Organizations using oVirt may occasionally encounter the following error when attempting to start a virtual machine:
Cannot run VM – CD-ROM ISO image is locked
This condition prevents the virtual machine from booting and is most commonly observed during operating system installations or when attaching installation media to newly provisioned workloads.
This article provides a technical explanation of the ISO lock mechanism in oVirt, identifies the most common root causes, and outlines safe, production-ready remediation steps aligned with enterprise operational standards.
Understanding ISO Locking in oVirt
In oVirt, ISO images are stored within a dedicated ISO Storage Domain and presented to virtual machines as virtual CD-ROM devices.
To preserve data integrity and avoid concurrent access conflicts, oVirt enforces a locking mechanism that ensures an ISO image can only be actively used by one VM operation at a time.
An ISO remains locked until oVirt confirms that:
- The virtual machine has released the CD-ROM device
- No storage-level operation is pending
- The engine and host are in a consistent state
If this process is interrupted, the ISO remains locked
Common Root Causes
1. ISO Image Still Attached to Another Virtual Machine
An ISO may remain locked if it is still mounted to a VM that:
- Is running
- Was force-stopped
- Did not correctly release the CD-ROM device
2. Interrupted or Failed ISO Upload
Incomplete uploads caused by network interruption or browser termination may leave the ISO in a permanent locked state.
3. Storage Domain Inconsistency
Issues with NFS, iSCSI, or GlusterFS ISO storage domains can result in stale locks at the storage layer.
4. oVirt Engine or Hypervisor Interruption
Unexpected engine restarts, host reboots, or connectivity loss may prevent proper cleanup of ISO locks.
Resolution Steps
Step 1: Verify ISO Usage Across Virtual Machines
- Open the oVirt Administration Portal
- Navigate to Compute → Virtual Machines
- Inspect all VMs for mounted CD-ROM devices
- Detach the ISO from any VM where it is still assigned
Retry starting the affected VM.
Step 2: Detach and Reattach the ISO
- Edit the affected virtual machine
- Set CD-ROM to Empty
- Save and close the configuration
- Reopen VM settings and reattach the ISO
- Start the VM
This action forces oVirt to re-evaluate the ISO lock state.
Step 3: Validate ISO Storage Domain Health
Navigate to:
Storage → ISO Domains
Confirm that the domain is:
- Active
- Connected
- Free of errors
If necessary:
- Deactivate the ISO domain
- Reactivate it to refresh metadata and release stale locks
Step 4: Re-Upload the ISO Image
If the ISO appears as Locked, Illegal, or Incomplete:
- Remove the affected ISO image
- Upload the ISO again using a stable connection
- Wait for upload completion before attaching it to a VM
Step 5: Restart oVirt Engine (Controlled Maintenance Action)
If the ISO remains locked without a visible consumer:
systemctl restart ovirt-engine
Note: Restarting the oVirt Engine does not interrupt running virtual machines but should be performed during a planned maintenance window.
Windows 11 Deployment Considerations on oVirt
Required VM Configuration
For Windows 11 deployments, ensure the following enterprise-grade configuration:
- Chipset: Q35
- Firmware: UEFI
- Secure Boot: Enabled
- TPM: Version 2.0 (if supported)
- CPU Mode: Host Passthrough
- Disk Interface: VirtIO
- Memory: Minimum 4 GB
Failure to meet these requirements may result in installation blocks unrelated to ISO locking.
TPM Workaround (Lab Environments Only)
If virtual TPM is unavailable, registry-based installation bypasses may be used for non-production systems.
This approach is not recommended for enterprise or compliance-sensitive environments.
Preventive Best Practices
- Always eject installation ISOs after OS deployment
- Avoid sharing ISO images across simultaneous VM operations
- Ensure ISO uploads complete successfully before use
- Maintain a dedicated and monitored ISO storage domain
- Avoid force-stopping VMs during installation phases
Conclusion
The “CD-ROM ISO image is locked” error in oVirt is a protective mechanism designed to maintain platform integrity.
When addressed systematically—by validating ISO ownership, storage domain health, and engine consistency—the issue can be resolved quickly and without service disruption.
Implementing the preventive practices outlined above will significantly reduce recurrence in enterprise virtualization environments.
Frequently Asked Questions
Why does oVirt lock ISO images?
To prevent concurrent access, ensure storage integrity, and avoid inconsistent VM states.
Can ISO locks be force-removed?
No. ISO locks must be released through proper detachment, storage validation, or engine refresh procedures.
Does restarting oVirt Engine impact running workloads?
No. Running VMs continue operating normally during an engine restart.
