Create a VM

A classic VM is a normal Linux server: its own kernel, its own disk, cloud-init on first boot, and a console. If you have used a cloud instance before, none of this will surprise you.

Before you start you need a storage pool and at least one cached image. See First-run setup and Images and templates.

Create one

1. Open Instances under Compute and start a new VM.

2. Pick an image and size the machine.

   Choose a cached cloud image, then set vCPUs, memory, and disk size. The disk is a full copy of the image and can be larger than the original, so size it for what the workload will actually store.

3. Attach it to a network.

   Leaving the default is right for most hosts: the VM joins the host’s default VM network and gets an address from your existing DHCP server. To pin an address instead, switch the interface to a static IPv4 address and set the gateway and DNS servers yourself.

4. Set the first-boot configuration.

   Apply a template, or fill in the hostname, user, SSH keys, and password directly. This is what cloud-init consumes the first time the machine boots.

5. Boot it.

   Leave Boot after creation on and the machine starts as soon as it is built.

First-boot accounts

The form pre-fills a freshly generated password every time you open it, so two machines created from the defaults never share a credential. You can read it back later from the Cloud-init panel on the instance, so the randomness does not lock you out.

A few behaviours are worth knowing before you change the defaults.

• A root account with a password can log in over SSH. Leaving the root login option on Follow the image with a password set enables password login, because most cloud images ship configured to refuse it.
• An account with no password gets passwordless sudo. Granting sudo to an account that has no password to type would otherwise promise something the guest cannot deliver. An account with a password still has to enter it.
• Disabling root turns sudo on by default for the account you create in its place, since a machine with no root and no way to escalate is a machine you cannot administer.

Some combinations are refused outright rather than producing a machine nobody can reach: root disabled with no password and no SSH key, root disabled while also permitting root login, an empty password, and reusing a system account name such as daemon or www-data. Resetting a distribution’s own default user, such as debian or fedora, is allowed.

Auto update installs, but does not reboot

Turning on automatic updates installs upgrades on first boot and leaves the reboot to you. Rebooting on its own could cut first-boot setup off partway through, and there is no delay that is safe on every image.

Reaching the machine

The Instances list shows the VM moving to running, then reports the address it was observed at. SSH to that address with the credentials you configured.

If the state stays at booting, the machine started but was never seen on the network. Open its console from the VM detail page and look at the boot output. A VM that never appears is eventually marked failed rather than left claiming to be healthy.

Options worth knowing

Option	Where it lives	Why you would use it
Extra interfaces	Network, under Advanced	Attach a VM to more than one network
MAC, VLAN, MTU	Network, under Advanced	Pin an identity or match an existing segment
Anti-spoof and port isolation	Network, under Advanced	Restrict what the machine may send, and stop it talking to its neighbours
Data volumes	Additional hardware	Give the machine disks beyond its system disk
PCI passthrough	Additional hardware	Hand a host device to the guest
CPU pinning	Advanced	Bind vCPUs to specific host CPUs for latency-sensitive workloads
Disk I/O limits	Advanced	Cap IOPS and bandwidth so one machine cannot starve the others
Console auto-login	First-boot configuration	Get a console session without a password, useful when you are still setting up access

Additional hardware is a collapsed section at the foot of the form holding data volumes and PCI passthrough, the two choices most people never make. If a template pre-filled either of them, it opens by itself, so nothing is applied that you cannot see.

To create more than one machine at once, start from a template. The count lives there now, next to the template picker. See Images and templates.

Only one interface may carry a gateway

If you attach several interfaces, give exactly one of them a gateway. Two default routes make the guest pick one at random, which shows up later as a machine that is reachable only some of the time.

Changing a VM later

Shape changes such as vCPUs, memory, and network attachment are made while the machine is created or stopped, not while it runs. Anti-spoof and port isolation are the exception: those take effect immediately, without a reboot.