Set up Cockpit

Install the Cockpit web console and the libvirt stack on Debian, and get the Virtual machines page working.

Overview

This guide explains how to install the Cockpit web console on Debian 13 (trixie) together with the libvirt stack behind its Virtual machines page, so the host can be administered and can run VMs from a browser.

Everything needed is in trixie's main component — Cockpit 337 and cockpit-machines 332 at the time of writing — so no backports repository is involved.

Before you start

Before you set up Cockpit, ensure:

You have administrative rights on the host — see First boot. Cockpit authenticates you as a normal system user, so an account without administrative rights gets a read-only console.
The CPU supports hardware virtualisation and it is enabled in firmware — SVM Mode on AMD, VT-x on Intel.
You can reach the host on TCP port 9090 from wherever you run a browser.
If you intend to pass a GPU through to a VM, do that host configuration first — it needs a reboot, and it is easier before any VM exists.

Install the console, the VM plugin, and the hypervisor.
bash
```
sudo apt update
sudo apt install cockpit cockpit-machines libvirt-daemon-system qemu-system-x86 ovmf
```
cockpit-machines pulls in libvirt-clients, libvirt-dbus, and virtinst on its own. qemu-system-x86 and ovmf are named explicitly because they are the emulator and the UEFI firmware images — a VM that needs UEFI cannot be created without the latter.
Confirm hardware virtualisation is available to the host.
bash
```
ls -l /dev/kvm
```
```
crw-rw---- 1 root kvm 10, 232 Aug 22 17:20 /dev/kvm
```
If the file is missing, virtualisation is switched off in firmware and no amount of configuration below will produce a working VM. Reboot into the BIOS setup and enable it.
Confirm libvirt is running.
bash
```
systemctl is-active libvirtd
```
This prints active. Debian's libvirt-daemon-system still enables the monolithic libvirtd rather than the modular virtqemud, and Cockpit connects to it over qemu:///system.
Add your account to the libvirt group.
bash
```
sudo usermod -aG libvirt "$USER"
```
Cockpit talks to libvirt as the user you log into Cockpit as, not as root. Log out and back in afterwards — group membership is fixed when a session is created, so your current session will not pick it up.

Confirm the default virtual network is up.

bash

sudo virsh net-list --all

 Name      State      Autostart   Persistent
----------------------------------------------
 default   active     yes         yes

If default is inactive, start it and make that survive a reboot:

bash

sudo virsh net-start default
sudo virsh net-autostart default

Without it, new VMs have no network and the create dialog offers no usable interface.

Confirm Cockpit is listening.
bash
```
systemctl is-active cockpit.socket
```
This prints active. Cockpit is socket-activated and enabled on install, so cockpit.service itself shows as inactive until the first connection arrives — that is normal and not a fault.
Log in to the console.

Open https://vm-001.hero4hire.org:9090/ in a browser. The certificate is self-signed on a fresh install, so expect the browser warning and accept it for this host.

Log in with your system account, then turn on Administrative access in the top bar. Without it the Virtual machines page loads read-only and the Create VM button does nothing.
Confirm the Virtual machines page works.

Click Virtual machines in the left-hand navigation. An empty list with a working Create VM button means Cockpit reached libvirt successfully.

If the page reports that it cannot connect to libvirt, the usual cause is step 4 — log out of Cockpit and back in so the session carries your new group membership.

Set up Cockpit

Overview

Before you start

Set up Cockpit

See also

On this page