diff --git a/roles/lmn_fvs/tasks/main.yml b/roles/lmn_fvs/tasks/main.yml
index adc3357..afffe10 100644
--- a/roles/lmn_fvs/tasks/main.yml
+++ b/roles/lmn_fvs/tasks/main.yml
@@ -50,6 +50,7 @@
       - pulseview
       - python3-websockets
       - qpdfview
+      - shellcheck
       - sigrok
       - sigrok-cli
       - tmux
@@ -64,6 +65,12 @@
   environment:
     http_proxy: '' # this is needed to avoid ttf-mscorefonts-installer picking up aptcacher
 
+- name: Remove update notifications from plasma-discover
+  apt:
+    name:
+      - plasma-discover
+    autoremove: true
+    state: absent
 
 - name: Make sure wireshark works for all users after installation and upgrades
   ansible.builtin.copy:
diff --git a/roles/lmn_vm/files/vm-netboot b/roles/lmn_vm/files/vm-netboot
new file mode 100755
index 0000000..dbb13bd
--- /dev/null
+++ b/roles/lmn_vm/files/vm-netboot
@@ -0,0 +1,61 @@
+#!/usr/bin/bash
+#
+# Start a netboot VM connected to macvtap device and fraction of mem/cpus
+#
+set -eu
+
+menu=(standard "CLI Standard Debian GNU/Linux"
+      kde-desktop "KDE Plasma Desktop Debian GNU/Linux"
+      gnome-desktop "Gnome Desktop Debian GNU/Linux")
+img=$(dialog --clear --backtitle "Virtual Machine Chooser" \
+             --title "Choose the Virtual Machine to Start" \
+             --menu "Start VM:" 12 60 6 \
+             "${menu[@]}" 2>&1 >/dev/tty)
+
+if [[ -z $img ]] ; then
+    echo "Starting VM canceled."
+    exit 1
+fi
+
+mac="$(ip link | grep -A1 "vm-macvtap" | \
+          sed -nE "s%\s+link/ether ([[:xdigit:]:]{17}) .+%\1%p")"
+
+if [[ $# -eq 0 ]] ; then
+    mem=$(sed -En "s/^MemTotal:\s+([0-9]+)\s+kB/\1/p" /proc/meminfo)
+    cpu=$(sed -En "0,/^cpu cores/s/^cpu cores\s+:\s+([0-9]+)/\1/p" /proc/cpuinfo)
+    arg=("--memory=$((mem/2048))" "--vcpu=$((cpu/2))")
+    echo Set options: "${arg[@]}"
+else
+    arg=("$@")
+fi
+
+kernel="http://livebox/d-i/n-live/$img/live/vmlinuz"
+initrd="http://livebox/d-i/n-live/$img/live/initrd.img"
+kargs=(boot=live components splash locales=de_DE.UTF-8 keyboard-layouts=de \
+                 swap=true live-config.timezone=Europe/Berlin netboot=nfs \
+                 "nfsroot=10.190.1.2:/srv/nfs/debian-live/$img/")
+
+type="ethernet,mac=${mac},target.dev=vm-macvtap,xpath1.set=./target/@managed=no"
+
+## FIXME: use passt, needs more settings for correct DNS/gateway
+# type=user,xpath1.create=./backend,xpath2.set=./backend/@type=passt,xpath3.create=./ip,xpath4.set=./ip/@family=ipv4,xpath5.set=./ip/@address=172.16.1.1,xpath6.set=./ip/@prefix=24,xpath7.create=./portForward,xpath8.set=./portForward/@proto=tcp,xpath9.set=./portForward/range/@start=2001,xpath10.set=./portForward/range/@end=2500,xpath11.set=./portForward/range/@to=1
+
+case "$img" in
+    standard)
+	arg+=("--autoconsole=text")
+	kargs+=("console=ttyS0")
+	;;
+    *)
+	;;
+esac
+
+http_proxy='' XDG_CONFIG_HOME="/tmp/${UID}/.config" \
+          exec virt-install \
+          --name "$img" \
+          --osinfo debiantesting \
+          --nodisks --import --noreboot --transient \
+          --install kernel="$kernel",initrd="$initrd",kernel_args="${kargs[*]}" \
+          --network "type=$type" "${arg[@]}"
+
+# --filesystem "$HOME",share
+# mount -t 9p share /mnt
diff --git a/roles/lmn_vm/tasks/main.yml b/roles/lmn_vm/tasks/main.yml
index 46f0c20..7d7e1b6 100644
--- a/roles/lmn_vm/tasks/main.yml
+++ b/roles/lmn_vm/tasks/main.yml
@@ -16,6 +16,7 @@
       - ctorrent
       - libvirt-daemon-system
       - virt-manager
+      - dialog # for vm-netboot menu
     state: latest
     autoremove: true
 
@@ -247,3 +248,17 @@
   command: sudo -u lmnsynci /usr/local/bin/sync-vm.sh -t
   register: result
   changed_when: result.stdout | length > 0
+
+- name: Start virt-manager in session mode by default
+  ansible.builtin.copy:
+    dest: /usr/local/bin/virt-manager
+    content: |
+      #!/usr/bin/sh
+      exec /usr/bin/virt-manager --connect qemu:///session $@
+    mode: '0755'
+
+- name: Copy vm-netboot script
+  ansible.builtin.copy:
+    src: vm-netboot
+    dest: /usr/local/bin/
+    mode: '0755'