Setting up LXD Lab with Ansible
In the world of local infrastructure automation and playbook testing, Vagrant/VirtualBox has long been the go-to combo. But what if you could replace all that overhead with something faster, lighter, and closer to real-world Linux systems? That’s exactly what I set out to do with lxd-lab - that uses Ansible and LXD to spin up containerised Linux environments for testing and development. No bloated VMs. No GUI. Just containers, automation, and security done right.
In a previous post, I shared how I streamlined SSH key management in LXD after migrating from Vagrant. This was a simple solution leveraging cloud-init. Later, I delved into the enhanced security of SSH certificate authentication. Despite its robust security, that process involved numerous manual, repetitive steps – particularly when adding new servers or clients.
This repetition sparked an idea: automate the entire lab setup and its intricate workflow. My tool of choice for this challenge? Ansible. After a couple of weeks of dedicated effort in my downtime, I'm excited to share the results of that automation journey in this article.
What is lxd-lab?
It provides a complete, Ansible-orchestrated lab environment built upon LXC containers. It utilises a dedicated lxd_manage Ansible role to automate the provisioning and configuration of these containers, delivering a highly efficient, secure, and modern workflow.
This solution empowers developers and DevOps teams to:
Validate Ansible playbooks within a truly representative environment.
Rapidly deploy ephemeral development and testing systems without the resource demands of traditional hypervisors like VirtualBox.
Implement SSH certificate-based authentication, enhancing security and streamlining connectivity by eliminating the need for manual host key management.
Upgrading My Workflow: Why LXD + Ansible Outperforms Vagrant
For many developers and DevOps professionals, Vagrant paired with VirtualBox has been the go-to for local development environments. However, the overhead of full virtualisation often translates to sluggish performance, high resource consumption, and a less-than-ideal user experience on contemporary Linux desktops.
Enter LXD and Ansible – a powerful duo that revolutionises local lab management. This pairing offers significant improvements in speed, efficiency, and security:
Boot Time
Slow (Spinning up full virtual machines)
Fast (Nearly instantaneous container starts)
Disk/CPU Usage
High (Each VM consumes dedicated resources)
Low (Containers share the host kernel efficiently)
SSH Setup
Often manual host key acceptance (TOFU) or basic key-based auth
Seamlessly integrated CA-signed certificates (Enhanced security, no manual key acceptance)
Native Integration
(VirtualBox is a hypervisor, not native to Linux's core container tech)
(LXD is built directly on Linux container technology, offering native performance)
Automation Flexibility
Limited to VM-specific commands and guest OS config
Full Ansible power, orchestrating everything from host to container configuration
Understanding the lxd-lab Workflow
The lxd-lab environment is orchestrated through a combination of key components designed for efficiency and security:
lxd_manage Ansible Role: Container Orchestration
The custom lxd_manage Ansible role is the engine behind container provisioning. It systematically performs the following actions:
Container Creation: Instantiates LXC containers using specified remote images, such as ubuntu:24.04.
Initial Configuration: Applies predefined profiles and configures hostnames and network settings.
Readiness Check: Waits for cloud-init to fully initialise within the container, ensuring it's ready for subsequent operations.
Secure Connectivity: SSH Certificate Authentication
A cornerstone of this lab's security is its reliance on SSH Certificate Authentication. Instead of traditional host key verification, a dedicated SSH Certificate Authority (CA) is used to sign all host keys.
This method delivers several key benefits:
Eliminates Manual Fingerprint Confirmation: You'll never encounter "Trust On First Use" (TOFU) prompts, streamlining initial connections.
Centralised Trust Management: Provides a single point of control for issuing, trusting, and revoking SSH host certificates.
Enhanced Scalability: Ideal for environments with frequently changing or numerous instances, offering a secure and efficient authentication mechanism for labs, server fleets, and CI/CD pipelines.
Getting Started
We can get up and running in a few steps:
Clone the repository
View its directory structure
Here is how the Ansible inventory (
inventory/hosts.yml) looks like. Of course, all of those variables and IP addresses can be changed to your liking as desired.
The main Ansible playbook (
lxd-lab.yml) is shown as below.
Given the self-documenting nature of Ansible playbooks, I'll skip a line-by-line explanation of each play and task.
Standing Up
Prerequisites
Ubuntu 24.04 LTS
LXD installed (with snapd) and properly setup
Ansible (version - 2.16.3)
Git to clone my GitHub repository - lxd-lab
Ansible Magic
Run the following command to run Ansible playbook lxd-lab.yml.
Verification Process
Let's verify if all those LXC containers are actually up and running with lxc list command first.
To verify the SSH certificate authentication workflow, go through the following process.
As you can see, there is no TOFU prompt upon the first login attempt and SSH authentication is successful with SSH certificates.
Teardown
After you have done with homelab testing and development works, it's also quite easy to clean up the environment with the following command.
Elevated Security: Leveraging an SSH Certificate Authority
This is a game-changer for lab security, often overlooked in many home setups. Instead of letting Ansible blindly trust new hosts or forcing you to manually manage host keys, this configuration implements a robust SSH Certificate Authority (CA):
Your CA signs each container's SSH host key.
The CA's public key is distributed to all clients.
/etc/ssh/ssh_known_hostsis configured with@cert-authority, establishing a trusted chain.
The outcome? No more annoying fingerprint prompts, no risk of Man-in-the-Middle (MITM) surprises, and an overall cleaner, more secure SSH experience.
Real-World Use Cases
lxd-lab isn't just for tinkering; it's a powerful tool for practical applications:
Develop and test Ansible roles efficiently, without the overhead of full virtual machines.
Validate playbooks in a controlled, repeatable lab environment, ensuring consistency.
Leverage it as a lightweight Continuous Integration (CI) testing environment for rapid feedback.
Replace heavy Vagrant/VirtualBox + VM setups for basic infrastructure simulation and proof-of-concept work.
Final Thoughts
If you're ready to modernise your local development workflow and move beyond the overhead of traditional virtual machines, lxd-lab is your answer.
It's a minimal, automated, and secure environment, built with the same robust tools you likely already use in production. With lxd-lab, you'll discover how effortlessly containers can become your new, more efficient VMs.
Last updated
Was this helpful?