Deploying a VM

Running a VM on the ARROW device lets you stand up a disposable, ready-made attack box right on the target network, without shipping more hardware. ARROW Manager deploys these from a built-in library of pre-built templates, and this guide walks the whole process from encrypted storage through a booting VM.

The Virtual Machines page is laid out in three parts: a status strip across the top (VM count, storage state, and a Scan USB action), a “Your Machines” list of what you have already deployed, and a “Deploy a VM” app library where you pick a template and launch it.

ARROW Manager Virtual Machines page with the app library and encryption setup prompt

The Virtual Machines page, showing the app library and the encryption setup prompt

Prerequisites

You need four things in place before a VM will deploy:

You are logged into ARROW Manager
Host connection credentials are configured (under Settings, in Virtual Machines)
Encrypted storage is set up and mounted
At least one template is installed from the app library

Step 1: Set Up Encrypted Storage

VMs on the ARROW device always live on LUKS-encrypted storage. This is deliberate: your VMs may hold engagement data and target access, and if the device is lost or seized, that data has to be unreadable. That is why deployment is blocked until encryption is active.

If encryption is not set up yet, the Virtual Machines page shows an “Encryption Setup Required for Deployment” prompt and the storage indicator in the status strip reads “Not set up”. To set it up, click Setup Encryption, enter a strong key or passphrase, and confirm. The device creates a LUKS-encrypted partition, mounts it, and configures a dedicated “encrypted” storage location for your VMs.

Remember Your Key

The device does not save your encryption key. You have to re-enter it after every reboot to unlock your VM storage, and if you lose it there is no recovery: your only path forward is to wipe the encrypted storage and start over. Store the key somewhere safe.

After a Reboot

A reboot leaves the storage locked, so you will see an Encrypted Storage Not Mounted alert. This is normal, not a failure. Click Enter Encryption Key, type your key, and click Unlock Storage to remount it and get your VMs back.

Step 2: Choose a Template from the App Library

The “Deploy a VM” section is a one-click app library. Each card shows a template, such as kali-arrow (Kali Linux with ARROW’s custom tools and configuration), along with its tags and version. If a template has not been downloaded yet, install it from its card and wait for the download to finish. Templates are kept separate from the encrypted partition, so you can install and update them whenever you like, even before encryption is set up.

Step 3: Deploy the VM

Click Deploy on a template card to open the deployment dialog. It has four sections to fill in before the VM can be created.

Authentication

Set the passwords the VM will be built with:

Field	Required	Description
Root Password	Yes	Root account password (minimum 8 characters)
Confirm Root Password	Yes	Must match the root password
ARROW User Password	Yes	Password for the `arrow` user account (minimum 8 characters)
Confirm ARROW User Password	Yes	Must match the arrow user password
SSH Public Key	No	Optional SSH public key for key-based authentication (ssh-rsa, ssh-ed25519, etc.)

VPN

This is what makes the VM reachable from anywhere, the same way the device itself is. ARROW Manager provisions a NetBird setup key for the VM automatically and ties it to your device request, so there is no key to paste in. The VM joins your organization’s VPN network on first boot and becomes remotely accessible.

Field	Required	Description
NetBird Device Name	Auto	Automatically generated from your device hostname in the format `pvm-[host-suffix]` (for example, `pvm-001`). This becomes the VM’s system hostname; you can edit it before deploying.
Enable ARROW Control	No	Toggle to provision an ARROW Control license for the VM (enabled by default, Linux only). When enabled, an Install Beta Version toggle lets you provision the pre-release beta build instead of the stable channel.

Network

Configure how the VM connects to the local network:

Field	Required	Description
MAC Address	Auto	Auto-generated from the host adapter. Can be manually changed if needed.
Use Static IP	No	Toggle between DHCP (default) and static IP configuration

When Use Static IP is enabled, additional fields appear:

Field	Required	Description
IP Address	Yes	Static IP address for the VM
Subnet Mask	Yes	Supports CIDR notation (/24) or decimal (255.255.255.0)
Gateway	Yes	Network gateway address
Primary DNS	Yes	Primary DNS server
Secondary DNS	No	Optional fallback DNS server

If you leave Use Static IP disabled, the VM will use DHCP to obtain its network configuration automatically.

Resources

Decide how much of the device’s hardware the VM gets. The defaults are calculated from your device’s actual specs and leave headroom for the host to keep running, so they are a safe starting point; adjust them if the VM needs more or you are running several at once.

Field	Default	Description
Disk Size (GB)	Template minimum	Size of the VM disk. Cannot be smaller than the template’s disk size. Maximum 2000 GB.
CPU Cores	Host cores - 1	Number of CPU cores allocated to the VM
Memory (GB)	Host memory - 2 GB	Amount of RAM allocated to the VM

Step 4: Confirm and Deploy

With all four sections filled in, click Create VM. ARROW Manager validates your settings, allocates a VM ID on Proxmox, clones the template with your resource settings, applies the cloud-init configuration (passwords, network, and VPN), and starts the VM.

You can watch the progress as it happens. When it finishes, the VM shows up in your VM list and begins booting.

Deployment Checklist

A quick pass before you hit Deploy:

Requirement	Status
Logged into ARROW Manager
Proxmox credentials configured
Encrypted storage set up and mounted
Template installed
Root and arrow user passwords chosen
Network configuration decided (DHCP or static)
Resource allocation reviewed

Troubleshooting

“Encrypted storage is not mounted.” Set up or unlock encrypted storage before deploying, as covered in Step 1.

The Deploy button is greyed out. It stays disabled until the basics are in place, so check for one of these: encrypted storage is not set up or not mounted, a template is still downloading, or host connection credentials have not been configured.

The VM has no network. On static IP, confirm the IP, gateway, and DNS are correct for the network you are on. On DHCP, make sure the network actually has a DHCP server. Either way, check that the MAC address does not collide with another device.

You forgot the encryption key after a reboot. There is no way to recover it. Your only option is to wipe the encrypted storage and set it up again, which deletes every deployed VM. Use the Wipe action in the status strip to reset, then see below.

Wiping Encrypted Storage

When an engagement wraps up, wiping the encrypted storage is how you make sure nothing you did on the device can be recovered. It permanently destroys every deployed VM and its data. You would also wipe if you have lost the encryption key and cannot unlock the storage, or if you simply want the disk space back.

Wiping stops all running VMs, deletes them from Proxmox, removes the “encrypted” storage from the Proxmox configuration, unmounts the filesystem, closes the LUKS device, wipes the LUKS header so the data cannot be recovered, and deletes the partition from disk.

To wipe:

Go to the Virtual Machines page in ARROW Manager
In the status strip, click the Wipe action (it only appears when encrypted storage exists)
Read the warning dialog carefully
If any VMs are running, you will see an extra warning that they will be stopped for you
Click Wipe Encrypted Storage to confirm

Afterward you can set up encryption from scratch again by following Step 1.

ARROW Manager Overview - General ARROW Manager features
VPN Management - NetBird VPN setup and configuration
Troubleshooting - Common ARROW Manager issues