Cloonix runs virtual machines and containers on a Linux host and wires them together through Open vSwitch. You get the topology on a canvas in your browser, a root shell in any node, and a packet capture on any cable.
Get started Downloads What you can learn Documentation
AGPLv3 · version 100 · Linux host, any browser
kvm is a QEMU/KVM machine with its own kernel. cnt is a crun container sharing the host kernel. Both take the same commands and appear the same way on the canvas.
Links are Open vSwitch ports in a private net namespace. The packets are ethernet frames on a bridge, so routing daemons, DHCP and wifi emulation behave as they do on hardware.
Cloonix ships its own QEMU, Open vSwitch, crun and passt, and loads no library from the host. The host needs none of them.
The graphical interface is a web page served by cloonix itself. There is nothing to install on the machine you browse from.
https://127.0.0.1:4444, user nemo, password
nemoclown: not secret, they are in
/usr/libexec/cloonix/cloonfs/etc/cloonix.cfg, where they can be
changed.
An item owns one or more ports. Each port carries one connection, drawn as a line to a crossroad called a lan — which is an Open vSwitch bridge. Everything on this list plugs into everything else the same way.
Sixty FRR routers in a spider topology start in about a minute. Watch OSPF converge, cut a cable, watch it reconverge.
Double-click a green interface dot to capture it. The dissection engine is wireshark's, the viewer is a web page — no Qt, no X forwarding.
A topology is a python file of a few lines. Send it to somebody and they get the same network.
demos/ holds subject areas, and under each one python file per
demo: a running topology, every cloonix command printed as it is typed, and
the packet that shows the protocol at work.
cloonix | cloonix under itself | a2b c2c cnt cntkvmwifi cntwifi kvm kvmwifi limit mount nat nginx phy realnet snf systemd |
switching | one wire, several networks | ovn stp vlan vxlan |
routing | how a packet finds a way | babel batman bird frrmix frrspider frrspider_bgp isis |
address | an address, a name | dhcp dns ipv6 knot ntp unbound |
security | tunnels, filters, who is let in | arp ebpf ipsec nftables openvpn radius suricata tinc tls wg |
services | the machines in the middle | asterisk mqtt proxy smtp squid |
availability | staying up when one stops | cluster vrrp |
watching | what the path carries, and what it costs | perf |
wifi | the air, before the ip stack | cnt_open cnt_wpa2 cnt_wpa3 cnt_bridge cnt_roaming cnt_mesh, their kvm_ twins, cntkvm_home cntkvm_enterprise cntkvm_roaming cntkvm_monitor |
windows.py | a guest with no agent | the firewall rule everyone forgets |
freebsd.py | a guest that is not linux | the agent on a disc of its own |
cisco.py | a guest driven over its console | three ios-xe routers in ospf |
A tarball you extract as a normal user. Cloonix runs inside a container it brings with it. No root, nothing written outside the directory, and deleting the directory removes it.
Everything on this page works in the toy.
An installation under /usr/libexec/cloonix, done once as root.
Several users share it, each running their own networks.
One installation serves every user of the machine.
Cloonix inside its own container. No root, nothing installed; delete the directory and it is gone. Get started uses it.
The compiled run-time, installed once as root under
/usr/libexec/cloonix, for a machine several people share.
The source tree: cloonix, the demos, the image builders, the tests, the two books. It compiles from cloonix-targz_store-100.tar.gz, the open sources it rebuilds, extracted at its root first.
/var/lib/cloonix/bulk| cnt_bulk | 8 container images: alpine, debian trixie, ubuntu, rocky, fedora, arch, tumbleweed, and trixie with systemd |
| kvm_bulk | 15 machine images: the same seven distributions, and eight desktops |
| cnt_demo_bulk | 29 container images, one per subject of the demos: frr, wireguard, dns, dhcp, mqtt, … |
| kvm_demo_bulk | the machine image of the demos that run the cloonix client in a guest |