Build your Linux lab in VirtualBox

The commands below use Windows paths and PowerShell, because most readers are on Windows. On macOS or Linux the VBoxManage commands are the same: replace C:\Lab\Linux with ~/Lab/Linux and run them in your normal terminal. If you prefer clicking, every step also says what to choose in VirtualBox Manager.

Apple Silicon Macs (M1 to M4) can’t run x86 VMs at a usable speed. Use VirtualBox for Arm (or UTM) with the aarch64 ISOs of Rocky Linux 10 and Ubuntu Server 26.04. The names, IPs and steps stay the same, only the ISO files change.

1Check your CPU and install VirtualBox

On Windows, find your CPU model, then look it up: Intel 4th generation Core (model numbers like i5-4xxx) or newer, or any AMD Ryzen, is fine for Rocky Linux 10.

Run this in PowerShell:

Get-CimInstance Win32_Processor | Select-Object Name

You should see something like this:

Name
----
11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz

On a Linux laptop, ask glibc directly. Look for x86-64-v3 (supported, searched):

/lib64/ld-linux-x86-64.so.2 --help | grep x86-64

Now install VirtualBox 7.2.10 or later from virtualbox.org (on Windows you may also need the Microsoft Visual C++ redistributable it asks for). VBoxManage, the command-line tool, isn’t on the Windows PATH by default, so add it for this PowerShell window and check the version:

Run this:

$env:Path += ";C:\Program Files\Oracle\VirtualBox"
VBoxManage --version
mkdir C:\Lab\Linux\ISO

You should see something like this:

7.2.10r173892

Download two ISO files into C:\Lab\Linux\ISO: Rocky-10.2-x86_64-minimal.iso (about 1.9 GiB, from rockylinux.org/download) and ubuntu-26.04.1-live-server-amd64.iso (about 2.7 GiB, from ubuntu.com/download/server). Check each one against the SHA256 checksum published next to it:

Get-FileHash C:\Lab\Linux\ISO\Rocky-10.2-x86_64-minimal.iso -Algorithm SHA256
Get-FileHash C:\Lab\Linux\ISO\ubuntu-26.04.1-live-server-amd64.iso -Algorithm SHA256

✅ Checkpoint: VBoxManage prints 7.2.10 or newer, both ISOs are in C:\Lab\Linux\ISO and their hashes match the published ones.

2Create the LinuxLab NAT Network with port forwards

This makes the private network and the four SSH doors. Rules for kafka01 and ad01 point at machines that don’t exist yet, which does no harm, and it saves you coming back here in Lessons 54 and 58.

Paste this whole block:

VBoxManage natnetwork add --netname=LinuxLab --network=10.10.10.0/24 --dhcp=off --enable
VBoxManage natnetwork modify --netname=LinuxLab --port-forward-4="ssh-rocky01:tcp:[127.0.0.1]:2211:[10.10.10.11]:22"
VBoxManage natnetwork modify --netname=LinuxLab --port-forward-4="ssh-ubu01:tcp:[127.0.0.1]:2221:[10.10.10.21]:22"
VBoxManage natnetwork modify --netname=LinuxLab --port-forward-4="ssh-kafka01:tcp:[127.0.0.1]:2231:[10.10.10.31]:22"
VBoxManage natnetwork modify --netname=LinuxLab --port-forward-4="ssh-ad01:tcp:[127.0.0.1]:2241:[10.10.10.40]:22"
VBoxManage natnetwork list LinuxLab

You should see something like this:

NAT Networks:

Name:         LinuxLab
Enabled:      Yes
Network:      10.10.10.0/24
Gateway:      10.10.10.1
DHCP Server:  No
IPv6:         No
Port-forwarding (ipv4)
        ssh-ad01:tcp:[127.0.0.1]:2241:[10.10.10.40]:22
        ssh-kafka01:tcp:[127.0.0.1]:2231:[10.10.10.31]:22
        ssh-rocky01:tcp:[127.0.0.1]:2211:[10.10.10.11]:22
        ssh-ubu01:tcp:[127.0.0.1]:2221:[10.10.10.21]:22
loopback mappings (ipv4)
        127.0.0.1=2

1 network found

Each rule reads name:protocol:[host IP]:host port:[guest IP]:guest port. In VirtualBox Manager the same screen is under File, Tools, Network Manager, the NAT Networks tab, where you can also see the rules on the Port Forwarding tab.

✅ Checkpoint: natnetwork list shows LinuxLab, 10.10.10.0/24, DHCP Server: No and four port-forwarding rules.

3Create both VMs

Both VMs get a SATA controller for the disk and a separate IDE controller for the DVD. That keeps SATA ports 1 to 3 empty for the extra disks you’ll hot-add in Lessons 42 and 45.

Paste this whole block (ubu01):

VBoxManage createvm --name=ubu01 --ostype=Ubuntu_64 --basefolder="C:\Lab\Linux" --register
VBoxManage modifyvm ubu01 --memory=2048 --cpus=2 --firmware=bios --graphicscontroller=vmsvga --vram=16 --audio-enabled=off --nic1=natnetwork --nat-network1=LinuxLab --nic-type1=82540EM
VBoxManage createmedium disk --filename="C:\Lab\Linux\ubu01\ubu01.vdi" --size=20480 --format=VDI
VBoxManage storagectl ubu01 --name=SATA --add=sata --controller=IntelAhci --portcount=4
VBoxManage storageattach ubu01 --storagectl=SATA --port=0 --device=0 --type=hdd --medium="C:\Lab\Linux\ubu01\ubu01.vdi"
VBoxManage storagectl ubu01 --name=IDE --add=ide
VBoxManage storageattach ubu01 --storagectl=IDE --port=1 --device=0 --type=dvddrive --medium="C:\Lab\Linux\ISO\ubuntu-26.04.1-live-server-amd64.iso"

You should see something like this:

Virtual machine 'ubu01' is created and registered.
UUID: 4d1c7e2a-93b6-4f0e-8a57-2c6b1e9d0f43
Settings file: 'C:\Lab\Linux\ubu01\ubu01.vbox'
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Medium created. UUID: 9a2f61c4-0b7d-4e38-b1a5-6d3c8e2f7a10

Paste this whole block (rocky01):

VBoxManage createvm --name=rocky01 --ostype=RedHat_64 --basefolder="C:\Lab\Linux" --register
VBoxManage modifyvm rocky01 --memory=2048 --cpus=2 --firmware=efi --graphicscontroller=vmsvga --vram=16 --audio-enabled=off --nic1=natnetwork --nat-network1=LinuxLab --nic-type1=82540EM
VBoxManage createmedium disk --filename="C:\Lab\Linux\rocky01\rocky01.vdi" --size=20480 --format=VDI
VBoxManage storagectl rocky01 --name=SATA --add=sata --controller=IntelAhci --portcount=4
VBoxManage storageattach rocky01 --storagectl=SATA --port=0 --device=0 --type=hdd --medium="C:\Lab\Linux\rocky01\rocky01.vdi"
VBoxManage storagectl rocky01 --name=IDE --add=ide
VBoxManage storageattach rocky01 --storagectl=IDE --port=1 --device=0 --type=dvddrive --medium="C:\Lab\Linux\ISO\Rocky-10.2-x86_64-minimal.iso"

rocky01 boots with EFI and ubu01 with BIOS on purpose, so in Lesson 9 you can compare both boot paths on real machines. In VirtualBox Manager the equivalent is New, name and folder as above, turn unattended installation off, 2048 MB and 2 CPUs, tick EFI for rocky01 only, a 20 GB disk, and then Settings, Network, Adapter 1 attached to NAT Network “LinuxLab”.

✅ Checkpoint: VBoxManage list vms shows “ubu01” and “rocky01”, and showvminfo for each shows NIC 1 attached to NAT Network ‘LinuxLab’.

4Install Ubuntu Server on ubu01

Run this, then use the VM window:

VBoxManage startvm ubu01 --type=gui

Pick “Try or Install Ubuntu Server” and go through the installer with these choices. Anything not listed here, leave at the default.

When it says “Installation complete”, choose Reboot Now. If it asks you to remove the installation medium, press Enter (VirtualBox ejects the ISO by itself). Log in at the console as student, then check the address:

Run this on ubu01:

ip -br a show enp0s3

You should see something like this:

enp0s3           UP             10.10.10.21/24 fe80::a00:27ff:fe5e:7d21/64

[Add your screenshot here]: the Ubuntu installer’s “Edit enp0s3 IPv4 configuration” screen with Manual selected and the five fields filled in as in the table.

✅ Checkpoint: ubu01 shows 10.10.10.21/24 on enp0s3, and you can log in as student.

5Check that your VM sees an x86-64-v3 CPU

ubu01 boots on any 64-bit CPU, so use it as a test probe. It sees the same virtual CPU that rocky01 will see, which tells you before installing whether Rocky Linux 10 can start.

Run this on ubu01:

/lib64/ld-linux-x86-64.so.2 --help | grep x86-64
grep -c -w avx2 /proc/cpuinfo

You should see something like this:

  x86-64-v4 (supported, searched)
  x86-64-v3 (supported, searched)
  x86-64-v2 (supported, searched)
2

“x86-64-v3 (supported, searched)” means glibc found every v3 feature, and the 2 means both vCPUs show the avx2 flag. You’re good to install Rocky. If the v3 line has no “(supported, searched)” after it and the count is 0, don’t install Rocky yet: read Break It 2 first, and if you can’t fix it, use the AlmaLinux 10 fallback in the note below.

Fallback for older CPUs: AlmaLinux 10 also publishes an x86_64_v2 build. Download the x86_64_v2 minimal ISO (named like AlmaLinux-10.2-x86_64_v2-minimal.iso), attach it to the rocky01 VM instead of the Rocky ISO and keep the name rocky01, so every later lesson still works. The commands in this course are the same. You’ll notice small differences: the prompt and /etc/os-release say AlmaLinux, and the default volume group is called almalinux instead of rl.

✅ Checkpoint: Your ubu01 output shows x86-64-v3 as supported, or you have switched rocky01 to the AlmaLinux x86_64_v2 ISO.

6Install Rocky Linux on rocky01

Run this, then use the VM window:

VBoxManage startvm rocky01 --type=gui

Choose “Install Rocky Linux 10.2”. On the Installation Summary screen set these spokes, then click Begin Installation:

Why set a root password when you’ll use sudo every day? Because in Phase 4 you’ll break the boot on purpose, and RHEL-family emergency mode asks for the root password before it gives you a shell. After the reboot, log in at the console as student:

Run this on rocky01:

ip -br a show enp0s3
ip route

You should see something like this:

enp0s3           UP             10.10.10.11/24 fe80::a00:27ff:fe3b:9c11/64
default via 10.10.10.1 dev enp0s3 proto static metric 100
10.10.10.0/24 dev enp0s3 proto kernel scope link src 10.10.10.11 metric 100

[Add your screenshot here]: the Rocky Linux Installation Summary with every spoke filled in (no orange warnings), showing “Network: Wired (enp0s3) connected” and the root account enabled.

✅ Checkpoint: rocky01 shows 10.10.10.11/24 on enp0s3 and a default route via 10.10.10.1.

7Check DNS and the internet from both VMs

Both VMs use 10.10.10.1 as their name server, which is VirtualBox’s DNS proxy on the NAT Network. Test it with getent, which asks the system resolver the same way dnf and apt do:

Run this on rocky01:

getent hosts dl.rockylinux.org
sudo dnf -y makecache

You should see something like this (first line):

151.101.130.132 dl.rockylinux.org

On ubu01 run getent hosts archive.ubuntu.com and sudo apt update instead. Any IP address on the first line means DNS works. If getent prints nothing and dnf or apt say they can’t resolve the host, the proxy isn’t answering on your laptop (some VPNs and company laptops block it), so add a public resolver as a second server:

sudo nmcli connection modify enp0s3 ipv4.dns "10.10.10.1 1.1.1.1"
sudo nmcli connection up enp0s3

sudo netplan apply

✅ Checkpoint: getent returns an IP address for the repository host on both VMs, and dnf makecache and apt update finish without errors.

8Give every VM the same /etc/hosts

A lab doesn’t need a DNS server for four machines. One block in /etc/hosts on each VM lets you use names like ubu01 and rocky01.saatlab.test everywhere.

Paste this whole block on rocky01, then again on ubu01:

sudo tee -a /etc/hosts > /dev/null <<'EOF'
10.10.10.11  rocky01.saatlab.test  rocky01
10.10.10.21  ubu01.saatlab.test    ubu01
10.10.10.31  kafka01.saatlab.test  kafka01
10.10.10.40  ad01.saatlab.test     ad01
EOF
ping -c 3 ubu01

You should see something like this on rocky01:

PING ubu01.saatlab.test (10.10.10.21) 56(84) bytes of data.
64 bytes from ubu01.saatlab.test (10.10.10.21): icmp_seq=1 ttl=64 time=0.612 ms
64 bytes from ubu01.saatlab.test (10.10.10.21): icmp_seq=2 ttl=64 time=0.498 ms
64 bytes from ubu01.saatlab.test (10.10.10.21): icmp_seq=3 ttl=64 time=0.521 ms

--- ubu01.saatlab.test ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2034ms
rtt min/avg/max/mdev = 0.498/0.543/0.612/0.050 ms

sudo tee -a appends as root, which a plain >> after sudo can’t do (Lesson 13 explains why). On ubu01, ping rocky01 instead. Ubuntu already has a line like 127.0.1.1 ubu01 near the top of the file, which is normal and can stay.

✅ Checkpoint: ping by name works in both directions with 0% packet loss.

9SSH in from your laptop

Windows 10 and 11, macOS and Linux all have the OpenSSH client built in. Open a new terminal on the laptop (not inside a VM):

Run this:

ssh -p 2211 student@127.0.0.1

You should see something like this:

The authenticity of host '[127.0.0.1]:2211 ([127.0.0.1]:2211)' can't be established.
ED25519 key fingerprint is SHA256:Qm4Zr8yVt1kH2cW9pLx6dN0sJfA3eB7uT5gR1oYiK8M.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[127.0.0.1]:2211' (ED25519) to the list of known hosts.
student@127.0.0.1's password:
Last login: Tue Oct 27 11:02:41 2026
[student@rocky01 ~]$

Type yes the first time only. SSH saves the server’s key under [127.0.0.1]:2211, so rocky01 and ubu01 don’t clash even though both are “127.0.0.1”. Type exit, then do the same for ubu01 with ssh -p 2221 student@127.0.0.1.

From now on you can minimise the VM windows and work only over SSH.

✅ Checkpoint: You get the [student@rocky01 ~]$ prompt on port 2211 and student@ubu01:~$ on port 2221.

10Update both VMs and take the “base” snapshot

Run this on rocky01, then shut it down:

sudo dnf -y group install standard
sudo dnf -y update
sudo systemctl poweroff

Run this on ubu01, then shut it down:

sudo apt update && sudo apt -y full-upgrade
sudo systemctl poweroff

The standard group adds the everyday admin tools a minimal install leaves out, such as the man pages you’ll use in Lesson 3. Updates bring a new kernel more often than not, and the power-off makes sure the snapshot holds a clean, fully stopped system. Then, back on the laptop:

Run this:

VBoxManage snapshot rocky01 take base --description="Lesson 2: clean install, static IP, student user, updated"
VBoxManage snapshot ubu01 take base --description="Lesson 2: clean install, static IP, student user, updated"
VBoxManage snapshot rocky01 list --details

You should see something like this:

0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Snapshot taken. UUID: 7e4b2d90-1f6a-4c83-9e05-b8d2a6c3f117
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Snapshot taken. UUID: c3a91f08-5d2e-47b6-8f14-0e7a9b2d6c55
   Name: base (UUID: 7e4b2d90-1f6a-4c83-9e05-b8d2a6c3f117) *
   Description: Lesson 2: clean install, static IP, student user, updated

To start the VMs without a window from now on, use VBoxManage startvm rocky01 --type=headless. On an 8 GB laptop run only two VMs at a time, which is all you need until Phase 3.

✅ Checkpoint: Both VMs have a snapshot called base, and you can start them headless and SSH in on 2211 and 2221.