[libvirt-users] It takes long time to start kvm virtual machine with nwfilter in docker container.

[John Y.]

1.  It takes minutes to start the virtual machine when I add "filterref" to
libvirt.xml and run command "virsh start  vm1".
It also takes minutes to destroy the virtual machine.

<interface type="bridge">
  <mac address="fa:16:3e:fa:f7:94"/>
  <target dev="tap69e948b0-bf"/>
  <source bridge="br02"/>
  <model type="virtio"/>
  <filterref filter="no-arp-spoofing">
    <parameter name="IP" value="192.168.2.2"/>
    <parameter name="MAC" value="fa:16:3e:fa:f7:94"/>
  </filterref>
</interface>

2. I found some logs in /var/log/libvirt/libvirtd.log


2019-11-04 03:46:18.495+0000: 15257: info : virFirewallApplyRule:815 :
Applying rule '/usr/sbin/ebtables --concurrent -t nat -D PREROUTING -i
tap69e948b0-bf -j libvirt-J-tap69e948b0-bf'
2019-11-04 03:46:18.495+0000: 15257: debug : virCommandRunAsync:2499 :
About to run /usr/sbin/ebtables --concurrent -t nat -D PREROUTING -i
tap69e948b0-bf -j libvirt-J-tap69e948b0-bf
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 24
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:18.496+0000: 15257: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:18.496+0000: 15257: debug : virCommandRunAsync:2502 :
Command result 0, with PID 16291
2019-11-04 03:46:19.242+0000: 15257: debug : virCommandRun:2350 : Result
invalid value 255, stdout: '' stderr: '2019-11-04 03:46:19.239+0000: 16291:
debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.239+0000: 16291: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.239+0000: 16291: debug : virFileClose:111 : Closed fd 24
Illegal target name 'libvirt-J-tap69e948b0-bf'.
'
2019-11-04 03:46:19.242+0000: 15257: debug : virFirewallApplyRuleDirect:704
: Ignoring error running command
2019-11-04 03:46:19.242+0000: 15257: debug : virFileClose:111 : Closed fd 25
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 28
2019-11-04 03:46:19.243+0000: 15257: info : virFirewallApplyRule:815 :
Applying rule '/usr/sbin/ebtables --concurrent -t nat -D POSTROUTING -o
tap69e948b0-bf -j libvirt-P-tap69e948b0-bf'
2019-11-04 03:46:19.243+0000: 15257: debug : virCommandRunAsync:2499 :
About to run /usr/sbin/ebtables --concurrent -t nat -D POSTROUTING -o
tap69e948b0-bf -j libvirt-P-tap69e948b0-bf
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 24
2019-11-04 03:46:19.243+0000: 15257: debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.244+0000: 15257: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.244+0000: 15257: debug : virCommandRunAsync:2502 :
Command result 0, with PID 16292
2019-11-04 03:46:19.990+0000: 15257: debug : virCommandRun:2350 : Result
invalid value 255, stdout: '' stderr: '2019-11-04 03:46:19.986+0000: 16292:
debug : virFileClose:111 : Closed fd 26
2019-11-04 03:46:19.986+0000: 16292: debug : virFileClose:111 : Closed fd 29
2019-11-04 03:46:19.986+0000: 16292: debug : virFileClose:111 : Closed fd 24
Illegal target name 'libvirt-P-tap69e948b0-bf'.
'
2019-11-04 03:46:19.990+0000: 15257: debug : virFirewallApplyRuleDirect:704
: Ignoring error running command
2019-11-04 03:46:19.990+0000: 15257: debug : virFileClose:111 : Closed fd 25
2019-11-04 03:46:19.990+0000: 15257: debug : virFileClose:111 : Closed fd 28

3. It works fine on hosts.
4. It works fine in other host's libvirt container.


How can I solve this problem?

Best regards,
John
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20191104/cfeef1e0/attachment.htm>