DEV Community: julio

Automating Ubuntu VM Creation with libvirt (KVM/QEMU) and Cloud-Init

julio — Sat, 06 Dec 2025 21:05:07 +0000

Ever needed to spin up multiple Ubuntu VMs quickly for testing, development, or learning? In this post, I'll walk you through a bash script that automates the entire process using libvirt/KVM and cloud-init.

What This Script Does

Downloads the official Ubuntu Noble cloud image automatically
Creates multiple VMs with customizable resources (memory, CPUs, disk)
Configures static IPs in the 192.168.122.2-254 range
Sets up SSH access via your GitHub public keys
Pre-installs useful packages including Docker, Python 3.13.7, and a minimal desktop environment (Openbox)

Prerequisites

Before running this script, make sure you have:

A Linux host with KVM/QEMU installed
libvirt and virt-install packages
cloud-localds (from cloud-image-utils package)
A bridge network interface (br0) configured
wget for downloading the cloud image

Below is the script

#!/bin/bash

usage() {
  cat <<EOF
Usage: $(basename "$0") [OPTIONS]

Launch Ubuntu VMs using libvirt/KVM with cloud-init configuration.

OPTIONS:
  -n, --num-vms NUM       Number of VMs to create (default: 1, max: 5)
  -m, --memory GB         Memory per VM in GB (default: 1, max: 8)
  -c, --cpus NUM          Number of CPUs per VM (default: 1, max: 2)
  -d, --disk-size GB      Disk size in GB (default: 10, min: 10)
  -g, --github USER       GitHub username for SSH key import (required)
  -h, --help              Show this help message and exit

EXAMPLES:
  $(basename "$0") -g myuser
  $(basename "$0") -n 3 -m 2 -c 2 -d 20 -g myuser
  $(basename "$0") --num-vms 5 --memory 4 --github myuser

NOTES:
  - VMs will be assigned IPs in the range 192.168.1.100-150
  - The script will automatically find available network octets
  - Ubuntu Noble cloud image will be downloaded if not present
EOF
  exit 0
}

NUM_VMS=1
MEMORY=1
CPUS=1
DISK_SIZE=10
GITHUB_USER=""

while [[ $# -gt 0 ]]; do
  case $1 in
    -n|--num-vms)
      NUM_VMS="$2"
      shift 2
      ;;
    -m|--memory)
      MEMORY="$2"
      shift 2
      ;;
    -c|--cpus)
      CPUS="$2"
      shift 2
      ;;
    -d|--disk-size)
      DISK_SIZE="$2"
      shift 2
      ;;
    -g|--github)
      GITHUB_USER="$2"
      shift 2
      ;;
    -h|--help)
      usage
      ;;
    *)
      echo "Error: Unknown option $1"
      echo "Use -h or --help for usage information."
      exit 1
      ;;
  esac
done

if [ -z "$GITHUB_USER" ]; then
  echo "Error: GitHub username is required for SSH key import."
  echo "Use -g or --github to specify your GitHub username."
  echo "Use -h or --help for usage information."
  exit 1
fi

BASE_IMG="noble-server-cloudimg-amd64.img"
IMG_URL="https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
IMG_DIR="/var/lib/libvirt/images"
SUBNET="192.168.122"
GATEWAY="$SUBNET.1"
DHCP_START=2
DHCP_END=254

if [ $NUM_VMS -gt $((DHCP_END - DHCP_START)) ]; then
  echo "Error: Max 5 VMs to stay within $DHCP_START-$DHCP_END range."
  exit 1
fi

if [ $MEMORY -gt 8 ]; then
  echo "Error: Max memory is 8GB"
  exit 1
fi

if [ $CPUS -gt 2 ]; then
  echo "Error: Max CPUs is 2"
  exit 1
fi

if [ $DISK_SIZE -lt 10 ]; then
  echo "Error: Disk size must be at least 10GB to accommodate base image."
  exit 1
fi

if [ ! -f "$IMG_DIR/$BASE_IMG" ]; then
  echo "Downloading Ubuntu Noble cloud image..."
  wget -O "$IMG_DIR/$BASE_IMG" "$IMG_URL"
  if [ $? -ne 0 ]; then
    echo "Error: Failed to download the base image from $IMG_URL"
    exit 1
  fi
  echo "Base image downloaded successfully."
fi

is_octet_available() {
  local octet=$1
  local ip="$SUBNET.$octet"

  for vm in $(virsh list --all --name 2>/dev/null); do
    if [ -n "$vm" ]; then
      if [ "$vm" = "server-$octet" ]; then
        return 1
      fi
    fi
  done

  if ping -c 1 -W 1 "$ip" &>/dev/null; then
    return 1
  fi

  return 0
}

AVAILABLE_OCTETS=()
for octet in $(seq $DHCP_START $DHCP_END); do
  if is_octet_available $octet; then
    AVAILABLE_OCTETS+=($octet)
  fi
  if [ ${#AVAILABLE_OCTETS[@]} -ge $NUM_VMS ]; then
    break
  fi
done

if [ ${#AVAILABLE_OCTETS[@]} -lt $NUM_VMS ]; then
  echo "Error: Not enough available network addresses. Found ${#AVAILABLE_OCTETS[@]}, need $NUM_VMS."
  echo "Available range is $SUBNET.$DHCP_START-$DHCP_END. Some addresses may already be in use."
  exit 1
fi

echo "Found ${#AVAILABLE_OCTETS[@]} available network addresses."

for i in $(seq 0 $(($NUM_VMS - 1))); do
  OCTET=${AVAILABLE_OCTETS[$i]}
  HOSTNAME="server-$OCTET"
  IMG="$IMG_DIR/vm-$OCTET.qcow2"
  SEED="$IMG_DIR/seed-$OCTET.iso"
  USER_DATA="user-data-$OCTET.yaml"
  NETWORK_DATA="network-data-$OCTET.yaml"

  qemu-img create -f qcow2 -F qcow2 -b "$IMG_DIR/$BASE_IMG" "$IMG" ${DISK_SIZE}G

  cat <<EOF > "$USER_DATA"
#cloud-config
hostname: $HOSTNAME

package_update: true
package_upgrade: true

users:
  - name: ubuntu
    shell: /bin/bash
    groups: [users, sudo]
    sudo: "ALL=(ALL) NOPASSWD:ALL"
    lock_passwd: false
    passwd: 123456789
    ssh_import_id:
      - gh:$GITHUB_USER

packages:
  - apt-transport-https
  - xorg
  - xterm
  - openbox
  - chromium-browser
  - spice-vdagent
  - xvfb
  - gdebi
  - make
  - wget
  - curl
  - build-essential

runcmd:
  - mkdir -p /home/ubuntu/.config/openbox
  - wget https://raw.githubusercontent.com/Mikachu/openbox/refs/heads/master/data/rc.xml -P /home/ubuntu/.config/openbox
  - sed -i '/<\/keyboard>/i \   <keybind key="C-A-t">\n     <action name="Execute">\n       <command>xterm</command>\n     </action>\n   </keybind>' /home/ubuntu/.config/openbox/rc.xml
  - sed -i '/<\/keyboard>/i \   <keybind key="C-A-c">\n     <action name="Execute">\n       <command>chromium</command>\n     </action>\n   </keybind>' /home/ubuntu/.config/openbox/rc.xml
  - sed -i '/<\/keyboard>/i \   <keybind key="C-A-g">\n     <action name="Execute">\n       <command>google-chrome</command>\n     </action>\n   </keybind>' /home/ubuntu/.config/openbox/rc.xml

  - sudo apt-get install -y make build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev xz-utils tk-dev liblzma-dev
  - cd /tmp/
  - wget https://www.python.org/ftp/python/3.13.7/Python-3.13.7.tgz
  - tar xzf Python-3.13.7.tgz
  - cd Python-3.13.7
  - sudo ./configure --enable-optimizations
  - sudo make -j\$(nproc)
  - sudo make altinstall
  - sudo ln -s /usr/local/bin/python3.13 /usr/local/bin/python
  - sudo ln -s /usr/local/bin/pip3.13 /usr/local/bin/pip

  - wget https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
  - sudo apt install ./google-chrome-stable_current_amd64.deb
  - sudo mkdir -p /home/ubuntu/.config/google-chrome/Crashpad

  - echo 'if [[ -z \$DISPLAY ]] && [[ \$(tty) = /dev/tty1 ]]; then exec startx; else export DISPLAY=:0; fi' | sudo tee -a /home/ubuntu/.profile
  - echo "alias displays='ps e | grep -Po " DISPLAY=[\\.0-9A-Za-z:]* " | sort -u'" >> /home/ubuntu/.bashrc

  - sudo groupadd -g 3001 docker
  - sudo usermod -aG docker ubuntu
  - curl -fsSL https://get.docker.com -o get-docker.sh
  - sudo sh get-docker.sh
  - sudo reboot
EOF

  cat <<EOF > "$NETWORK_DATA"
#cloud-config
network:
  version: 2
  ethernets:
    interface0:
      match:
        name: "en*s0"
      dhcp4: false
      addresses: [$SUBNET.$OCTET/24]
      routes:
        - to: default
          via: $GATEWAY
      nameservers:
        addresses: [8.8.8.8,8.8.4.4]
EOF

  echo "$(cat $USER_DATA)"
  echo "$(cat $NETWORK_DATA)"

  cloud-localds --network-config "$NETWORK_DATA" "$SEED" "$USER_DATA"

  rm "$USER_DATA"
  rm "$NETWORK_DATA"

  virt-install \
    --name "$HOSTNAME" \
    --memory $(( $MEMORY * 1024 )) \
    --vcpus $CPUS \
    --disk path="$IMG",bus=virtio,format=qcow2 \
    --disk path="$SEED",bus=virtio,format=raw \
    --network default \
    --os-variant ubuntu24.04 \
    --graphics spice,listen=0.0.0.0 \
    --channel spicevmc \
    --video virtio \
    --import \
    --noautoconsole

  echo "Launched VM $((i + 1)): $HOSTNAME with IP $SUBNET.$OCTET (disk size: ${DISK_SIZE}GB)"
done

echo "All $NUM_VMS VMs launched. Use 'virsh list --all' to see VMs, 'virsh start/stop/destroy <name>', 'virsh console <name>' for access. Clean up images/ISOs when done."

If you want to use another version of Python, you can find here and update the area into the runcmd that install the python

When the machine start you need to wait the cloud-init to configure everything, you can see the logs with sudo tail -f /var/log/cloud-init-output.log

The network that I used was this

<network>
  <name>default</name>
  <uuid>2dba4e25-611d-44db-9b54-ce38bd7c5a62</uuid>
  <forward mode="nat">
    <nat>
      <port start="1024" end="65535"/>
    </nat>
  </forward>
  <bridge name="virbr0" stp="on" delay="0"/>
  <mac address="ad:98:81:e2:9a:74"/>
  <dns>
    <forwarder addr="8.8.8.8"/>
    <forwarder addr="8.8.4.4"/>
  </dns>
  <ip address="192.168.122.1" netmask="255.255.255.0">
    <dhcp>
      <range start="192.168.122.2" end="192.168.122.254"/>
    </dhcp>
  </ip>
</network>

Thanks for read until there :)

Basic of Java

julio — Fri, 05 Dec 2025 16:01:12 +0000

Java is a popular and powerful programming language, created in 1995.

It is used for:

Mobile apps (specially android)
Desktop apps
Web apps
Web servers and app servers
Games
Database connection
etc.

why use?

Java works on different platforms (Windows, Mac, Linux, Raspberry PI, etc.), is one of the most popular programming languages in the world, have large demand in job market, it is beginner friendly, open source, free, secure, and powerful.

installation

Some system already have Java pre-installed, you can check with this command on your terminal

java --version

if you receive an error you can install for your system in this link oracle.com.

Note: In this tutorial i used the version 21

syntax

The first thing you need to know is that java is Object Oriented, then you will use classes in every file that you will create.

For that reason you need to know somethings:

The filename and class name need be the same
MyClass and myclass will be treated as different
The main method is required, is the start point
don't forget the ;
text only with double quotes "

Then, let's create Main.java and put this inside

public class Main {
  public static void main(String[] args) {
    System.out.println("Hello World");
  }
}

public is used for make the method accessible in any place
static is for make the method executable without the class instance
void means that the class don't return anything
the System.out.println is to print info at screen

Now you need to compile and run with these commands

javac Main.java # for compile
java Main # for run

# Output:
# Hello World

variables

You can create variables for store values of these types:

String - for text
byte - whole numbers from -128 to 127
short - whole numbers from -32,768 to 32,767
int - whole numbers from -2,147,483,648 to 2,147,483,647
long - whole numbers from -9,223,372,036,854,775,808 to 9,223,372,036,854,775,807
float - fractional numbers. Sufficient for storing 6 to 7 decimal digits
double - fractional numbers. Sufficient for storing 15 to 16 decimal digits
float - for floating point numbers
char - for single characters
boolean - for true or false

For declare a new variable you can use this syntax

// type variableName = value;
String str = "John";
byte bytes = 100;
short = shorting = 5000;
int interger = 100000;
long longer = 15000000000L
float floating = 4.2f;
double doubled = 19.99;
char singleLetter = "J";
boolean bool = true;

And if you want to create a variable that is read-only you can use the final keyword, like that

final int age = 18;
age = 19; // error!

We need to follow some rules for the variables names:

Only letters, digits, underscores and dollar signs
Can't start with digits
Can't have white spaces
If starts with a letter, need to be lowercase
case-sensitive (myVar and myvar are different variables)
Can't use reserved words (int, final, etc.)

Note: By convention, the final (constants) are usually written in uppercase (e.g. BIRTHYEAR), it is not required, you decide to use it or not

If you want to make your code more clean, you can define variables with the var keyword like that, without the typing, but in this case you need to specify the value.

var x = 5;

type casting

Sometimes you have a variable in one type, but you need to change to another, when you have a byte but you need a short, or when you have a long and need a int.

For convert from smaller type to a larger type: byte -> short -> char -> int -> long -> float -> double
You can use this logic

int myInt = 9;
double myDouble = myInt; // Automatic casting: int to double

System.out.println(myInt);    // Outputs 9
System.out.println(myDouble); // Outputs 9.0

For convert from larger type to a smaller type: double -> float -> long -> int -> char -> short -> byte

You can use this logic

double myDouble = 9.78d;
int myInt = (int) myDouble; // Manual casting: double to int

System.out.println(myDouble); // Outputs 9.78
System.out.println(myInt);    // Outputs 9

operators, conditions and loops

This three things are the same for a lot of languages, if you already have a good knowledge about programming logic, you already know this.

For the operators, we have the arithmetic operators: +, -, *, /, %, ++, --.

For the logical, we have: && (and), || (or), and ! (not).

We use double equal to equal and single equal for assign values, the comparison, not equal (!=), less than (<), greater than (>), etc. And we have the variations with the arithmetic.

And for conditions and loops we have these:

if - if true do it
if..else - if true do it, else do it
ternary operator - short version of if..else
switch - case 1 do it, case 2 do it, etc.
while - while true do it
do/while - do this while true
for - while and do/while alternative, better for range

Something important, if you want to stop a loop you can use break, if you want to go to the next loop step you can use continue.

arrays

Sometimes you need a list with String, int, or another type, for that you can use the arrays, for create a list with a max size.

String[] cars = {"Volvo", "BMW", "Ford", "Mazda"};

System.out.println(cars[0]) // accessing
System.out.println(cars[1]) // accessing

cars[2] = "Open"; // changing

// Output:
// Volvo
// BMW

You can too, create an empty array

String[] cars = new String[4];

cars[0] = "Volvo";
cars[1] = "BMW";
cars[2] = "Ford";
cars[3] = "Mazda";

System.out.println(cars[0]);

// Output:
// Volvo

You can iterate over the arrays.

String[] cars = {"Volvo", "BMW", "Ford", "Mazda"};

for (int i = 0; i < cars.length; i++) {
  System.out.println(cars[i]);
}

Our you can use the for-each loop, that will iterate over all the items of the array

String[] cars = {"Volvo", "BMW", "Ford", "Mazda"};

for (String car : cars) {
  System.out.println(car);
}

methods

This is how you can create blocks of code to run in different moments, they are known as methods or funtions.

public class Main {
  static void myMethod() {
    System.out.println("I just got executed!");
  }

  public static void main(String[] args) {
    myMethod(); //calling the method
  }
}

Different from another languages, in Java you can do method overloading.

int myMethod(int x)
float myMethod(float x)
double myMethod(double x, double y)

You can configure the same method for operate with different types.

classes

Like I said before, the Java is Object-Oriented, then every file will be composed of a class, and have some things that you need to know about classes.

the attributes are the class variables
the methods are the class actions
the public keyword is used for create classes/attributes/methods that can be accessed by anyone
the private keyword is used for create attributes/methods that can be only accessed inside the class
the protected keyword is used for create attributes/methods that can be accessed inside the class and by subclasses
the static keyword is for make the attribute/method accessible without the class instance
the abstract keyword is for classes/attributes/methods that only is used as a template
the constructor is a special method that is used into the object initialization (you can create using the class name)
the this keyword is used for access methods/attributes, good for when you have local and attributes with the same name
for access private attributes/methods you can use the get and set methods
the super keyword if used in subclasses for refer the parent class

// 7. 'abstract' keyword: this class is just a template
abstract class Template {

    // 1. Attributes (Class variables)
    // 3. 'public': accessible by anyone
    public String publicVar;

    // 4. 'private': accessible only inside this class
    private String privateVar;

    // 5. 'protected': accessible by subclasses
    protected String protectedVar;

    // 6. 'static': accessible without an object (shared by all)
    public static int staticCount = 0;

    // 8. Constructor: initializes the object
    public Template(String value) {
        // 9. 'this': refers to this specific object's attributes
        this.privateVar = value;

        // Increment static counter
        staticCount++;
    }

    // 2. Methods (Class actions)
    public void showMessage() {
        System.out.println("Action performed");
    }

    // 7. 'abstract' method: force subclass to create this action
    public abstract void requiredAction();

    // 10. 'get' method: allows reading private data
    public String getPrivateVar() {
        return this.privateVar;
    }

    // 10. 'set' method: allows writing private data
    public void setPrivateVar(String value) {
        this.privateVar = value;
    }
}

// Subclass needed to use the abstract template
class RealClass extends Template {

    public RealClass() {
        super("Initial Value"); // Calls parent constructor
    }

    public void requiredAction() {
        // 5. Can access protected variable here
        this.protectedVar = "I can see this";
    }
}

public class SimpleDemo {
    public static void main(String[] args) {
        // 6. Access static without creating object
        System.out.println(Template.staticCount);

        RealClass obj = new RealClass();

        // 10. Using set/get
        obj.setPrivateVar("New Value");
        System.out.println(obj.getPrivateVar());
    }
}

objects

When we create classes in Java, we can use these classes for create objects.

public class Main {
  int x = 5;

  public static void main(String[] args) {
    Main myObj = new Main();
    System.out.println(myObj.x);
  }
}

interfaces

An interface is a like an abstract class but only for group methods.

interface Animal {
  public void animalSound();
  public void run();
}

For use you need to add implements keyword before the class name and pass the interface name

class Pig implements Animal {
  public void animalSound() {
    // The body of animalSound() is provided here
    System.out.println("The pig says: wee wee");
  }
  public void run() {
    // The body of sleep() is provided here
    System.out.println("running!");
  }
}

anonymous

You can use an interface for create an anonymous class

interface Greetings {
    void sayHello()
}

public class Main {
  public static void main(String[] args) {
    // Anonymous class that implements Greeting
    Greeting greet = new Greeting() {
      public void sayHello() {
        System.out.println("Hello, World!");
      }
    };

    greet.sayHello();
  }
}

errors

If you want to handle errors in java, you can do that with the try...catch

try {
  //  Block of code to try
}
catch(Exception e) {
  //  Block of code to handle errors
}

finally

The finally can be used together with the try...catch for when you want to do something after the try...catch execution, independent of some error or success happened.

try {
  //  Block of code to try
}
catch(Exception e) {
  //  Block of code to handle errors
} finally {
  // Block of code to execute after error or success
}

multiple exceptions

Sometimes you want to catch multiple exceptions and run different code for each one, in that case you can use this

public class Main {
  public static void main(String[] args) {
    try {
      // Code
    } 
    catch (CustomException1 e) {
      // Custom Exception 1
    } 
    catch (CustomException2 e) {
      // Custom Exception 2
    } 
    catch (Exception e) {
      // Exception
    }
  }
}

custom error

If you have a custom error, you can throw it with the throwkeyword.

throw new CustomException("Message");

try-with-resources

When you are working with files, streams, or other resources, it is important to close them after use. If you forget to close the resource, it may keep using memory or even prevent you from opening the file again until the program ends.

For that reason since java 7 we can use this

import java.io.FileOutputStream;
import java.io.IOException;

public class Main {
  public static void main(String[] args) {
    // resource is opened inside try()
    try (FileOutputStream output = new FileOutputStream("filename.txt")) {
      output.write("Hello".getBytes());
      // no need to call close() here
      System.out.println("Successfully wrote to the file.");
    } catch (IOException e) {
      System.out.println("Error writing file.");
    }
  }
}

data structures

Sometimes we need to handle with complex data, for that reason we have the data structures, and in Java we have ArrayList, HashSet and HashMap.

We have other, but these are the more used.

array list

The ArrayList is a resizable array that can grow as needed, different from the Array that you know before.

import java.util.ArrayList;

public class Main {
  public static void main(String[] args) {
    ArrayList<String> cars = new ArrayList<String>();
    cars.add("Volvo");
    cars.add("BMW");
    cars.add("Ford");
    cars.add("Mazda");
    System.out.println(cars);
  }
}

// Output:
// [Volvo, BMW, Ford, Mazda]

hash set

A collection of unique elements - no duplicates are allowed.

import java.util.HashSet;

public class Main {
    public static void main(String[] args) {
        HashSet<String> cars = new HashSet<String>();
        cars.add("Volvo");
        cars.add("BMW");
        cars.add("Ford");
        cars.add("BMW");  // Duplicate
        cars.add("Mazda");
        System.out.println(cars);
    }
}

// Output:
// [Volvo, Mazda, Ford, BMW]

hash map

With that you can store key-value pairs, the keys need to be unique.

import java.util.HashMap;

public class Main {
  public static void main(String[] args) {
    // Create a HashMap object called capitalCities
    HashMap<String, String> capitalCities = new HashMap<String, String>();

    // Add keys and values (Country, City)
    capitalCities.put("England", "London");
    capitalCities.put("Germany", "Berlin");
    capitalCities.put("Norway", "Oslo");
    capitalCities.put("USA", "Washington DC");
    System.out.println(capitalCities);
  }
}

// Output:
// {USA=Washington DC, Norway=Oslo, England=London, Germany=Berlin}

All these data structures have it own methods, for add, delete and access the values.

advanced

Here are some extra things that is good to know.

wrapper classes

Wrapper classes provide a way to use primitive data types (int, boolean, etc..) as objects.

In cases where you want to use the ArrayList, HashSet or the HashMap you need to use it

ArrayList<int> myNumbers = new ArrayList<int>(); // Invalid
ArrayList<Integer> myNumbers = new ArrayList<Integer>(); // Valid

Follow this table

Primitive Data Type	Wrapper Class
byte	Byte
short	Short
int	Integer
long	Long
float	Float
double	Double
boolean	Boolean
char	Character

generics

If you don't know exactly the type or you want to receive different data types, you can use it

public class Box<T> {

    // Generic Attribute
    private T item;

    // Generic Method (Parameter)
    public void setItem(T item) {
        this.item = item;
    }

    // Generic Method (Return Type)
    public T getItem() {
        return item;
    }

    public static void main(String[] args) {
        // Usage with String
        Box<String> strBox = new Box<>();
        strBox.setItem("Hello");
        System.out.println(strBox.getItem());

        // Usage with Integer
        Box<Integer> intBox = new Box<>();
        intBox.setItem(123);
        System.out.println(intBox.getItem());
    }
}

threads

This is for when you need to run multiple things in the same time.

You can create a thread by extending the Thread class or implementing the Runnable

public class Main extends Thread {
  public void run() {
    System.out.println("This code is running in a thread");
  }
}

public class Main implements Runnable {
  public void run() {
    System.out.println("This code is running in a thread");
  }
}

For run a thread you need to use the start method that is extended from the Thread class

public class Main extends Thread {
  public static void main(String[] args) {
    Main thread = new Main();
    thread.start();
    System.out.println("This code is outside of the thread");
  }
  public void run() {
    System.out.println("This code is running in a thread");
  }
}

If it is a Runnable implementation you need to involve the obj into the Thread class and create the instance.

public class Main implements Runnable {
  public static void main(String[] args) {
    Main obj = new Main();
    Thread thread = new Thread(obj); // Generate the thread
    thread.start();
    System.out.println("This code is outside of the thread");
  }
  public void run() {
    System.out.println("This code is running in a thread");
  }
}

lambda

In the Java 8 was added the lambdas, that is a method that don't have a name, it is a shorthand for methods.

// (parameter1, parameter2) -> expression
(parameter1, parameter2) -> {
  // code block
  return result;
}

sorting

If you need to sort lists that have objects in it, you can use the Comparator and Comparable interfaces, where you will define what rules to use to sort the objects.

The first with the Comparator interface you will create a compare() method that need to return numbers.

Negative if the first object should go first in a list
Positive if the second object go first in a list
Zero if the order doesn't matter

class SortByYear implements Comparator {
  public int compare(Object obj1, Object obj2) {
    // Make sure that the objects are Car objects
    Car a = (Car) obj1;
    Car b = (Car) obj2;

    // Compare the objects
    if (a.year < b.year) return -1; // The first car has a smaller year
    if (a.year > b.year) return 1;  // The first car has a larger year
    return 0; // Both cars have the same year
  }
}

Comparator myComparator = new SortByYear();
Collections.sort(myCars, myComparator);

The Comparable interface is for the object specify it own sorting rule with the compareTo() method.

class Car implements Comparable {
  public String brand;
  public String model;
  public int year;

  // Decide how this object compares to other objects
  public int compareTo(Object obj) {
    Car other = (Car)obj;
    if(year < other.year) return -1; // This object is smaller than the other one
    if(year > other.year) return 1;  // This object is larger than the other one
    return 0; // Both objects are the same
  }
}

Setup Hashicorp Vault + Vault Agent on Docker Compose

julio — Mon, 17 Nov 2025 20:01:42 +0000

Files

First create a directory for put the config files, i will put in /opt/vault

Create the docker-compose.yml

services:
  init_vault:
    image: alpine:latest
    container_name: init_vault
    group_add:
      - 3001
    volumes:
      - vault-data:/vault/data:rw
      - certs:/tmp/certs/:rw
      - secrets:/secrets:rw
    command: >
      /bin/sh -c "apk add --no-cache openssl && \
      openssl req -x509 -newkey rsa:4096 -sha256 -days 365 \
      -nodes -keyout /tmp/certs/vault-key.pem -out /tmp/certs/vault-cert.pem \
      -subj '/CN=vault' \
      -addext 'subjectAltName=DNS:vault,IP:127.0.0.1' && \
      chown -R 100:3001 /vault/ /tmp/certs /secrets && \
      chmod -R 0750 /secrets/ && \
      exit 0"

  vault:
    image: "hashicorp/vault:latest"
    restart: unless-stopped
    container_name: vault
    ports:
      - "8201:8201"
      - "8200:8200"
    privileged: true
    depends_on:
      init_vault:
        condition: service_completed_successfully
    environment:
      VAULT_ADDR: "https://vault:8200"
      VAULT_CACERT: "/vault/certs/vault-cert.pem"
      VAULT_SKIP_VERIFY: true
    cap_add:
      - IPC_LOCK
    volumes:
      - vault-data:/vault/data:rw
      - ./agent-policies.hcl:/policies/agent-policies.hcl
      - ./vault-config.hcl:/vault/config/vault-config.hcl:ro
      - certs:/vault/certs:ro
    healthcheck:
      test:
        [
          "CMD-SHELL",
          'vault status -format=json 2>/dev/null | grep -q ''"sealed": false''',
        ]
      interval: 10s
      timeout: 5s
      retries: 1000
      start_period: 20s
    command: vault server -config=/vault/config/vault-config.hcl -log-level="info"

    # run docker exec vault vault status
    # then
    # run docker exec vault vault operator init -key-shares=3 -key-threshold=2

  vault-agent:
    image: "hashicorp/vault:latest"
    restart: unless-stopped
    container_name: vault-agent
    depends_on:
      vault:
        condition: service_healthy
    environment:
      VAULT_ADDR: "https://vault:8200"
      VAULT_CACERT: "/vault/certs/vault-cert.pem"
      VAULT_SKIP_VERIFY: true
    cap_add:
      - IPC_LOCK
    volumes:
      - certs:/vault/certs:ro
      - secrets:/secrets:rw
      - ./role-id.txt:/role-id:ro
      - ./secret-id.txt:/secret-id:ro
      - ./agent-config.hcl:/vault/config/agent-config.hcl:rw
      - ./templates:/templates:ro
    command: vault agent -config=/vault/config/agent-config.hcl -log-level="info"

volumes:
  certs:
  vault-data:
  secrets:
    driver: local
    driver_opts:
      type: none
      device: /path/to/mount/secrets/in/host
      o: bind

networks:
  default:
    name: network
    driver: bridge

The role-id.txt and the secret-id.txt will be created after, and you need to specify the device into the secrets volume.

The group_add 3001, is for my docker group, i use this gid for docker, if you don't do that, you can't access the envs files, when they are created.

Create the vault-config.hcl

api_addr                = "https://vault:8200"
cluster_addr            = "https://vault:8201"
cluster_name            = "vault_cluster"
disable_mlock           = true
ui                      = true

max_lease_ttl       = "2h"
default_lease_ttl   = "20m"

raw_storage_endpoint = "true"
disable_printable_check = "true"

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/vault/certs/vault-cert.pem"
  tls_key_file  = "/vault/certs/vault-key.pem"
}

storage "raft" {
  path    = "/vault/data"
  node_id = "vault_1"
}

the agent-config.hcl that will have all the vault agent configurations

auto_auth {
  method {
    type = "approle"
    config = {
      role_id_file_path = "/role-id",
      secret_id_file_path = "/secret-id",
      remove_secret_id_file_after_reading = false
    }
  }

  sink {
    type = "file",
    config = {
      path = "/tmp/token"
    }
  }
}

template_config {
  static_secret_render_interval = "1m"
  exit_on_retry_failure         = true
  max_connections_per_host      = 10
}

vault {
  address = "https://vault:8200"
  ca_cert = "/vault/certs/vault-cert.pem"
  tls_server_name = "vault"
  tls_skip_verify = true
}

template {
  source = "/path/to/source"
  destination = "path/to/destination"
  perms = "0750"
  error_on_missing_key = true
}

The last one is the agent-policies.hcl

path "kv/*" {
  capabilities = ["read"]
}

You can see here how to create your policies file

I recommend you to set the owner with chown for enable vault to read/write the files inside the container.

sudo chown -R 100:100 /path/to/vault/files

Running

Now you need to run the command for build the services docker compose up -d

After the vault container started, we need to exec some commands for init, unseal, enable the approle, and create the kv secrets that we need.

Init

For initialize the operator you need to run

docker exec vault vault operator init -key-shares=<number> -key-threshold=<number>

key-shares is the quantity of unseal key that will be generated
key-threshold is how many keys you need to use for unseal the vault (every time that you restart will be necessary to unseal)

==Store this keys into a secure place, without it, you can't unseal the vault==

For unseal the vault you need to run this command with one of the unseal keys n times.

docker exec vault vault operator unseal <key>

You will receive the Root Token too, this is necessary for login into the vault and make the changes.

After init the operator you need to login with your root token

docker exec vault vault login <token>

kv

The first thing that we need to do is to create our first secrets, then enable kv with

docker exec vault vault secrets enable -path=<path/to/secrets> kv-v2

You can create one for each service that you have, our a single for all the services.

For example, you can create with the name web-app, backend, or envs and put every service as a file inside the envs, you choose what is better for you.

I recommend you to add a prefix in all yours kv, like use kv/your-path this will facilitate the policies creation after.

After create the kv, now you need to add your secrets to it, you can use the UI or run this command

docker exec vault vault kv put -mount=path/to/secrets <name> key1=value1 key2=value2

If you want, I have a script for convert .env into a command for create all the secrets into the kv here

approle

This will be necessary to enable your vault agent to login into your vault.

For this, you need to write the policy that we created before (change my-policy)

docker exec vault vault policy write my-policy /policies/agent-policies.hcl

Then enable the approle auth method

docker exec vault vault auth enable approle

Then create the role for your agent to use, you can put any name to the role (change my-role)

docker exec vault vault write auth/approle/role/my-role \
    token_type=batch \
    token_ttl=20m \
    token_max_ttl=2h \
    token_policies="my-policy"

With this command you will save the role id inside a file to be used by the agent (remember to change the path to your vault files)

docker exec vault vault read -field=role_id auth/approle/role/agent/role-id > /opt/vault/role-id.txt

Other thing that we need is the secret id (remember to change the path to your vault files)

docker exec vault vault write -field=secret_id -f auth/approle/role/agent/secret-id > /opt/vault/secret-id.txt

Agent Template

Now, if you want to convert your secrets in a .env for example, you need to create a template with Consul Template markup.

You can learn more about here

With your templates created, add then to a folder and make the docker compose mount the templates inside the vault agent, they use .ctmpl and look like that

{{ with secret "kv/data/envs" -}}
KEY={{ .Data.data.KEY }}
{{- end }}

After do this, you need to recreate the vault-agent service into the docker.

And with this, now our .env will be generated inside a folder and we can access with the docker, if you mount the /secrets volume in /secrets, then you can access it on the host machine in the /secrets

Maybe you need to change the permissions for read the file, you need to test if your user that runs the docker can access the .env, with cat /path/to/env.

When i make this tutorial I have some problems in the UI, like the secrets are not showing, for this i created a new token and apply the default policies (remember to edit the policies and add the kv/*), should have this lines

path "kv/*" { 
  capabilities = ["create", "read", "update", "delete", "list"] 
}

And you can generate a new token with this command

docker exec vault vault token create -policy=default -ttl=2h