Revisiting KVM support for Hosted GitHub Actions

[grahamc]

There are a lot of exciting developments in the operating space with unikernels, testing tools, networking labs, and more. It would be much easier to collaborate on and encourage new developers to explore this level of the system if GitHub Actions supported KVM.

What are the chances that Actions may support using KVM in the future?

[ethomson]

Hi @grahamc - great question. If we offered nested virtualization, would this be sufficient? Or is there more that we would need to provide to support you using KVM?

[ustiugov]

we would be interested in this feature very much as well!

[maxkratz]

Another +1; we would also be interested in this feature. Currently, it is the only reason we have to use a self-hosted runner.

[javierhonduco]

+1, it would be fantastic to have nested virtualization to run tests in VMs. Our use case is ensuring that our software works in various kernel versions

[obbardc]

nested virtualisation on the default runners would be great :-)

[jacob-carlborg-apoex]

FYI, hardware accelerated nested virtualization already works on regular macOS runners. GitHub also recently added support for hardware accelerated nested virtualization on larger runners [1]. But I would still like to have support for hardware accelerated nested virtualization on regular Linux runners.

[1] https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners

[alexellis]

Hey folks, hope you don't mind me chiming in here.

My team created actuated for self-hosted GHA within microVMs, we support launching VMs within CI, so long as Linux + KVM are all you need.

Launching Firecracker in a GitHub Action: https://twitter.com/welteki/status/1625487015650410496?s=20

Running a NixOS build in a GitHub Action https://twitter.com/welteki/status/1625419864029466624?s=20

Nested virtualisation extensions are required on the host, so this only works on x86_64 for now.

Feel free to reach out to me, I'm easy to find on the Internet.

[joshiste]

I managed to run KVM on the large hosted runners, but it requires some packages installed.
It would be awesome if they'd be included in the large runners by default and permissions are setup as needed.

      - name: Enable KVM group perms
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm
          sudo apt-get update
          sudo apt-get install -y libvirt-clients libvirt-daemon-system libvirt-daemon virtinst bridge-utils qemu qemu-system-x86
          sudo usermod -a -G kvm,libvirt $USER

[alexellis]

Some of what you're referring to there is about libvirt - not KVM. KVM is installed and working if /dev/kvm is available.

[joshiste]

yes your'e right. but would be nice to have it anyway

[nebuk89]

Good feedback @joshiste. I will have a chat with @samvantran about whether we get these added into the runner image :) feel free to open an issue in the https://github.com/actions/runner-images/ repo as well to ask for this and tag me!

[DavHau]

What's the progress on this?
The last response from github was two years ago and by now @ethomson doesn't seem to work for github anymore.

[JojOatXGME]

Would be nice if the runner-user would be part of the kvm group. This way, you wouldn't always have to re-configure the permissions when you want to use KVM. I also don't expect that applications which don't use KVM would be impacted by this change.

[JojOatXGME]

I noticed there is already actions/runner-images#8542 about this topic. Unfortunately, the ticket was closed as a duplicate for a reason I find a bit strange, and the other ticket was shortly afterward closed for a different reason which seems completely unrelated to the kvm group. I commented there as well: actions/runner-images#7670 (comment).