8 ms·

OSBoxes – Virtual Machines for VirtualBox and VMware

124 points by rayascott 11y ago

ComSubVie 11y ago
What's the benefit of OSBoxes in comparison to Vagrant and others?
- koolba 11y ago
  I have no clue what the advantages of OSBoxes are but I know what like about Vagrant: being able to see how the box is provisioned Rather than having a VM be some magical preconfigured black box, I can peak at the Vagrantfile to see all the steps to convert a stock Linux host into a database/cache/MQ/xyz. From a security perspective it's much nicer too as one can reduce the level of trust to: 1) Do I trust the root box? 2) Do I trust the subsequent commands?
  - stormbrew 11y ago
    Note that unless you rebuild the .box yourself, you probably still can't actually trust it any more than one of these. Building a .box with a fake Vagrantfile inside is not really difficult.
    - y4mi 11y ago
      obviously, he said so himself as well... but creating basic baseboxes is pretty easy with hashicorps packer and the bento packerfiles repo on github.
s0l1dsnak3123 11y ago
I use OSBoxes a lot when I want to quickly spin up a Linux distro I don't normally use. I really wish they'd clean up the design of their website though...
andybak 11y ago
What I really want is a good repository for ready to go 'application appliances' - something pretty much production ready - and in a format that I can deploy to a VPS as well as locally in a VM. I know there's a few of these in existence but the selection always seemed a bit patchy. Can anyone point me towards a good source?
- educar 10y ago
  If you are looking for full blown apps, there is cloudron.io. The app selection is a bit lacking (for example, no zulip).
- icebraining 11y ago
  There's Bitnami, but I frankly never used their 'appliances' on a long term basis.
  - andybak 11y ago
    I suppose this is an argument for 'recipe' over 'image'. You get to see how it was built and the chance to easily combine things from different recipes. The downside is everything then is fragmented depending on the builder you choose (ansible vs whatever).
- rwmj 11y ago
  Vagrant or virt-builder, I guess. With virt-builder we are trying to persuade Linux distros to start publishing high quality metadata about their cloud and VM images. Then virt-builder will just pull down those images automatically. It's been a very long and slow process. So far we can only support Ubuntu, OpenSuSE and (coming shortly) CentOS. Even though Red Hat sponsors the project, we've still not managed to get either Fedora or RHEL to publish metadata, after 2+ years of trying. But I believe this method of publishing metadata is the way to make the whole process sustainable long term. Edit: I should say I didn't read your original posting closely enough. It sounds as if you're looking for fully formed applications (eg. PostgreSQL or whatever) in appliances. Personally I wouldn't use an existing appliance like that for trust reasons (also the reason I'm not over-keen on half-baked Docker repositories), but with virt-builder you can do something like: $ virt-builder centos-7.2 --install postgresql-server which will provision a PostgreSQL VM on your local machine in a minute or two. (And yes, it does work as non-root)
nickysielicki 11y ago
Nothing makes me reach for my back button quite as quickly as a full-screen "9001 PPL LIKEZ US ON TEH FACEBOOK PLEASE DO IT TOO" modal.
- laumars 11y ago
  To be honest, the whole site is a homage to bad design clichés. It took me a great deal more patience to navigate around than I'd normally gift a website. But then I suspect this is aimed more at home users rather the enterprise, which might explain some of the gaudy gimmicks.
  - cookiemonsta 11y ago
    its just a wordpress theme... http://newsmartwave.net/wordpress/porto http://newsmartwave.net/wordpress/porto
    - laumars 11y ago
      Wordpress theme or not, it was still chosen over and above better designed themes in that collection. Plus some of the most distracting elements on that page are stuff they've added which wasn't in the theme's demo: * The main carousel images background is different from the background of the carousel itself. And since the images are quite small, it means the top section of the landing page looks disjoined when the browser window is sized to larger dimensions. * The main carousel has lots of sunken bevels which makes the logos and text harder to identify and read. I'm not generally a fan of flat design, but things like that are meant to be instantly identifiable; so they should either be flat, or have a larger unified border around them (badly explained, but something like how the social icons are often bevelled, or how Apple shapes iOS apps). * In the main title, "OSBoxes" has a different vertical alignment to the rest of the text. * In the main title, "VMWare" and "Virtualbox" scroll in a vertical "carousel", which is very distracting. * In the main title, the aforementioned vertical carousel has a blue background which is jarring against the rest of the white document. To be honest, between this and the previous two points, the dyslexic in me took a couple of attempts to parse the title. Which somewhat undermines the point of a title. * Downloading a VM image requires clicking the OS to reveal a hidden dropdown, then clicking the download link. Given the amount of whitespace in that list, they could have just had download icons in the list and saved users a pointless click. Given you only need a download icon and a www icon (icons people are already familiar with), you could still have a clean usable design. Anyway, I didn't mean this to slate the project based on the site. In fact normally I wouldn't be so critical of someone else's site. Perhaps it's just my dyslexia, or even just me specifically, but I really struggled to read through this site in ways that I don't on most other websites.
justsaysmthng 11y ago
That's really nice. I'll remember to use it whenever I need a linux box. However, I'm not that interested in a zillion flavors of Linux. I would be willing to pay for a box which comes with Windows and Visual Studio preinstalled (plus git, cmake, bash, etc): In other words, an up to date development machine based on WinXP, Vista, 8, X, etc. The main reason is that it takes hours if not an entire day to install all this stuff and run all the updates required to configure it. As a Mac user writing cross platform C++, I sometimes need to test my app on various flavors of windows and compile the code on various flavors of compilers. Keeping 30-50GB VM files ( for different versions of windows ) on my SSD is kind of wasteful, since I only need these boxes once every month or so.. I would easily part with $5 or $10 or even $20 (if it's very urgent) for an up-to-date box like that ..
- mhw 11y ago
  I got some of the way there with https://github.com/xdissent/ievms https://github.com/xdissent/ievms and https://github.com/xdissent/iectrl https://github.com/xdissent/iectrl but I'd really like a way to provision things on to the VM once it's up and running. Windows seems to suffer from a historical lack of attention to automated provisioning.
  - geerlingguy 11y ago
    Chef, Ansible, and I think even Puppet have varying levels of support for Windows provisioning.
  - stephengillie 11y ago
    Check out WinRM. You can manage every feature in 2012R2 through a remote Powershell session. Installing and uninstalling programs can be done this way.
  - kuma4 11y ago
    Sysprep is Microsoft's System Preparation Tool for Microsoft Windows operating system deployment. https://en.wikipedia.org/wiki/Sysprep https://en.wikipedia.org/wiki/Sysprep
- 11y ago
vhiremath4 11y ago
Docker Hub. That is all.
drcongo 11y ago
This website just looks like spam. Is it offering anything that vagrantbox.es doesn't?
- sciurus 11y ago
  I'm surprised vagrantbox.es is still around; Hashicorp had been offering box discovery themselves for a while now. https://atlas.hashicorp.com/boxes/search https://atlas.hashicorp.com/boxes/search
verytrivial 11y ago
We have no particular reason to trust any of these images though. An image built from a reproducible-build-only distribution (if that exists) would be valuable in this space.
- kevincox 11y ago
  Yeah, and the design of the sight also doesn't exactly make me want to trust it either. Not that relying on design is a good security measure.
- heavenlyhash 11y ago
  > An image built from a reproducible-build-only distribution (if that exists) Yeah, that'd be amazing. Know of any?
- AdmiralAsshat 11y ago
  Looking at the about page, this seems to be maintained by some college kid: http://www.osboxes.org/about/ http://www.osboxes.org/about/ So I'd be tempted to cut the guy some slack and assume that any oversights are from inexperience rather than malice.
gioele 11y ago
Nostalgia time. In 2005 the university of Bologna set up OSzoo.org: A repository of dozens of ready-to-run VMs for all majors free OSs: http://www.aboutus.com/Oszoo.org http://www.aboutus.com/Oszoo.org https://web.archive.org/web/20081206082548/http://www.oszoo.org/wiki/index.php/Category:OS_images https://web.archive.org/web/20081206082548/http://www.oszoo....
spy4hire 11y ago
Or just start from scratch with http://netboot.xyz http://netboot.xyz.
ronkwan 11y ago
is this spam? the page will try to you force you "like" or "share" their page on Facebook
Elrac 11y ago
Just to add another opinion: (1) I didn't notice anything particularly horrible about the Web site. If I manage to find stuff I need and don't have to wade through too much garbage, and no attempt is made to trick or trap or scam me, I feel I'm getting what I paid for and am happy enough. (2) I pulled a Linux off the site, installed it in VirtualBox, and it ran, smoothly, with no problem. Other offerings from other sites may have more/better features, but sometimes "good enough" is good enough. (3) The one thing I missed, here and elsewhere, is a Linux with built-in VM Extensions (spiffy display drivers, better mouse / cut&paste / file transfer support).
antihero 11y ago
What exactly does this offer over Vagrant or better yet having a single Docker VM and using containers??
- gnu8 11y ago
  These have my backdoors preinstalled.
opensourcedude 11y ago
Downloading untrusted images off of a site that you've never heard of before. What could possibly go wrong?
- brillenfux 11y ago
  "100000+ happy users […] can't be wrong", right?!
  - CameronBanga 11y ago
    Did you not see how many XP they have? Look at that XP.
    - nickpsecurity 11y ago
      I like how the JS was slow to load and all the numbers said zero for quite a while. Zero users, zero experience but download now!
- jaimex2 11y ago
  Do you want to get pwned? Because this is how you get pwned.
- jaseemabid 11y ago
  over http!
- Chris2048 11y ago
  "No NSA involvement. We promise."
- __jal 11y ago
  My first thought, too. The contact page and even the privacy policy is devoid of identifying information. And the faq (aside from a zero-content privacy comment) doesn't even mention malware concerns, which is a pretty weird elephant to ignore if you're on the up and up.
- finishingmove 11y ago
geerlingguy 11y ago
Are there any open source Packer build configurations or anything else that can be used to reproduce the base boxes from scratch? I wouldn't usually run a base box that I can't also see/use the automated build scripts for. For my own boxes (e.g. https://github.com/geerlingguy/packer-ubuntu-1604 https://github.com/geerlingguy/packer-ubuntu-1604), I make sure to prominently link to Packer configs licensed under the MIT license (based on Chef's Bento project (https://github.com/chef/bento) https://github.com/chef/bento)).
- Chris2048 11y ago
  This is a great idea! Packer script repo? Also, common repos can include open-builds..
seaghost 11y ago
Highly recommended. https://github.com/boxcutter https://github.com/boxcutter
deleted 11y ago
[deleted]
yo-code-sucks 11y ago
Ever hear of Vagrant?
AdmiralAsshat 11y ago
I've used the site in the past when trying to preview distros. Website design aside, it's not bad. I totally understand the security risk, but really, as long as you're only spending a few hours with the VM to see what the distro is like, exactly how much damage can you do in a VM anyway? I was thrilled to try FreeBSD with KDE pre-installed to play with, since I had tried previously to manually install a desktop environment on FreeBSD and borked it.
bobwaycott 11y ago
Safari on a very recent Mac, sitting in a café. 1. Click link 2. See blue spinner on white background 3. Think, "Hmm ... okay." 4. Wait 5 seconds 5. See a popup box asking me to "Like" this on FB 6. Stare in bewilderment, as I still haven't actually seen any content on the page 7. Click the X button to dismiss the Like spam 8. Back to staring at that blue spinner 9. Wait a couple more seconds, still no content 10. Close tab

124 points by rayascott 11y ago

ComSubVie 11y ago

What's the benefit of OSBoxes in comparison to Vagrant and others?

koolba 11y ago
I have no clue what the advantages of OSBoxes are but I know what like about Vagrant: being able to see how the box is provisioned Rather than having a VM be some magical preconfigured black box, I can peak at the Vagrantfile to see all the steps to convert a stock Linux host into a database/cache/MQ/xyz. From a security perspective it's much nicer too as one can reduce the level of trust to: 1) Do I trust the root box? 2) Do I trust the subsequent commands?
- stormbrew 11y ago
  Note that unless you rebuild the .box yourself, you probably still can't actually trust it any more than one of these. Building a .box with a fake Vagrantfile inside is not really difficult.
  - y4mi 11y ago
    obviously, he said so himself as well... but creating basic baseboxes is pretty easy with hashicorps packer and the bento packerfiles repo on github.

s0l1dsnak3123 11y ago

I use OSBoxes a lot when I want to quickly spin up a Linux distro I don't normally use. I really wish they'd clean up the design of their website though...

andybak 11y ago

What I really want is a good repository for ready to go 'application appliances' - something pretty much production ready - and in a format that I can deploy to a VPS as well as locally in a VM. I know there's a few of these in existence but the selection always seemed a bit patchy. Can anyone point me towards a good source?

educar 10y ago
If you are looking for full blown apps, there is cloudron.io. The app selection is a bit lacking (for example, no zulip).
icebraining 11y ago
There's Bitnami, but I frankly never used their 'appliances' on a long term basis.
- andybak 11y ago
  I suppose this is an argument for 'recipe' over 'image'. You get to see how it was built and the chance to easily combine things from different recipes. The downside is everything then is fragmented depending on the builder you choose (ansible vs whatever).
rwmj 11y ago
Vagrant or virt-builder, I guess. With virt-builder we are trying to persuade Linux distros to start publishing high quality metadata about their cloud and VM images. Then virt-builder will just pull down those images automatically. It's been a very long and slow process. So far we can only support Ubuntu, OpenSuSE and (coming shortly) CentOS. Even though Red Hat sponsors the project, we've still not managed to get either Fedora or RHEL to publish metadata, after 2+ years of trying. But I believe this method of publishing metadata is the way to make the whole process sustainable long term. Edit: I should say I didn't read your original posting closely enough. It sounds as if you're looking for fully formed applications (eg. PostgreSQL or whatever) in appliances. Personally I wouldn't use an existing appliance like that for trust reasons (also the reason I'm not over-keen on half-baked Docker repositories), but with virt-builder you can do something like: $ virt-builder centos-7.2 --install postgresql-server which will provision a PostgreSQL VM on your local machine in a minute or two. (And yes, it does work as non-root)

nickysielicki 11y ago

Nothing makes me reach for my back button quite as quickly as a full-screen "9001 PPL LIKEZ US ON TEH FACEBOOK PLEASE DO IT TOO" modal.

laumars 11y ago
To be honest, the whole site is a homage to bad design clichés. It took me a great deal more patience to navigate around than I'd normally gift a website. But then I suspect this is aimed more at home users rather the enterprise, which might explain some of the gaudy gimmicks.
- cookiemonsta 11y ago
  its just a wordpress theme... http://newsmartwave.net/wordpress/porto http://newsmartwave.net/wordpress/porto
  - laumars 11y ago
    Wordpress theme or not, it was still chosen over and above better designed themes in that collection. Plus some of the most distracting elements on that page are stuff they've added which wasn't in the theme's demo: * The main carousel images background is different from the background of the carousel itself. And since the images are quite small, it means the top section of the landing page looks disjoined when the browser window is sized to larger dimensions. * The main carousel has lots of sunken bevels which makes the logos and text harder to identify and read. I'm not generally a fan of flat design, but things like that are meant to be instantly identifiable; so they should either be flat, or have a larger unified border around them (badly explained, but something like how the social icons are often bevelled, or how Apple shapes iOS apps). * In the main title, "OSBoxes" has a different vertical alignment to the rest of the text. * In the main title, "VMWare" and "Virtualbox" scroll in a vertical "carousel", which is very distracting. * In the main title, the aforementioned vertical carousel has a blue background which is jarring against the rest of the white document. To be honest, between this and the previous two points, the dyslexic in me took a couple of attempts to parse the title. Which somewhat undermines the point of a title. * Downloading a VM image requires clicking the OS to reveal a hidden dropdown, then clicking the download link. Given the amount of whitespace in that list, they could have just had download icons in the list and saved users a pointless click. Given you only need a download icon and a www icon (icons people are already familiar with), you could still have a clean usable design. Anyway, I didn't mean this to slate the project based on the site. In fact normally I wouldn't be so critical of someone else's site. Perhaps it's just my dyslexia, or even just me specifically, but I really struggled to read through this site in ways that I don't on most other websites.

justsaysmthng 11y ago

That's really nice. I'll remember to use it whenever I need a linux box. However, I'm not that interested in a zillion flavors of Linux. I would be willing to pay for a box which comes with Windows and Visual Studio preinstalled (plus git, cmake, bash, etc): In other words, an up to date development machine based on WinXP, Vista, 8, X, etc. The main reason is that it takes hours if not an entire day to install all this stuff and run all the updates required to configure it. As a Mac user writing cross platform C++, I sometimes need to test my app on various flavors of windows and compile the code on various flavors of compilers. Keeping 30-50GB VM files ( for different versions of windows ) on my SSD is kind of wasteful, since I only need these boxes once every month or so.. I would easily part with $5 or $10 or even $20 (if it's very urgent) for an up-to-date box like that ..

mhw 11y ago
I got some of the way there with https://github.com/xdissent/ievms https://github.com/xdissent/ievms and https://github.com/xdissent/iectrl https://github.com/xdissent/iectrl but I'd really like a way to provision things on to the VM once it's up and running. Windows seems to suffer from a historical lack of attention to automated provisioning.
- geerlingguy 11y ago
  Chef, Ansible, and I think even Puppet have varying levels of support for Windows provisioning.
- stephengillie 11y ago
  Check out WinRM. You can manage every feature in 2012R2 through a remote Powershell session. Installing and uninstalling programs can be done this way.
- kuma4 11y ago
  Sysprep is Microsoft's System Preparation Tool for Microsoft Windows operating system deployment. https://en.wikipedia.org/wiki/Sysprep https://en.wikipedia.org/wiki/Sysprep
11y ago

vhiremath4 11y ago

Docker Hub. That is all.

drcongo 11y ago

This website just looks like spam. Is it offering anything that vagrantbox.es doesn't?

sciurus 11y ago
I'm surprised vagrantbox.es is still around; Hashicorp had been offering box discovery themselves for a while now. https://atlas.hashicorp.com/boxes/search https://atlas.hashicorp.com/boxes/search

verytrivial 11y ago

We have no particular reason to trust any of these images though. An image built from a reproducible-build-only distribution (if that exists) would be valuable in this space.

kevincox 11y ago
Yeah, and the design of the sight also doesn't exactly make me want to trust it either. Not that relying on design is a good security measure.
heavenlyhash 11y ago
> An image built from a reproducible-build-only distribution (if that exists) Yeah, that'd be amazing. Know of any?
AdmiralAsshat 11y ago
Looking at the about page, this seems to be maintained by some college kid: http://www.osboxes.org/about/ http://www.osboxes.org/about/ So I'd be tempted to cut the guy some slack and assume that any oversights are from inexperience rather than malice.

gioele 11y ago

Nostalgia time. In 2005 the university of Bologna set up OSzoo.org: A repository of dozens of ready-to-run VMs for all majors free OSs: http://www.aboutus.com/Oszoo.org http://www.aboutus.com/Oszoo.org https://web.archive.org/web/20081206082548/http://www.oszoo.org/wiki/index.php/Category:OS_images https://web.archive.org/web/20081206082548/http://www.oszoo....

spy4hire 11y ago

Or just start from scratch with http://netboot.xyz http://netboot.xyz.

ronkwan 11y ago

is this spam? the page will try to you force you "like" or "share" their page on Facebook

Elrac 11y ago

Just to add another opinion: (1) I didn't notice anything particularly horrible about the Web site. If I manage to find stuff I need and don't have to wade through too much garbage, and no attempt is made to trick or trap or scam me, I feel I'm getting what I paid for and am happy enough. (2) I pulled a Linux off the site, installed it in VirtualBox, and it ran, smoothly, with no problem. Other offerings from other sites may have more/better features, but sometimes "good enough" is good enough. (3) The one thing I missed, here and elsewhere, is a Linux with built-in VM Extensions (spiffy display drivers, better mouse / cut&paste / file transfer support).

antihero 11y ago

What exactly does this offer over Vagrant or better yet having a single Docker VM and using containers??

gnu8 11y ago
These have my backdoors preinstalled.

opensourcedude 11y ago

Downloading untrusted images off of a site that you've never heard of before. What could possibly go wrong?

brillenfux 11y ago
"100000+ happy users […] can't be wrong", right?!
- CameronBanga 11y ago
  Did you not see how many XP they have? Look at that XP.
  - nickpsecurity 11y ago
    I like how the JS was slow to load and all the numbers said zero for quite a while. Zero users, zero experience but download now!
jaimex2 11y ago
Do you want to get pwned? Because this is how you get pwned.
jaseemabid 11y ago
over http!
Chris2048 11y ago
"No NSA involvement. We promise."
__jal 11y ago
My first thought, too. The contact page and even the privacy policy is devoid of identifying information. And the faq (aside from a zero-content privacy comment) doesn't even mention malware concerns, which is a pretty weird elephant to ignore if you're on the up and up.
finishingmove 11y ago

geerlingguy 11y ago

Are there any open source Packer build configurations or anything else that can be used to reproduce the base boxes from scratch? I wouldn't usually run a base box that I can't also see/use the automated build scripts for. For my own boxes (e.g. https://github.com/geerlingguy/packer-ubuntu-1604 https://github.com/geerlingguy/packer-ubuntu-1604), I make sure to prominently link to Packer configs licensed under the MIT license (based on Chef's Bento project (https://github.com/chef/bento) https://github.com/chef/bento)).

Chris2048 11y ago
This is a great idea! Packer script repo? Also, common repos can include open-builds..

seaghost 11y ago

Highly recommended. https://github.com/boxcutter https://github.com/boxcutter

deleted 11y ago

[deleted]

yo-code-sucks 11y ago

Ever hear of Vagrant?

AdmiralAsshat 11y ago

I've used the site in the past when trying to preview distros. Website design aside, it's not bad. I totally understand the security risk, but really, as long as you're only spending a few hours with the VM to see what the distro is like, exactly how much damage can you do in a VM anyway? I was thrilled to try FreeBSD with KDE pre-installed to play with, since I had tried previously to manually install a desktop environment on FreeBSD and borked it.

bobwaycott 11y ago

Safari on a very recent Mac, sitting in a café. 1. Click link 2. See blue spinner on white background 3. Think, "Hmm ... okay." 4. Wait 5 seconds 5. See a popup box asking me to "Like" this on FB 6. Stare in bewilderment, as I still haven't actually seen any content on the page 7. Click the X button to dismiss the Like spam 8. Back to staring at that blue spinner 9. Wait a couple more seconds, still no content 10. Close tab