# Out of Interest, Gentoo in KVM-QEMU

## judepereira

Hey there,

I've used gentoo for the first two years when I started using GNU/Linux, frankly, it was the best learning experience I've ever had. Now I use fedora, as I want things to just work and not break after 719 updates[which I did just yesterday on my fedora]. This is just for the ultimate gentoo server experience which I want to have...  :Smile: 

Here's what I want to do:

I want to build a very secure gentoo based server with all different servers[namely, vsftpd, apache, sshd, openvpn, mysqld]. And the best challenge of all, with SELinux and PaX complete support. So I'm running it in qemu-kvm, and I'm kinda stuck at the part of making a sane make.conf, as I don't know what CFLAGS to use for the qemu64 virtual processor... Anyone any ideas?

Could someone also post tips for my virtual gentoo server?

Thanks in advance,

J. Pereira

 :Very Happy: 

Oh, I forgot to mention, I'm compiling everything in a chrooted environment, and the host processor is and Intel E8500 Core2Duo.

----------

## poly_poly-man

First off, I would say XEN might be a better virtualizationtool for this situation, although your system will work well.

The qemu processor (as well as the XEN proc, etc.) will generally support the same stuff as your main box. You should use: -march=native -O2 -pipe for best results.

If you were to use qemu, I might suggest using distcc for performance help (instead of your chroot idea), but this might (keyword might) require use of more specific use flags. If you use XEN, it should give you like 95% of your main system's performance... no need for help

----------

## cach0rr0

 *poly_poly-man wrote:*   

> First off, I would say XEN might be a better virtualizationtool for this situation, although your system will work well.
> 
> The qemu processor (as well as the XEN proc, etc.) will generally support the same stuff as your main box. You should use: -march=native -O2 -pipe for best results.
> 
> If you were to use qemu, I might suggest using distcc for performance help (instead of your chroot idea), but this might (keyword might) require use of more specific use flags. If you use XEN, it should give you like 95% of your main system's performance... no need for help

 

Nowadays Qemu with KVM should give you as good or better performance than Xen. And the kicker, you don't have to run an ancient kernel with shit tonnes of special patches, much easier to manage. 

If it were Qemu alone VS Xen, I would agree with you that Xen would be a better option. 

Concur with the CFLAGS suggestion though, on both accounts. Far as distcc goes the gentoo docs explain relatively well what's involved.

----------

## Mad Merlin

As mentioned above, use qemu-kvm with -march=native and there's no need for distcc or other fluff.

----------

## judepereira

Thanks for the tip, appreciated very much, but I don't get this, how come compiling in the chroot wouldn't be better off than compiling in a qemu-kvm/XEN virtual machine? I mean, it's totally compiling using the native processor and not some other thing right? So it can do -j3 perfectly well....

----------

## poly_poly-man

 *judepereira wrote:*   

> Thanks for the tip, appreciated very much, but I don't get this, how come compiling in the chroot wouldn't be better off than compiling in a qemu-kvm/XEN virtual machine? I mean, it's totally compiling using the native processor and not some other thing right? So it can do -j3 perfectly well....

 it's harder, and if you include the time required to copy files over, etc., it more than makes up for any good it did...

----------

## judepereira

 *poly_poly-man wrote:*   

> it's harder, and if you include the time required to copy files over, etc., it more than makes up for any good it did...

 

Ummm, I haven't understood what you meant by "......the time required to copy files over, etc......". Care to elaborate on that a bit?

----------

## Shining Arcanine

 *judepereira wrote:*   

> Hey there,
> 
> I've used gentoo for the first two years when I started using GNU/Linux, frankly, it was the best learning experience I've ever had. Now I use fedora, as I want things to just work and not break after 719 updates[which I did just yesterday on my fedora]. This is just for the ultimate gentoo server experience which I want to have... 
> 
> Here's what I want to do:
> ...

 

While this does not answer your question, I suggest that you try running as ~arch (e.g. ACCEPT_KEYWORDS="~x86" in /etc/make.conf). I find that things often break when doing updates without that because people tend to add un-softmask software by adding it to package.keywords and that software updates usually depend on newer versions of dependencies that need to be in package.keywords, which causes updates to break. Running as ~arch allows portage to install the latest versions of software from the testing tree, so that does not happen and things do not break. The only difference between testing and stable is that the upstream developers say that the software is okay, but Gentoo's package maintainers have not yet finished examining the updates for bugs, which more of a formality than anything else.

In summary, there is no need for you to run Fedora, just run Gentoo as ~arch and things should not break when you do updates.

----------

## poly_poly-man

 *judepereira wrote:*   

>  *poly_poly-man wrote:*   it's harder, and if you include the time required to copy files over, etc., it more than makes up for any good it did... 
> 
> Ummm, I haven't understood what you meant by "......the time required to copy files over, etc......". Care to elaborate on that a bit?

 you emerge in a chroot, quickpkg it, copy it, and emerge the binpkg - will take longer than simply emrging on the vm.

----------

## Mad Merlin

 *judepereira wrote:*   

> Thanks for the tip, appreciated very much, but I don't get this, how come compiling in the chroot wouldn't be better off than compiling in a qemu-kvm/XEN virtual machine? I mean, it's totally compiling using the native processor and not some other thing right? So it can do -j3 perfectly well....

 

You can run SMP guests with KVM:

```

-smp n[,maxcpus=cpus][,cores=cores][,threads=threads][,sockets=sockets]

                set the number of CPUs to 'n' [default=1]              

                maxcpus= maximum number of total cpus, including       

                  offline CPUs for hotplug etc.                        

                cores= number of CPU cores on one socket               

                threads= number of threads on one CPU core             

                sockets= number of discrete sockets in the system

```

Try it both ways if you'd like (it'd be interesting to see the speed difference), but I suspect you'll find that overall you prefer to emerge in the VM, not in a chroot.

----------

## judepereira

Thanks for all your suggestions, by the way, I can just mount the qemu raw image, chroot into it, and then emerge stuff, so I'm not sure now why would I need to do a binpkg and some other stuff, cause then when I boot it directly, it will be in the same state as I updated it in the chroot environment. Will definitely post results as soon as I get it done, for right now, my exams(class 11 - sci) are up in about twenty days....

Thanks once again!!!

----------

## judepereira

 *Shining Arcanine wrote:*   

> While this does not answer your question, I suggest that you try running as ~arch (e.g. ACCEPT_KEYWORDS="~x86" in /etc/make.conf). I find that things often break when doing updates without that because people tend to add un-softmask software by adding it to package.keywords and that software updates usually depend on newer versions of dependencies that need to be in package.keywords, which causes updates to break. Running as ~arch allows portage to install the latest versions of software from the testing tree, so that does not happen and things do not break. The only difference between testing and stable is that the upstream developers say that the software is okay, but Gentoo's package maintainers have not yet finished examining the updates for bugs, which more of a formality than anything else.
> 
> In summary, there is no need for you to run Fedora, just run Gentoo as ~arch and things should not break when you do updates.

 

Ummmm, not to mention, yes I've always runned Gentoo with that entry in my make.conf, 'cause I've always wanted to stay on the bleeding edge, and my first time, I installed it from stage3 around three times or so, cause I always managed to screw up the system terribly, until I realized that pretty much everything can be fixed in gentoo...

Thanks!!!

----------

