Repository navigation
run-ephemeral: Use cloud-init=disabled instead of ds=None - #379
Merged
Merged
Conversation
Images with cloud-init installed ship a systemd drop-in (disable-sshd-keygen-if-cloud-init-active.conf) that adds a condition to sshd-keygen@.service preventing it from generating SSH host keys when the cloud-init generator has activated cloud-init. The previous ds=None kernel parameter caused the cloud-init generator to treat 'None' as a found datasource and create its activation symlink at /run/systemd/generator.early/multi-user.target.wants/cloud-init.target. This blocked sshd-keygen from generating host keys. However, in the to-disk flow, cloud-init itself never actually ran because the boot target (bcvk-to-disk.target) does not pull in multi-user.target. The result was that neither sshd-keygen nor cloud-init generated host keys, causing sshd to fail with 'no hostkeys available', which in turn caused bcvk to-disk to time out after 240 seconds waiting for SSH. Using cloud-init=disabled instead causes the cloud-init generator to not create the activation symlink at all, allowing sshd-keygen to run normally and generate host keys. Tested manually with a cloud-init-enabled bootc image; verified that sshd-keygen runs, sshd starts successfully, and to-disk completes. Assisted-by: AI Signed-off-by: John Eckersberg <dev@eckersberg.com>
Collaborator
Author
|
Man even with AI assistance this one took a while to run down |
cgwalters
enabled auto-merge (rebase)
September 25, 2026 23:44
Collaborator
Author
|
Man even with AI assistance this one took a while to run down
Yeah
Yeah that would also work I suppose, but this also seems to do the trick. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Images with cloud-init installed ship a systemd drop-in
(disable-sshd-keygen-if-cloud-init-active.conf) that adds a condition
to sshd-keygen@.service preventing it from generating SSH host keys
when the cloud-init generator has activated cloud-init. The previous
ds=None kernel parameter caused the cloud-init generator to treat
'None' as a found datasource and create its activation symlink at
/run/systemd/generator.early/multi-user.target.wants/cloud-init.target.
This blocked sshd-keygen from generating host keys.
However, in the to-disk flow, cloud-init itself never actually ran
because the boot target (bcvk-to-disk.target) does not pull in
multi-user.target. The result was that neither sshd-keygen nor
cloud-init generated host keys, causing sshd to fail with 'no
hostkeys available', which in turn caused bcvk to-disk to time out
after 240 seconds waiting for SSH.
Using cloud-init=disabled instead causes the cloud-init generator to
not create the activation symlink at all, allowing sshd-keygen to
run normally and generate host keys.
Tested manually with a cloud-init-enabled bootc image; verified that
sshd-keygen runs, sshd starts successfully, and to-disk completes.
Assisted-by: AI
Signed-off-by: John Eckersberg dev@eckersberg.com