QEMU-NBD(8)

💅 qemu-nbd — QEMU Disk Network Block Device Server ✨

okay so bestie, welcome to the qemu-nbd(8) page, aka the QEMU manual. this one's a whole vibe: it's how you flex a QEMU disk image out over the network with the NBD protocol. no cap, it does a lot. 🦋

---

🌸 SYNOPSIS 🌸

qemu-nbd [OPTION]... filename

qemu-nbd -L [OPTION]...

qemu-nbd -d dev

like, three whole modes. pick your fighter. 👑

---

✨ DESCRIPTION ✨

the main character job: export a QEMU disk image using the NBD protocol. that's the whole thing. 🔥

but it's also giving... other uses, and honestly they're iconic:

• Bind a /dev/nbdX block device to a QEMU server (on Linux).
• Act as a client to query exports of a remote NBD server.

so it serves and it snoops. versatility queen. 💅

---

🎀 OPTIONS 🎀

quick grammar check before we start: filename is a disk image filename, or — if you're using --image-opts — a set of block driver options. and dev is an NBD device. ok now the flags, bestie. get comfy. 🍓

• --object type,id=ID,... — define a new instance of the type object class, identified by ID. the qemu(1) manual page has the full deets on which properties are supported. the ones that actually make sense to define here are the secret object (for passwords and/or encryption keys) and the tls-creds object (for TLS credentials for the qemu-nbd server or client). 🔑
• -p, --port=PORT — the TCP port to listen on as a server, or connect to as a client. default is 10809. yes, that exact number. 🎯
• -o, --offset=OFFSET — the offset into the image. like starting a book on chapter 3. 📖
• -b, --bind=IFACE — the interface to bind to as a server, or connect to as a client. default 0.0.0.0. 🫶
• -k, --socket=PATH — use a unix socket with path PATH. very cozy, very local. 🧚
• --image-opts — treat filename as a set of image options instead of a plain filename. ⚠️ if you use this flag, do not use the -f flag — instead set the format= option. got it? slay.
• -f, --format=FMT — force the use of the block driver for format FMT instead of auto-detecting. no guessing, we're decisive. 💅
• -r, --read-only — export the disk as read-only. look, don't touch. 🙈
• -A, --allocation-depth — expose allocation depth info through the qemu:allocation-depth metadata context, reachable via NBD_OPT_SET_META_CONTEXT. 🔍
• -B, --bitmap=NAME — if filename has a qcow2 persistent bitmap named NAME, expose that bitmap via the qemu:dirty-bitmap:NAME metadata context, accessible through NBD_OPT_SET_META_CONTEXT. 🗺️
• -s, --snapshot — use filename as an external snapshot: create a temporary file with backing_file=filename, and redirect the writes into the temporary one. ✨
• -l, --load-snapshot=SNAPSHOT_PARAM — load an internal snapshot inside filename and export it as a read-only device. SNAPSHOT_PARAM format is snapshot.id=[ID],snapshot.name=[NAME] or [ID_OR_NAME]. 🎀
• --cache=CACHE — the cache mode for the file. valid values: none, writeback (the default), writethrough, directsync and unsafe. the emulator's -drive cache=... option docs have more info. 🗂️
• -n, --nocache — literally just --cache=none. same energy. 💀
• --aio=AIO — set the asynchronous I/O mode: threads (the default), native (Linux only), and io_uring (Linux 5.1+). ⚡
• --discard=DISCARD — control whether discard requests (aka trim, aka unmap) are ignored or passed to the filesystem. DISCARD is one of ignore (or off), unmap (or on). the default is ignore. 🗑️
• --detect-zeroes=DETECT_ZEROES — control the automatic conversion of plain zero writes by the OS into driver-specific optimized zero write commands. DETECT_ZEROES is one of off, on, or unmap. ⚠️ unmap converts a zero write into an unmap operation and can only be used if DISCARD is set to unmap. the default is off. 🕳️
• -c, --connect=DEV — connect filename to NBD device DEV (Linux only). 🔌
• -d, --disconnect — disconnect the device DEV (Linux only). bye bestie 👋
• -e, --shared=NUM — allow up to NUM clients to share the device (default 1), or 0 for unlimited. come one, come all. 🎉
• -t, --persistent — don't exit on the last connection. she stays. 👑
• -x, --export-name=NAME — set the NBD volume export name. default is a zero-length string. 🏷️
• -D, --description=DESCRIPTION — set the NBD volume export description as a human-readable string. 🗒️
• --handshake-limit=N — set the timeout for a client to successfully complete its handshake to N seconds (default 10), or 0 for no limit. ⏳
• -L, --list — connect as a client and list all the details about the exports a remote NBD server is exposing. this enables list mode, and it's incompatible with options that change behavior related to a specific export (things like --export-name, --offset, ...). lowkey just window shopping. 🛍️
• --tls-creds=ID — enable mandatory TLS encryption for the server by setting the ID of the TLS credentials object you previously created with --object; or provide the credentials needed for connecting as a client in list mode. 🔐
• --tls-hostname=hostname — when validating an x509 certificate received over a TLS connection, the hostname the NBD client used to connect gets checked against info in the server-provided certificate. sometimes you gotta override the hostname used for that check. for example, if the NBD client is using a tunnel from localhost to reach the remote server, use --tls-hostname to set the officially expected hostname of the remote NBD server. also works when accessing NBD over a UNIX socket where there's no inherent hostname available. ⚠️ this is only permitted when acting as an NBD client with the --list option. 🌐
• --fork — fork off the server process and exit the parent once the server is running. ✂️
• --pid-file=PATH — store the server's process ID in the given file. 📌
• --tls-authz=ID — specify the ID of a qauthz object previously created with --object. this gets used to authorize connecting users against their x509 distinguished name. 🪪
• -v, --verbose — display extra debugging info. this option also keeps the original STDERR stream open if the qemu-nbd process gets daemonized because of other options like --fork or -c. 🗣️
• -h, --help — display this help and exit. 🆘
• -V, --version — display version information and exit. ℹ️
• -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE] — specify tracing options. details below 👇
  • [enable=]PATTERN — immediately enable events matching PATTERN (either an event name or a globbing pattern). 🪄 this option is only available if QEMU was compiled with the simple, log or ftrace tracing backend. to specify multiple events or patterns, just pass the -trace option multiple times. also: use -trace help to print a list of names of trace points.
  • events=FILE — immediately enable the events listed in FILE. 📄 the file must contain one event name per line (as listed in the trace-events-all file); globbing patterns are accepted too. this option is only available if QEMU was compiled with the simple, log or ftrace tracing backend.
  • file=FILE — log output traces to FILE. 📝 this option is only available if QEMU was compiled with the simple tracing backend.

---

🌈 EXAMPLES 🌈

okay now the fun part, actual receipts. 🧾

1. start a server listening on port 10809 that exposes only the guest-visible contents of a qcow2 file, with no TLS encryption, and with the default export name (an empty string). the command is one-shot, and will block until the first successful client disconnects:

qemu-nbd -f qcow2 file.qcow2

2. start a long-running server listening with encryption on port 10810, and allow clients with a specific X.509 certificate to connect to a 1 megabyte subset of a raw file, using the export name 'subset':

qemu-nbd \
  --object tls-creds-x509,id=tls0,endpoint=server,dir=/path/to/qemutls \
  --object 'authz-simple,id=auth0,identity=CN=laptop.example.com,,\
            O=Example Org,,L=London,,ST=London,,C=GB' \
  --tls-creds tls0 --tls-authz auth0 \
  -t -x subset -p 10810 \
  --image-opts driver=raw,offset=1M,size=1M,file.driver=file,file.filename=file.raw

3. serve a read-only copy of a guest image over a Unix socket with as many as 5 simultaneous readers, with a persistent process forked as a daemon:

qemu-nbd --fork --persistent --shared=5 --socket=/path/to/sock \
  --read-only --format=qcow2 file.qcow2

4. expose the guest-visible contents of a qcow2 file via a block device /dev/nbd0 (and possibly creating /dev/nbd0p1 and friends for partitions found within), then disconnect the device when done. 🔌

⚠️ access to bind qemu-nbd to a /dev/nbd device generally requires root privileges, and may also require running modprobe nbd to enable the kernel NBD client module. CAUTION: do not use this method to mount filesystems from an untrusted guest image — a malicious guest may have prepared the image to attempt to trigger kernel bugs in partition probing or file system mounting. fr fr, don't do it. 💀

qemu-nbd -c /dev/nbd0 -f qcow2 file.qcow2
qemu-nbd -d /dev/nbd0

5. query a remote server to see details about what export(s) it's serving on port 10809, and authenticate via PSK:

qemu-nbd \
  --object tls-creds-psk,id=tls0,dir=/tmp/keys,username=eblake,endpoint=client \
  --tls-creds tls0 -L -b remote.example.com

---

🫶 SEE ALSO 🫶

qemu(1), qemu-img(1) — go read those too, bestie, they're literally related. 📚

---

👑 Author 👑

Anthony Liguori <anthony@codemonkey.ws> — the icon who made this. 🫡

💖 Copyright 💖

2026, The QEMU Project Developers

---

and that's the whole page!! 🎉 this was QEMU-NBD(8), version 11.1.3, dated Oct 29, 2026, from the QEMU manual. mwah, go export something legendary. 💅✨🦋