Purpose and current status
Use a dedicated Linux VM for the practical classes. Several exercises change networking, privileges, authentication or disks; run them inside the lab VM. A VM that boots is not necessarily ready for all SIO exercises.
The existing course-image link below comes from 2025/26. The clean-install route is an alternative requiring the tools and checks below; it is not a preconfigured equivalent of the course image but may be better suited to your specific environment.
Choose the architecture first
| Host | Guest and approach | Status |
|---|---|---|
| Intel/AMD Windows, Linux or macOS | x86-64 Ubuntu; use the course image with matching architecture or a clean installation | Closest match to existing lab assumptions; still needs a 2026/27 smoke test |
| Apple Silicon macOS | ARM64 Ubuntu in UTM using Virtualize → Linux | Fast native route; some lab assets need adaptation and validation |
| Apple Silicon requiring an x86-64-only exercise | x86-64 course image in UTM using Emulate | Compatibility fallback; performance must be checked before class |
Do not choose Emulate merely because the host is an ARM Mac. Native ARM64 Linux uses virtualization; an x86-64 guest on that host requires emulation. Changing a disk file from VDI to QCOW2 does not change its CPU architecture. See the UTM Ubuntu guide.
Proposed starting allocation for validation: 2 vCPUs, 4 GB RAM and 30 GB of virtual disk, with additional room for container images and snapshots. This is a planning baseline, not a measured minimum. A desktop session is needed for browser exercises, Wireshark and other graphical tools.
Route A: existing course image
Download the course image.
Extract a .7z archive with a 7-Zip-compatible tool,
such as 7-Zip or Keka. The content is a file named sio-disk001.vdi, and gives
sio as both username and password. These details apply to that historical
image, not to a fresh installation or an unverified replacement image.
VirtualBox
Use VirtualBox on a supported host/guest pairing. For a disk-only distribution, create an Ubuntu VM and select the extracted disk as its existing boot disk. Match firmware (BIOS or UEFI) to the image; do not change firmware blindly when troubleshooting a boot failure.
UTM or QEMU/virt-manager
UTM is available from its official site. For an existing VDI, if the chosen hypervisor needs QCOW2, convert a copy:
qemu-img info sio-disk001.vdi
qemu-img convert -p -f vdi -O qcow2 sio-disk001.vdi sio.qcow2
qemu-img info sio.qcow2
The qemu-img utility is supplied with QEMU. Run the commands in the directory
containing the extracted disk, while that disk is not in use by a running VM.
Conversion changes the storage format only. In UTM, select Virtualize or Emulate
according to the architecture table, import the existing disk, and use the
firmware expected by the source image. In virt-manager, choose Import existing
disk image, select the disk and matching guest OS/architecture.
Route B: clean Ubuntu installation
The sio-vm option below requires Ubuntu 26.04 LTS. Download the chosen version from
Ubuntu releases for AMD64 or
Ubuntu ARM downloads for ARM64.
Verify the publisher’s checksum for the chosen image.
Create the VM, attach the installer ISO and install Ubuntu. If using Ubuntu
Server with the manual tool route, add a desktop environment for the graphical
exercises, using sudo apt install ubuntu-desktop or other of your liking.
The sio-vm route
installs a minimal desktop. Detach the installer ISO after installation.
Use the account created during installation; the old image’s sio credentials
will not apply.
Option 1: install course tools with sio-vm (Ubuntu 26.04)
Inside an existing Ubuntu 26.04 VM, open a terminal as your normal login account and run:
wget -qO- https://detiuaveiro.github.io/sio-vm/install.sh | sh
sio-vm install
The first command installs the sio-vm command; sio-vm install then installs
the course tools, Docker and Containerlab, enables the guest SSH server, and
adds your account to the Docker and Wireshark groups. It may ask for your sudo
password. It does not create the VM, set your password, or install lab
solutions. Follow the message at the end: reboot if Ubuntu requires it;
otherwise sign out and back in if your session needs the new group memberships.
The installer is public for inspection.
Later, run sio-vm install to apply changes to the signed course dependency
list. Run sio-vm upgrade to update the command itself; sio-vm status shows
the installed command version and dependency hash. These commands do not
perform a general Ubuntu upgrade. The course tool has passed an ARM64 check in
a VM that already had the packages; installation from a bare Ubuntu VM and
AMD64 remain to be tested. Complete the readiness checks below before relying
on it for a lab.
Option 2: install tools manually
Install tools inside the Linux guest. The list is a dependency inventory; exact versions and successful operation still need to be recorded in a qualified image.
| Area | Required capabilities / tools |
|---|---|
| General | Terminal, editor, Git, curl/wget, archive extraction, browser with developer tools; LibreOffice Calc or another way to use the awareness spreadsheet |
| Python and C | Python 3, pip and virtual environments, cryptography, guide-specific requirements, compiler/make, OpenSSL headers and libbsd-dev |
| Containers | Docker Engine and Compose v2 inside the guest; Containerlab for the firewall topology |
| Networking | iproute2, ping, DNS tools, SSH/Telnet clients, Wireshark, iptables/nftables as required by each exercise |
| Certificates and authentication | OpenSSL, XCA, KeePassXC/browser integration for the FIDO2 exercise; validate the authenticator workflow |
| Linux and storage | AppArmor tools, capabilities tools, EncFS, cryptsetup, filesystem utilities and GParted; a separate disposable virtual disk for the whole-disk exercise |
Use a separate Python environment per exercise and its requirements file. Follow the Docker Engine Ubuntu instructions for Engine plus the Compose plugin, and the Containerlab installation guide. Do not assume Docker Desktop on the physical host provides the Linux networking interfaces or privilege behavior expected inside this VM.
Install SSH/OTP server packages in the exercise container where the SSH guide specifies them. Do not replace the VM’s own login configuration with the exercise configuration. Docker access and packet-capture permissions need to be set up deliberately and checked using the student’s account.
Networking, isolation and storage
- Start with NAT/shared networking for package downloads. Use the guest browser for services inside the VM; expose a host port only when a particular exercise requires it. Avoid bridging deliberately vulnerable services onto campus Wi-Fi.
- Avoid sharing your home directory with the VM. If file exchange is needed, use a dedicated folder with disposable lab files.
- Take a snapshot or powered-off backup after setup and before exercises that change authentication, firewall rules or disk layout.
Author: Alfredo Matos, João Paulo Barraca.