Use case toturials ¶

Last changed: 2026-09-01

Note

Please be advised that these are merely examples of use cases, and they may be outdated.

Changing network interface for a running instance ¶

It is possible to change the network interface (i.e., from dualStack to IPv6) without rebooting or rebuilding your VM instance. This is possible between all available networks in the dashboard. Changing network interface will change the IP addresses of the instance. This toturial demonstrates how to change the network interface from dualStack to IPv6.

Tip

Set root password!

It is a good idea to set the root password prior to doing any network changes. The instance can then be accessed using the “Console” view in the dashboard.

In the Dashboard:

In the drop-down menu of your running instance, select “Detach Interface” (Figure 1).

Figure 1: Drop-down menu of the running instance (in Compute -> Instances). The first three options are shown. We will use all three options in this toturial.¶
Select the network to detach under “Port”. In Figure 2, a dualStack network configuration that is currently used by the running VM instance, is selected for detachment.

Figure 2: Selecting existing network to detach.¶
In the drop-down menu of your running instance, select “Attach Interface” (Figure 1).
Select the new (suggested) network to attach. In Figure 3, a new IPv6 network is selected.

Figure 3: Selecting new network to attach.¶

Tip

Automatic removal of security groups

Note that all security groups that used the network that you detached were removed from the instance as a result of detaching the interface. Because of this, you need to re-add the affected security group(s). In the drop-down menu of the running instance (Figure 1), select “Edit Instance”. In this toturial, a security group for SSH access is re-added as shown in Figure 4.

_images/uc-if-4.png — Figure 4: Adding security group for SSH access.¶

Linux VM user management ¶

Your Linux VM will come with a root user in addition to a cloud user as described in Current GOLD images.

User management follows standard Linux procedures. Below are some useful commands:

Table 1: Linux commands for basic user management.¶
Command	Description	Use case
`openssl rand -base64 6`	Generate random 6-digit password	Interactive
`sudo adduser <username>`	Create a new user with a password	Interactive
`sudo adduser --disabled-password <username>`	Create a new user with disabled password	When creating users with key-based login only. The user cannot be authenticated using password
`sudo useradd -m -s /bin/bash <username>`	Create a new user without specifying its password	-“-, non-interactive
`sudo passwd <username>`	Set password for user	Interactive
`sudo gpasswd -a <username> <groupname>`	Add user <username> to the group <groupname>	Ex. adding user admin to group sudo
`sudo passwd -l <username>`	Disable (lock) the password for <username>	The user can no longer be authenticated using password. Login to the user with other authentication methods will still work
`google-authenticator`	Run 2FA setup for scanning QR code with OTP mobile app	When having set up SSH to use the Google Authenticator PAM

Example:

Creating the additional user student with disabled password. From root:

adduser --disabled-password student

This should also create the home directory /home/student.

SSH keys

The public SSH key you selected in the in the wizard when creating the VM instance, was installed for the cloud and root user. However, by default, public key-based SSH login is only enabled for the cloud user. If you like to enable this for root (not recommended), you need to edit the correspondig settings in /etc/ssh/sshd_config, followed by a restart of the ssh service.

Example:

The manual process of installing the public SSH key for student is the following (from root):

mkdir -p /home/student/.ssh
# Substitute KEY with the public SSH key received from user student
echo KEY >> /home/student/.ssh/authorized_keys

2FA/MFA

You may want to setup the VM to use a pluggable authentication module (PAM) with your public SSH key and mobile one-time-password (OTP) app. Google Authenticator provides such a setup. The installation may vary with Linux distribution. For Debian-based systems, the package to install is libpam-google-authenticator and configuration is performed in /etc/pam.d/sshd and /etc/ssh/sshd_config.

Example: Assuming that Google Authenticator PAM is setup correctly with the SSH server in the VM. From root:

su - student
google-authenticator

A good default is to say yes (‘y’) to all options. A QR code should be printed. The student needs to somehow scan this QR code using any mobile OTP app. Additionally, the file /home/student/.google_authenticator will be created together with the generated QR code. This file can be deleted if you wish to re-run the google-authenticator command to get a new QR code.

Sudo

Passwordless sudo right is granted to the cloud user. This means that you may want to use sudo to set the root password while logged in with the cloud user, as described in How do I set the root password for my Linux instance?. The config file enabling passwordless sudo for the cloud user should be located in /etc/sudoers.d/. If you want passwordless sudo right for additional users, you can edit this file accordingly.

Example: To grant sudo right to user student, add user student to the group sudo. Then, find and edit the file where the cloud user is granted sudo right. For Ubuntu, the file is /etc/sudoers.d/90-cloud-init-users. From root:

gpasswd -a student sudo
echo -e '# User rules for ubuntu\nstudent ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers.d/90-cloud-init-users

If you followed the examples in this toturial, note that student can change to any user in the VM (using sudo su - <username>).

To prevent student from accessing other users, student and any other users in the VM should not have sudo rights, as well as a disabled password.

Any user logged into the VM may change to another user with password enabled (using su - <username>). This is a reason to create users with the –disabled-password option.

Shared account:

A shared user group1 may be created with password, and the password can be shared within the group. All members of the group should then be able to login to the VM using user group1 and shared password simultaneously. Shared accounts may also be accomplished by sharing the full (private+public) SSH key and possibly OTP app. However, this use case would go against introducing these increased security measures in the first place.

Lightweight Linux DE - LXDE + XRDP ¶

This is a tutorial on how you may setup a minimal graphical desktop environment (DE) in your linux VM, and access it remotely using the Remote Desktop Protocol (RDP) over a Secure Shell (SSH) tunnel.

LXDE: Lightweight X Desktop Environment
xrdp, a VDI server using the Remote Desktop Protocol (RDP) protocol, and that starts isolated X sessions
Web browser (firefox)
File browser (pcmanfm)
File de-compress/compress tool (xarchiver)
Text processor (mousepad)
Terminal emulator (lxterminal)
Decent theme (shimmer themes).

Abbreviations:

RDP: Remote Desktop Protocol, SSH: Secure Shell, GUI: Graphical User Interface, VDI: Virtual Desktop Infrastructure, DE: Desktop Environment

Note

The specific steps required for GUI to your linux VM instance depend heavily on the software and distribution. The steps in this toturial are likely to change in the future. The last edit was 2024-09-04.

Launch a new linux VM instance

Image: GOLD Ubuntu 24.04 LTS

Flavor: m1.medium (4 GB RAM, 20 GB OS disk)

Network: IPv6

Add a security group that allows SSH to the instance for IPv6

Add your SSH key

In this, toturial the instance is named vdi

SSH login with TCP tunnel for RDP connection
```
ssh ubuntu@<IPv6 address> -L 45000:localhost:3389
```
where we choose a high numbered port that we want to use to access our DE on localhost on our local machine.

If you are on a IPv4 only network such as eduroam, you can connect through login.uio.no or login.uib.no, e.g., for UiO users
```
ssh -J <username>@login.uio.no ubuntu@<IPv6 address> -L 45000:localhost:3389
```
where <username> is your UiO username. This requires that your SSH key is installed on the login host.
Set password for the cloud user (will be asked with VDI login)
```
sudo passwd ubuntu
```

Install software

sudo apt update -y && sudo apt install -y xrdp openbox-lxde-session lxappearance lxterminal xarchiver mousepad shimmer-themes firefox

First VDI login

Use a RDP Client to connect to localhost:45000. The client to use on Windows is the built-in Windows Remote Desktop. A good Linux client is Remmina.

You will be asked to login as user ubuntu with the password you set previously.

Necessary fixes
- Fix lxpanel bug for Ubuntu 24.04 LTS [1] [2]
  
  Right click on (the visible part of the) panel -> Panel Settings -> Panel Applets, select Desktop Pager, then click Remove
- Set decent theme
  
  Preferences -> Customize Look and Feel, select Greybird-dark -> Apply -> Close
  
  Preferences -> Openbox Configuration Manager, select Numix -> Close
  
  Right click on panel -> Panel Settings -> Appearance, under Background, select System theme -> Close
- Disable screensaver to avoid unwanted CPU consumption
  
  Preferences -> XScreenSaver Settings -> Mode: Disable Screen Saver -> Close
- (Windows only) Fix Windows Remote Desktop specific issues [3]
  
  Enable shared clipboard as well as drive redirection in Windows Remote Desktop client (to thinclient_drives mount): Make sure Windows Remote Desktop client is configured properly by unchecking Printers and Smart cards. Select the drive(s) to redirect, as well as Clipboard, then save the profile.
Finish

This toturial used the Remmina RDP client with custom screen resolution set to 1920x1080 (Figure 5).

Figure 5: Screenshot of the virtual DE with the GUI tools installed in this toturial.¶

Footnotes

VirtualGL Linux DE - GNOME + TurboVNC (Terraform)¶

This tutorial demonstrates how to deploy a ready-to-use Ubuntu 24.04 LTS VM with a GNOME desktop and TurboVNC remote access on NREC OpenStack, using the one-click deployment scripts from the nrec-oneclick-vps repository.

Tip

Prerequisites

Terraform >= 1.5
NREC OpenStack credentials (OS_USERNAME, OS_PASSWORD, OS_PROJECT_NAME, OS_REGION_NAME)
SSH client
TurboVNC viewer
Git (to clone the repository)

Clone the repository

git clone https://github.com/norcams/nrec-oneclick-vps.git
cd nrec-oneclick-vps

Create and fill in the environment file
```
cp env.sh.template env.sh
```
Edit env.sh and set your OpenStack API credentials:
- OS_USERNAME: your username (e.g. user@institution.no)
- OS_PASSWORD: your password
- OS_PROJECT_NAME: your project name
- OS_REGION_NAME: your region (e.g. bgo)
The OS_AUTH_URL is pre-set to https://identity.api.bgo.nrec.no:5000/v3.

Tip

Windows

Windows users: copy env.ps1.template to env.ps1 and set the same OpenStack credentials there. Run deploy.ps1 instead of deploy.sh.

Deploy the VM
```
./deploy.sh
```
The script will:
- Auto-detect your public IPv4/IPv6 address
- Generate a terraform.tfvars with default flavor (c1.xlarge) and image (GOLD Ubuntu 24.04 LTS). These can be changed directly in deploy.sh.
- Generate a TLS private key and save it to keys/vps-<deployment-id>.pem
- Create an OpenStack keypair
- Create a security group with SSH-only ingress
- Launch a VM with cloud-init (installs TurboVNC, GNOME desktop, Google Chrome)
- Print the VM IP addresses and SSH command
Credentials are saved to:
- VNC password: keys/vps-<deployment-id>.vncpass
- On VM: cat /home/ubuntu/.vnc-passwd

SSH login with VNC tunnel

ssh -L 55901:localhost:5901 -i keys/vps-<deployment-id>.pem ubuntu@<VM_IP>

If you are connecting from IPv6-only:

ssh -L 55901:localhost:5901 -i keys/vps-<deployment-id>.pem ubuntu@<VM_IPv6>

Start a VNC session and connect
```
vncserver :1
```
Then connect with TurboVNC to localhost:55901, using the password from /home/ubuntu/.vnc-passwd.
Tip

Desktop session

The default session starts with GNOME Flashback (Metacity). For the full modern GNOME session:
```
vncserver :1 -wm gnome
```
Tear down the VM

When finished, destroy all provisioned resources (including the VM, security groups, keypair, and local key files):
```
terraform destroy
```

Fast Qwen3.6 inference on L40s flavor for agentic tasks ¶

This tutorial demonstrates how to run the Qwen3.6-35B-A3B LLM with decent inference speed on an NREC L40s instance using llama.cpp and multi-token prediction (MTP).

Tip

Instance requirements

Flavor: gr1.L40S.24g.4xlarge (24 GB NVIDIA L40S vGPU)
Image: GOLD Ubuntu 24.04 LTS
Model: unsloth/Qwen3.6-35B-A3B-MTP-GGUF with UD-Q2_K_XL dynamic 2-bit quantization

The UD-Q2_K_XL quantization is a dynamic 2-bit format from Unsloth that reduces memory usage and increases inference speed. The A3B suffix indicates a Mixture of Experts (MoE) variant; no equivalent MoE variant exists yet for Qwen3.8.

Create and prepare the instance

Create a new instance with the flavor and image above. After login, install required packages:
```
sudo apt update
sudo apt install -y nvidia-cuda-toolkit git python3-venv python3-pip pciutils build-essential cmake curl libcurl4-openssl-dev nvtop
```
Follow the “Upgrading the instance drivers” section from the NREC vGPU documentation to install the latest NVIDIA drivers.
Verify GPU
```
nvidia-smi
```
You should see the NVIDIA L40S GPU listed.

Build llama.cpp

git clone https://github.com/ggml-org/llama.cpp
cd llama.cpp
cmake -B build -DBUILD_SHARED_LIBS=OFF -DGGML_CUDA=ON
cmake --build build --config Release -j --clean-first --target llama-cli llama-mtmd-cli llama-server llama-gguf-split
cp build/bin/llama-* .

Create a Python environment and download the model

python3 -m venv hf-llama
source hf-llama/bin/activate
pip install -U "huggingface_hub"

hf download unsloth/Qwen3.6-35B-A3B-MTP-GGUF \
    --local-dir unsloth/Qwen3.6-35B-A3B-MTP-GGUF \
    --include "*mmproj-F16*" \
    --include "*UD-Q2_K_XL*"

Start the inference server
```
./llama-server \
    --model unsloth/Qwen3.6-35B-A3B-MTP-GGUF/Qwen3.6-35B-A3B-UD-Q2_K_XL.gguf \
    --mmproj unsloth/Qwen3.6-35B-A3B-MTP-GGUF/mmproj-F16.gguf \
    --temp 0.6 --top-p 0.95 --min-p 0.00 --top-k 20 \
    --ctx-size 262144 --port 8001 \
    --spec-type draft-mtp --spec-draft-n-max 2 \
    --chat-template-kwargs '{"preserve_thinking":true}' \
    --no-mmap --image-min-tokens 1024
```
Key options explained:
- --spec-type draft-mtp --spec-draft-n-max 2: enables multi-token prediction, a speculative decoding technique that speeds up inference significantly
- --mmproj: enables image recognition capability (the multimodal projector); agentic frameworks with built-in image tools such as Hermes desktop should auto-detect and use it
- --chat-template-kwargs '{"preserve_thinking":true}': adds extra reasoning tokens that improve the model’s reasoning quality
- --no-mmap: avoids memory mapping for better GPU performance
- --image-min-tokens 1024: minimum tokens allocated for image processing
The server exposes an OpenAI-compatible API at http://127.0.0.1:8001/v1.

To use the CLI instead of the server, run llama-cli with the same arguments (omit --port).
Connect an agentic framework

Configure your agentic framework (e.g., agentic frameworks with built-in image tools such as Hermes desktop) to use the local endpoint:
```
# In your agent config:
# provider: custom
# endpoint: http://127.0.0.1:8001/v1
```
Stop the server with Ctrl+C.

Use case toturials¶

Changing network interface for a running instance¶

Linux VM user management¶

Lightweight Linux DE - LXDE + XRDP¶

VirtualGL Linux DE - GNOME + TurboVNC (Terraform)¶

Fast Qwen3.6 inference on L40s flavor for agentic tasks¶

Use case toturials ¶

Changing network interface for a running instance ¶

Linux VM user management ¶

Lightweight Linux DE - LXDE + XRDP ¶

Fast Qwen3.6 inference on L40s flavor for agentic tasks ¶