.d/openstack
source /etc/bash_completion

# configure connection
mkdir -p ~/.config/openstack
cat < ~/.config/openstack/clouds.yaml
clouds:
  dev-foo-app:
    auth:
      auth_url: https://keystone.service.example.com/v3
      application_credential_id: "xxxxxxxx"
      application_credential_secret: "xxxxxxxx"
    region_name: "eu-fra1"
    interface: "public"
    identity_api_version: 3
    auth_type: "v3applicationcredential"
EOF

echo export OS_CLOUD=dev-foo-app >> .bashrc

# test
export OS_CLOUD=dev-foo-app
openstack image list

Install LXD

Create Ubuntu minimal image container

lxc remote add --protocol simplestreams ubuntu-minimal https://cloud-images.ubuntu.com/minimal/releases/
lxc launch ubuntu-minimal:lts ults
lxc launch ubuntu-minimal:jammy u2204m
# lxc exec u2004m -- apt install -y dnsutils vim inetutils-ping

#!/bin/bash

if [ $# -lt 1 ]; then
  echo "Usage $0 "
  exit 1
else
  CONTAINER=$1
fi

OS_VERSION=${2-lts}

# create container
lxc launch ubuntu:${OS_VERSION} ${CONTAINER}
sleep 10

# deploy SSH key
lxc file push --uid 0 --gid 0 --mode 600 ~/.ssh/id_rsa.pub ${CONTAINER}/root/.ssh/authorized_keys

# configure http(s) proxy inside of container (if set on host)
[ -z ${http_proxy} ] || echo "export http_proxy=$http_proxy" | lxc shell ${CONTAINER} -- tee -a /etc/environment
[ -z ${https_proxy} ] || echo "export https_proxy=$https_proxy" | lxc shell ${CONTAINER} -- tee -a /etc/environment

# update APT repository
lxc exec ${CONTAINER} -- bash -c ". /etc/environment && apt update -qq && apt -qqq -y dist-upgrade"

# Optional: install applications
#lxc exec ${CONTAINER} -- bash -c ". /etc/environment && apt install -y haproxy"

Create default container