Vagrant Boxes: Private Vagrant Box Hosting With Easy Versioning

At NopSec, we are using vagrant and packer to spin up local dev environments and build our instances across the various hypervisor and cloud providers we use. We have packer scripts that build our VirtualBox and VMware images used in local development and our various instances used in our cloud providers.

An issue I had to solve recently was how best to share development vagrant boxes within our team. Since we are an information security company with potentially sensitive information in our instances, we try to self-host whenever possible. This makes Vagrant Cloud (now Atlas) an unlikely secondary option. At the time of writing, there are some pieces of documentation in packer and vagrant that point to a private vagrant cloud being available. But looks like Atlas has changed that. We would love to use Atlas as a self-hosted solution, hopefully this is something they will make available in the future.

Initial thoughts were to use URLs to share files privately but it felt clunky to have to tell everyone when they needed to update. This would mean users must remove their box locally and either add through the URL or on their next vagrant up. I wanted to use vagrant’s ability to check for updates and inform a user when an update is available. This is available in boxes hosted in Vagrant Cloud or Atlas. I found plenty of information on how to version vagrant boxes using their cloud or now Atlas product but couldn’t find much on how to do the same in a private environment. After combing through documentation along with some helpful blog and forum posts I come up with a setup that should work well for us. Hopefully sharing helps others with similar issues.

Using Packer To Version The Boxes

Originally I tried using the metadata.json format in the Vagrant docs, then bundling our own box file. But anything beyond what packer adds,

when adding a box vagrant would throw the following error

The stack trace was a bit vague and google didn’t turn up anything useful. So I started pulling official boxes to figure out what I was doing wrong with my metadata file. I found the documentation likely out of date with Atlas taking over as box repository. My initial findings lead to a great blog article.

Following the lead I was able to continue building our vagrant boxes the same way using packer. I just wound up modifying our naming scheme to reflect the version and provider. Then setup a web server to host the vagrant boxes in a standard file structure.

A sample packer build script