Lima VM using standard Ubuntu image - Slow DNS Resolution

[jasperf]

Running Lima Ubuntu standard version with latest Lima installed on macOS using Homebrew

limactl -v
limactl version 0.23.2
limactl list
NAME      STATUS     SSH               VMTYPE    ARCH      CPUS    MEMORY    DISK      DIR
ubuntu    Running    127.0.0.1:2022    qemu      x86_64    4       4GiB      100GiB    ~/.lima/ubuntu

I added some more port forwarding with edit

ssh:
  localPort: 2022
portForwards:
  - guestPort: 80
    hostPort: 8080
  - guestPort: 443
    hostPort: 8443
  - guestPort: 6379
    hostPort: 6380

Curl for secured site works well

curl -v https://arbor.local:8443
* Host arbor.local:8443 was resolved.
* IPv6: (none)
* IPv4: 127.0.0.1
*   Trying 127.0.0.1:8443...
* Connected to arbor.local (127.0.0.1) port 8443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted http/1.1
* Server certificate:
*  subject: C=US; ST=Wyoming; L=City; O=Imagewize; CN=arbor.local
*  start date: Nov  7 04:36:53 2024 GMT
*  expire date: Nov  8 04:36:53 2025 GMT
*  subjectAltName: host "arbor.local" matched cert's "arbor.local"
*  issuer: C=US; ST=Wyoming; L=City; O=Lima CA; CN=Lima CA Self Signed CN
*  SSL certificate verify ok.
* using HTTP/1.x
> GET / HTTP/1.1
> Host: arbor.local:8443
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Server: nginx/1.24.0 (Ubuntu)
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Cache-Control: no-cache, private
< Date: Fri, 08 Nov 2024 05:43:06 GMT
...

In Chrome I see

Request URL:
https://arbor.local:8443/
Request Method:
GET
Status Code:
200 OK
Remote Address:
127.0.0.1:8443
Referrer Policy:
strict-origin-when-cross-origin
cache-control:
no-cache, private
connection:
keep-alive
content-encoding:
gzip
content-type:
text/html; charset=UTF-8
date:
Fri, 08 Nov 2024 05:47:59 GMT
link:
<https://arbor.local:8443/build/assets/app-C-IfBEol.css>; rel="preload"; as="style", <https://arbor.local:8443/build/assets/app-CTSfgBJI.js>; rel="modulepreload", <https://arbor.local:8443/build/assets/Welcome-BpQqSg6h.js>; rel="modulepreload"
server:
nginx/1.24.0 (Ubuntu)
set-cookie:
XSRF-TOKEN=eyJpdiI6Im1oUXhyZFA0Yk05blVVNjZKL0lFN0E9PSIsInZhbHVlIjoiK3Zqa201TzFHZE1rOVBuMXE0SzJ1ZzVoVGpuaXBtWjN2a3p0RjBSRldES05OTnZHeENjb1JvcU9kTmh4VTV1cXVCUlNHVkd6WlZ5SlhNaXdBWlBiM2FJTjZEaWNxMnpYT2tkOWdMeC96MkROVnVpQ0R5L3BsQmFJV3oyN0lURUoiLCJtYWMiOiI2NWI1NGM3NjMxNDJmMzRiMzZkNTJkMzcyMDhkMjRlODAxZjg1YmRhOWMxM2YzZjczNTNlN2E3NzBiZjgwODlhIiwidGFnIjoiIn0%3D; expires=Fri, 08 Nov 2024 07:47:59 GMT; Max-Age=7200; path=/; secure; samesite=lax
set-cookie:
arbor_session=eyJpdiI6IjQ1aCtoUWxaZjJRNDdwKzVTZEUzREE9PSIsInZhbHVlIjoiZHQ3TTc1S3pCeVBPV3RLVzZBV0Nnc3NGSlB1d3B5NTBPemxHdXZldFpKV29kU0NQaGNTWDZXTm5MRklhRURic1lMUkFnSVNhZ3Fwb1ZxSXRkVnI5MHA4cnFjMnQ2aklkd090bkRudzZZUWZYUzdOOEF4NUFReUJOcmRubTVpWW4iLCJtYWMiOiJkNjRlY2U5ODU0NDI5NGVjNjNiNGY3NDViMDQ3OWMwYjJjYTQ1ZDc0YzYxMDRhMDM0MWM3NzY2NTVmMWY5M2NlIiwidGFnIjoiIn0%3D; expires=Fri, 08 Nov 2024 07:47:59 GMT; Max-Age=7200; path=/; secure; httponly; samesite=lax
transfer-encoding:
chunked
vary:
X-Inertia
x-content-type-options:
nosniff
x-frame-options:
SAMEORIGIN
x-xss-protection:
1; mode=block
accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
accept-encoding:
gzip, deflate, br, zstd
accept-language:
en
connection:
keep-alive
host:
arbor.local:8443
sec-ch-ua:
"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"
sec-ch-ua-mobile:
?0
sec-ch-ua-platform:
"macOS"
sec-fetch-dest:
document
sec-fetch-mode:
navigate
sec-fetch-site:
none
sec-fetch-user:
?1
upgrade-insecure-requests:
1
user-agent:
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

for that initial 10 second request for main page . Why is it taking so long? Is it the Lima port forwarding that is bad? Is it my Nginx configuration:

# HTTP server to redirect all requests to HTTPS
server {
    listen 80;
    server_name arbor.local;

    # Redirect all HTTP requests to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS server with SSL configuration
server {
    listen 443 ssl;
    server_name arbor.local;

    ssl_certificate     /etc/ssl/certs/arbor.local-combined.pem;
    ssl_certificate_key /etc/ssl/private/arbor.local.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    root /var/www/arbor/public;
    index index.html index.htm index.php;

    # Main location block
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP handling
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Restrict access to hidden files and directories
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

there are no error in Nginx error log nor in the PHP FPM log:

user@lima-ubuntu:/Users/jasperfrumau/code/stedding$ sudo tail /var/log/php8.3-fpm.log
[04-Nov-2024 18:54:51] NOTICE: Terminating ...
[04-Nov-2024 18:54:51] NOTICE: exiting, bye-bye!
[05-Nov-2024 06:20:14] NOTICE: fpm is running, pid 1555
[05-Nov-2024 06:20:14] NOTICE: ready to handle connections
[05-Nov-2024 06:20:14] NOTICE: systemd monitor interval set to 10000ms
[06-Nov-2024 19:06:31] NOTICE: Terminating ...
[06-Nov-2024 19:06:31] NOTICE: exiting, bye-bye!
[08-Nov-2024 10:38:20] NOTICE: fpm is running, pid 1556
[08-Nov-2024 10:38:20] NOTICE: ready to handle connections
[08-Nov-2024 10:38:20] NOTICE: systemd monitor interval set to 10000ms
user@lima-ubuntu:/Users/jasperfrumau/code/stedding$ sudo tail /var/log/nginx/error.log

Even pinging goes well

ping 127.0.0.1 -p 8443
PATTERN: 0x8443
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.084 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.214 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.258 ms
64 bytes from 127.0.0.1: icmp_seq=3 ttl=64 time=0.210 ms
64 bytes from 127.0.0.1: icmp_seq=4 ttl=64 time=0.242 ms
^C
--- 127.0.0.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.084/0.202/0.258/0.061 ms

Will look into Nginx improvements, but if there is anything on the Lima side that could be improved do let me know.

[jasperf]

Just did brew upgrade lima and now I am at the latest version

lima -v
limactl version 1.0.1

Should work better on my macOS Sequoia 15.0.1 (24A348)

limactl create --arch=aarch64 --vm-type=vz --mount-type=virtiofs template://ubuntu
? Creating an instance "ubuntu" Open an editor to review or modify the current configuration
INFO[0019] Attempting to download the image              arch=aarch64 digest="sha256:d71df0bcca6c3d2e7530517d3885f1d007fd9210d40ce2054db36af2a2176c38" location="https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-arm64.img"
Downloading the image (ubuntu-24.10-server-cloudimg-arm64.img)
592.71 MiB / 592.71 MiB [-----------------------------------] 100.00% 6.49 MiB/s
INFO[0111] Downloaded the image from "https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-arm64.img"
INFO[0111] Converting "/Users/jasperfrumau/.lima/ubuntu/basedisk" (qcow2) to a raw disk "/Users/jasperfrumau/.lima/ubuntu/diffdisk"
3.50 GiB / 3.50 GiB [---------------------------------------] 100.00% 1.18 GiB/s
INFO[0114] Expanding to 100GiB
INFO[0114] Attempting to download the nerdctl archive    arch=aarch64 digest="sha256:fe085381a09aa240ae5d1e0bbef1beccfb7c1d6dbb98bdc55bd416581d46ebc8" location="https://github.com/containerd/nerdctl/releases/download/v2.0.0/nerdctl-full-2.0.0-linux-arm64.tar.gz"
Downloading the nerdctl archive (nerdctl-full-2.0.0-linux-arm64.tar.gz)
195.48 MiB / 195.48 MiB [-----------------------------------] 100.00% 9.23 MiB/s
INFO[0137] Downloaded the nerdctl archive from "https://github.com/containerd/nerdctl/releases/download/v2.0.0/nerdctl-full-2.0.0-linux-arm64.tar.gz"
INFO[0137] Run `limactl start ubuntu` to start the instance.
limactl list
NAME      STATUS     SSH               VMTYPE    ARCH       CPUS    MEMORY    DISK      DIR
ubuntu    Stopped    127.0.0.1:2022    vz        aarch64    4       4GiB      100GiB    ~/.lima/ubuntu
limactl start ubuntu
INFO[0000] Using the existing instance "ubuntu"
INFO[0000] Starting the instance "ubuntu" with VM driver "vz"
INFO[0000] [hostagent] hostagent socket created at /Users/jasperfrumau/.lima/ubuntu/ha.sock
INFO[0000] [hostagent] Starting VZ (hint: to watch the boot progress, see "/Users/jasperfrumau/.lima/ubuntu/serial*.log")
INFO[0001] SSH Local Port: 2022
INFO[0000] [hostagent] [VZ] - vm state change: running
INFO[0000] [hostagent] Waiting for the essential requirement 1 of 2: "ssh"
INFO[0010] [hostagent] Waiting for the essential requirement 1 of 2: "ssh"
INFO[0011] [hostagent] The essential requirement 1 of 2 is satisfied
INFO[0011] [hostagent] Waiting for the essential requirement 2 of 2: "user session is ready for ssh"
INFO[0011] [hostagent] The essential requirement 2 of 2 is satisfied
INFO[0011] [hostagent] Waiting for the optional requirement 1 of 2: "systemd must be available"
WARN[0011] [hostagent] guest agent events closed unexpectedly  error="rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: unable to connect to guest agent via vsock port 2222\""
INFO[0011] [hostagent] The optional requirement 1 of 2 is satisfied
INFO[0011] [hostagent] Waiting for the optional requirement 2 of 2: "containerd binaries to be installed"
INFO[0021] [hostagent] Guest agent is running
INFO[0021] [hostagent] Not forwarding TCP [::]:22
INFO[0021] [hostagent] Not forwarding TCP 0.0.0.0:22
INFO[0021] [hostagent] Not forwarding TCP 127.0.0.53:53
INFO[0021] [hostagent] Not forwarding TCP 127.0.0.54:53
INFO[0038] [hostagent] The optional requirement 2 of 2 is satisfied
INFO[0038] [hostagent] Waiting for the guest agent to be running
INFO[0038] [hostagent] Waiting for the final requirement 1 of 1: "boot scripts must have finished"
INFO[0039] [hostagent] Forwarding TCP from 127.0.0.1:39019 to 127.0.0.1:39019
INFO[0047] [hostagent] The final requirement 1 of 1 is satisfied
INFO[0048] READY. Run `limactl shell ubuntu` to open the shell.

will test speed and usage next

[jasperf]

Oddly enough the ports for access fail to work. Inside LIma I see

imactl shell ubuntu
user@lima-ubuntu:/Users/me/code/stedding$ sudo ss -tuln
Netid          State           Recv-Q          Send-Q                       Local Address:Port                    Peer Address:Port
udp            UNCONN          0               0                               127.0.0.54:53                           0.0.0.0:*
udp            UNCONN          0               0                            127.0.0.53%lo:53                           0.0.0.0:*
udp            UNCONN          0               0                        192.168.5.15%eth0:68                           0.0.0.0:*
tcp            LISTEN          0               4096                         127.0.0.53%lo:53                           0.0.0.0:*
tcp            LISTEN          0               4096                            127.0.0.54:53                           0.0.0.0:*
tcp            LISTEN          0               4096                             127.0.0.1:43377                        0.0.0.0:*
tcp            LISTEN          0               4096                               0.0.0.0:22                           0.0.0.0:*
tcp            LISTEN          0               4096                                  [::]:22                              [::]:*

But I do have

 Please edit the following configuration for Lima instance "ubuntu"
# and an empty file will abort the edit.

minimumLimaVersion: "1.0.0"
images:
# Try to use release-yyyyMMdd image if available. Note that release-yyyyMMdd will be removed after several months.
- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-amd64.img"
  arch: "x86_64"
  digest: "sha256:ee070d95a2ba5a1500264e75b3e14aa85518220c24d25f1535407c55f0e33e4d"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-arm64.img"
  arch: "aarch64"
  digest: "sha256:d71df0bcca6c3d2e7530517d3885f1d007fd9210d40ce2054db36af2a2176c38"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-riscv64.img"
  arch: "riscv64"
  digest: "sha256:9cfcec0f9635b34e3c6d5294b33444b56c13a7ac5ac01c39e911c754b8018395"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release-20241023/ubuntu-24.10-server-cloudimg-armhf.img"
  arch: "armv7l"
  digest: "sha256:d51b578420a76e4d9eb1ed333acf2c1f1c61564e5325a4e888d693b721fbc7bd"
# Fallback to the latest release image.
# Hint: run `limactl prune` to invalidate the cache
- location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-amd64.img"
  arch: "x86_64"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-arm64.img"
  arch: "aarch64"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-riscv64.img"
  arch: "riscv64"
- location: "https://cloud-images.ubuntu.com/releases/24.10/release/ubuntu-24.10-server-cloudimg-armhf.img"
  arch: "armv7l"
mounts:
- location: "~"
- location: "/tmp/lima"
  writable: true

# 9p is broken in Linux v6.9, v6.10, and v6.11 (used by Ubuntu 24.10).
# The issue was fixed in Linux v6.12-rc5 (https://github.com/torvalds/linux/commit/be2ca38).
mountTypesUnsupported: ["9p"]
mountType: virtiofs
arch: aarch64
vmType: vz
ssh:
  localPort: 2022
portForwards:
  - guestPort: 80
    hostPort: 8080
  - guestPort: 443
    hostPort: 8443
  - guestPort: 6379
    hostPort: 6380

[jasperf]

Opened issue on port forwarding issue. Will continue here with testing site speed once the VM VZ version works.

[jasperf]

added public key on lima vm and now I can ssh in using port 2022. Just need to set things up further for other ports to work. Will test site speed later on.

First one was added by Lima and second by me:

cat ~/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICx1uTiqms5PWWz1CBbxeicda4iAi7yCy5npS5hHGt1U jasperfeeman@Jaspers-MacBook-Pro.local
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwOybdYwdNeQ6USqOEz8h1wXVeiIZLa3S0vnxbc0sto jasper@site.com

Not sure where first came from at first . Check all public ssh keys under ~/.ssh/ and zilch. But then I did

cat ~/.lima/_config/user.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICx1uTiqms5PWWz1CBbxeicda4iAi7yCy5npS5hHGt1U jasperf@Jaspers-MacBook-Pro.local

so it was added by Lima to configuration. Perhaps based on an older key. Need to see how to update this. But done

cp ~/.lima/_config/user.pub ~/.lima/_config/user.pub.bak

cp ~/.ssh/id_ed25519.pub ~/.lima/_config/user.pub

for now

[jasperf]

Speed is still slow. First load 10 seconds. Then it is faster again. Perhaps cause sessions have kicked in and or some files have been cached.

Nginx config:

cat /etc/nginx/sites-available/arbor.local
# HTTP server to redirect all requests to HTTPS
server {
    listen 80;
    server_name arbor.local;

    # Redirect all HTTP requests to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS server with SSL configuration
server {
    listen 443 ssl;
    server_name arbor.local;

    ssl_certificate     /etc/ssl/certs/arbor.local-combined.pem;
    ssl_certificate_key /etc/ssl/private/arbor.local.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # Enable SSL session caching and timeout for faster SSL handshake on repeated connections
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    # Enable session tickets for better performance (optional, check with your compliance needs)
    ssl_session_tickets on;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options "nosniff";

    root /var/www/arbor/public;
    index index.html index.htm index.php;

    # Main location block
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # PHP handling
    location ~ \.php$ {
        fastcgi_pass unix:/var/run/php/php-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        include fastcgi_params;
    }

    # Restrict access to hidden files and directories
    location ~ /\.(?!well-known).* {
        deny all;
    }
}

[jasperf]

found https://superuser.com/questions/1596225/dns-resolution-delay-for-entries-in-etc-hosts and so had to add ipv6 host to /etc/hosts to deal with Apple Bonjour issue.

sudo cat /etc/hosts
##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1	localhost
255.255.255.255	broadcasthost
::1             localhost
# ....
127.0.0.1       arbor.local
::1             arbor.local
fe80::1%lo0     arbor.local

[jandubois]

It is good that you found a workaround, but long term you should avoid using the .local domain for statically assigned names; it is reserved for mDNS and should not be used for other types of name resolution.

RFC 6762 has language like this:

Any DNS query for a name ending with ".local." MUST be sent to the mDNS IPv4 link-local multicast address 224.0.0.251 (or its IPv6 equivalent FF02::FB).

[jasperf]

Thanks for the feedback @jandubois . Started with .local as I was already using .test for Laravel Valet. Will see if I can combine both. True that .local should be avoided.