distros/skills/qemu-guest-agent/SKILL.md
QEMU guest agent for host-guest communication in virtual machines. Use when working with QEMU/KVM VMs, guest agent setup, or libvirt channel configuration.
npx skillsauth add overthinkos/overthink-plugins qemu-guest-agentInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
| Property | Value |
|----------|-------|
| Install files | charly.yml |
qemu-guest-agent -- QEMU guest agent daemon. The package name is identical on
Arch/CachyOS (pac) and Fedora (rpm), so the top-level package: covers both
— this is a cross-distro candy, not RPM-only.The candy exposes the complete guest-agent surface — guest-exec,
guest-file-*, guest-fsfreeze-*, guest-set-*. The package default blocks no
RPCs; the candy's /etc/qemu/qemu-ga.conf makes that explicit and turns on the
fsfreeze hook (the one capability not active by default), so the host can take
application-consistent snapshots. The hook is a standard dispatcher
(/etc/qemu/fsfreeze-hook) that runs every executable in
/etc/qemu/fsfreeze-hook.d/ with freeze/thaw; drop per-app scripts there.
The candy also enables the qemu-guest-agent.service (system scope) and
contributes the virtio-serial channel (below). On a kind: vm entity the channel
is usually declared structurally instead — channels: [{type: unix, name: org.qemu.guest_agent.0}] (see /charly-internals:libvirt-renderer).
# charly.yml -- add to a bootc image's layer list
my-vm-image:
bootc: true
candy:
- qemu-guest-agent
# or applied to a VM guest at deploy time:
# charly deploy add vm:<name> qemu-guest-agent
Composed into bootc images directly, or applied to a VM guest at deploy time (charly deploy add vm:<name> qemu-guest-agent).
The candy contributes a raw libvirt XML snippet that the libvirt renderer places in the VM's <devices> section:
<channel type='unix'>
<target type='virtio' name='org.qemu.guest_agent.0'/>
</channel>
Emitted in charly.yml as:
libvirt:
snippets:
- "<channel type='unix'><target type='virtio' name='org.qemu.guest_agent.0'/></channel>"
This is the / classification case: isDeviceElement flags it as device-scoped, so the renderer injects it inside <devices> rather than before </domain>. See /charly-internals:libvirt-renderer for the injection pipeline and /charly-vm:vm for the QEMU-user-net caveat (the agent shows as enabled/inactive under charly's QEMU backend; libvirt backend activates it).
/charly-coder:sshd -- SSH server (commonly paired in bootc/VM images)Use when the user asks about:
org.qemu.guest_agent.0 channel/charly-image:layer — candy authoring reference (charly.yml schema, task verbs, service declarations, libvirt.snippets:)/charly-vm:vm — VM lifecycle; bootc VM caveats; QEMU-user-net limitation/charly-vm:vms-catalog — kind: vm entity schema that consumes this candy's contribution/charly-internals:libvirt-renderer — renderer that injects this candy's snippet into <devices>/charly-eval:eval — declarative testing (eval: block, charly eval box, charly eval live)tools
OpenCharly CLI (charly) binary installed into container/VM images for in-container use. Use when working with charly binary deployment inside containers, native D-Bus support, or the full charly toolchain (charly binary + virtualization + gocryptfs + socat).
development
Operator CachyOS workstation profile — a kind:local template + target:local deploy that installs the full dev stack (30 candies) onto a CachyOS host via ShellExecutor. Lives in the overthinkos/cachyos submodule. MUST be invoked before editing or applying the charly-cachyos workstation profile.
tools
Fedora box with the full charly toolchain using shared candies. Rootless-first — runs as uid=1000 with passwordless sudo (no root, no cap_add: ALL). Same candy list as charly-arch. Includes NVIDIA GPU runtime. MUST be invoked before building, deploying, configuring, or troubleshooting the charly-fedora box.
tools
Arch Linux box with the full charly toolchain. Rootless-first — runs as uid=1000 with passwordless sudo (no root, no cap_add: ALL). Composes /charly-coder:charly-mcp so the box is reachable as an MCP gateway on port 18765. NVIDIA GPU runtime composed in. MUST be invoked before building, deploying, configuring, or troubleshooting the charly-arch box.