Every network engineer hits the same wall eventually. You start with a tidy three-node lab on your laptop, then the design grows: a second region, a route reflector pair, a few VRFs, an EVPN fabric, maybe a firewall. Suddenly the fans are screaming, RAM is exhausted, and the lab takes longer to boot than it does to test.
Buying a dedicated home server solves it for a while — but now you own hardware, you maintain it, and it sits idle most of the week. We wanted a third option: rent the iron only while the lab is running. Spin up a beefy VM in the cloud, deploy the topology, do the work, then tear it all down and pay for the hours you actually used.
That is exactly what Simple Labs does. This post explains why it exists, who it is for, and what it looks like in practice.
Simple Labs (slabs on the command line) is a small Python CLI that automates the boring parts of running netlab and Containerlab on Google Cloud. In a single command it:
netlab up for you.ping and ssh straight into lab devices from your Mac.There is no web UI, no control plane, and no SaaS account. Just your gcloud credentials, a YAML topology, and the CLI.
If those two names are new to you, here is the short version: Containerlab orchestrates network operating systems as containers and wires them together into topologies. netlab sits one level higher, turning a compact YAML description of your topology into a fully configured, fully wired lab — handling addressing, protocols, and device config automatically.
Simple Labs does not replace either tool. It gives them a place to run when your laptop can’t.
The architecture is deliberately simple: one GCP VM (Ubuntu 22.04, n1-standard-4 or larger, nested virtualization on) running all the containers, with an optional WireGuard tunnel back to your Mac so you can reach the lab management network directly.
YOUR MAC GOOGLE CLOUD
┌──────────────────┐ ┌────────────────────────────────────┐
│ │ │ │
│ slabs CLI │ ──── GCP API (HTTPS) ────▶ │ Compute Engine VM (n1-standard-4) │
│ │ │ Ubuntu 22.04 + nested virt │
│ ~/.ssh/ │ ──── SSH (paramiko) ─────▶ │ netlab → containerlab → docker │
│ simplelabs │ │ │
│ │ │ clab mgmt bridge │
│ WireGuard app │ ◀═══ WG tunnel :51820 ═══▶ │ 192.168.121.0/24 │
└──────────────────┘ │ r1 r2 s1 s2 … │
│ (cEOS / Linux containers) │
└────────────────────────────────────┘The four steps that make up every session:
slabs vm create — provisions the VM via the Compute Engine API and runs the startup script that installs all tooling.slabs lab deploy — uploads a netlab topology YAML over SSH; netlab up renders it into a Containerlab spec and launches the containers.slabs vpn setup — installs WireGuard on the VM, opens UDP/51820 in the GCP firewall, and hands back a client config for your Mac.ping/ssh straight into any lab device on the clab mgmt subnet.# 1. Authenticate once
gcloud auth application-default login
# 2. Spin up a lab VM (waits until Docker/Containerlab/netlab are ready)
slabs vm create --name lab-vm --wait-ready
# 3. Deploy a topology
slabs lab deploy --vm lab-vm --topology labs/examples/simple-lab.yml --wait
# 4. (Optional) Set up VPN so you can reach lab devices from your Mac
slabs vpn setup --vm lab-vm --output ~/Downloads/lab-vpn.conf
# 5. Do the work ...
# 6. Clean up — pay only for what you used
slabs vm delete --name lab-vmThat is the whole product.
When you run slabs vm create with the default settings, the startup script installs:
Pass --no-tools if you want a bare VM and prefer to manage the toolchain yourself.
| Command | What it does |
|---|---|
slabs vm create | Provision a new GCP VM with nested virtualization and optional tool install |
slabs vm setup-status | Check whether the startup script finished successfully |
slabs vm list | List all VMs in the project with status and IPs |
slabs vm start / stop / suspend / resume / delete | Lifecycle management for existing VMs |
slabs lab deploy | Upload a topology YAML and run netlab up on the VM |
slabs lab status | Show running containers and their states |
slabs lab stop | Destroy containers but keep files on the VM |
slabs lab imgload | Upload a Docker image tar.gz and docker load it on the VM |
slabs vpn setup | Install WireGuard server, open firewall, return client config |
slabs vpn status | Show WireGuard peer / handshake info |
slabs vpn get-config | Re-download the client config (e.g. after VM IP change) |
Simple Labs makes some opinionated choices that will not suit every reader:
n1-standard-4 running a medium EVPN fabric is cheap by enterprise standards, but it is not free. If your labs are small enough to live on a laptop, keep them there.slabs lab imgload uploads them, but cannot conjure them into existence.If those trade-offs are deal-breakers, a homelab or a tool like GNS3 or EVE-NG may be a better fit.
The first internal version of Simple Labs was a folder of shell scripts and a Makefile. It worked, but every engineer had to clone the repo, track which branch was current, and keep their local tweaks out of git. “Which script did you run?” is not a great question to answer at 11 pm when a lab refuses to come up.
Shipping slabs as a PyPI package fixed all three pain points at once: one install command that is the same on every laptop, semantic versions with a proper CHANGELOG, and a clean dependency boundary managed by uv. Network automation is overwhelmingly Python — meeting engineers where they already are mattered more than any clever alternative.
# Recommended (uv)
uv tool install slabs
# Alternative (pipx)
pipx install slabs
# Verify
slabs --helpRequires Python 3.11+ and a GCP project with the Compute Engine API and billing enabled.
gcloud CLI authenticated (gcloud auth application-default login)uv tool install slabsIf you try it and something breaks, open an issue on GitLab. Simple Labs is small on purpose — the best feedback at this stage is a real lab that refuses to boot.
