Dealing with multi-user rights/rules when lauching VMs and Docker container

[J Dupont]

Hello everyone.
I hope you're all doing great wherever you are.

In my lab we recently bought a impressive machine (Threadripper PRO 3975WX + 3GPU) who came with Unraid OS 6.9.2 installed.
The requirements are set to run simultaneously several VM for VR and AI research purpose.

As not all our users are experienced technicians, I would like to be able to isolate the UnraidOs core settings to avoid any unwanted complications.
That said my users should still be able to start and stop pre-configured VMs as they like (Ideally with a dedicated webGui).

The idea here is to maximise uptime, while maintaining stability and usability.

If I can assign specific rights-rules (group policy) on VMs/dockers it would be even better.
As an example a user that did started the VM cannot stop it.
Another use case could be to restrict the rights to use a VM to a specific set of users.

I know that Big Tech cloud company are providing similar services.
How to do to implement such this on our machine ?
This could be a 3rd party tool, a first party app, a plugin or part of the unraid OS.

Sincerely

 

[wgstarks]

You should really post this in the feature requests section (to improve your chances that someone from LT will see it). I imagine if you search you’ll find that this is already requested though.

Edited July 21, 2022 by wgstarks

[J Dupont]

Hi @wgstarks,
Thanks for your suggestion.
A post has been created Shared in the Feature Requests sections.

Best
 

 

[JonathanM]

6 hours ago, J Dupont said:

How to do to implement such this on our machine ?

If you are willing to do the work, it's not super complicated to get the basic functionality you want.

 

Here is the rough outline of one way to accomplish it.

 

virsh commands can be used to start and stop VM's

scripts can watch for the presence of files in a share. public or user password protected.

when a script detects a named file or deletion of said file, it does an action

 

So, your user would connect to a share, touch a file, and the VM would start. When the vm is stopped from within the guest, the script could delete that file, or immediately start the vm again, depending on what the script writer desires. Standard unraid users could be defined to restrict access to the controlling folders. You could have a share per vm that the script would watch, and only users granted access to that share could create the magic file.

 

 

Yes, I agree it would be nice to have user level permissions in the management GUI, but that requires Limetech to make significant changes. My suggestion can be implemented NOW with a little scripting.