Isolate a VM Instance

This tutorial creates a VM instance that cannot reach the network, shows that the guest is cut off and then gives it access. It follows on from Getting Started.

Create an Isolated VM Instance

$ cubic create sandbox --image ubuntu --isolate

cubic show reports the state:

$ cubic show sandbox
Running:    no
Arch:       amd64
CPUs:       4
Memory:     2048 M
Disk Used:  408 M
Disk Total: 100 G
User:       alice
Isolated:   yes
SSH Port:   46831

Try to Reach the Network

$ cubic ssh sandbox
alice@sandbox:~$ curl -4 -sSI -m 8 https://ubuntu.com | head -1
curl: (6) Could not resolve host: ubuntu.com
alice@sandbox:~$ exit
logout

The guest cannot even resolve a name. Nothing leaves the VM instance, which is what you want while you try out software you do not trust. Your own connection still works, because cubic ssh reaches the guest on the loopback address of your host rather than over the network of the guest.

Give the VM Instance Access

$ cubic modify sandbox --no-isolate
info: Note: changes may require a restart to take effect.

The switch applies on the next start, so restart the VM instance:

$ cubic restart sandbox

cubic restart stops the VM instance and starts it again, which is what picks up the new setting.

Try Again

$ cubic ssh sandbox
alice@sandbox:~$ curl -4 -sSI -m 8 https://ubuntu.com | head -1
HTTP/2 200
alice@sandbox:~$ exit
logout

Same guest, same command, different answer. Isolation is a setting of the VM instance, not something you install inside it, so a guest can never turn it off for itself.

Next Steps

Delete the VM instance when you are done:

$ cubic delete sandbox

cubic create sandbox --image ubuntu --isolate and cubic modify sandbox --isolate set the same switch, before and after creation. The Security page explains what isolation protects and what it does not.