Streamline VM overlays and rootfs packages

Move the default guest package list into a repo manifest and record a hash beside built rootfs images so run/make-rootfs can warn when the docker-ready image is stale.

Switch the Firecracker launch path to a single sparse root overlay per VM instead of separate /home and /var disks, so many VMs can share the same base image while still installing packages under /var and working from /root.

Keep older images bootable by masking stale home.mount and var.mount units at boot, and scrub those obsolete fstab entries when customize.sh rebuilds an image. Verified with bash -n on the updated scripts; no live VM boot was run in this environment.

interactive.sh

@@ -7,7 +7,7 @@ log() {
 
 usage() {
   cat <<'EOF'
-Usage: ./interactive.sh <base-rootfs> [--out <path>] [--size <size>] [--home-size <size>] [--var-size <size>]
+Usage: ./interactive.sh <base-rootfs> [--out <path>] [--size <size>]
 
 Creates a writable copy of the base rootfs and boots a VM so you can
 customize it manually over SSH. No automatic package/config changes
@@ -45,14 +45,10 @@ BR_DEV="br-fc"
 BR_IP="172.16.0.1"
 CIDR="24"
 DNS_SERVER="1.1.1.1"
-DEFAULT_HOME_SIZE="2G"
-DEFAULT_VAR_SIZE="2G"
 
 BASE_ROOTFS=""
 OUT_ROOTFS=""
 SIZE_SPEC=""
-HOME_SIZE="$DEFAULT_HOME_SIZE"
-VAR_SIZE="$DEFAULT_VAR_SIZE"
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --out)
@@ -63,14 +59,6 @@ while [[ $# -gt 0 ]]; do
       SIZE_SPEC="${2:-}"
       shift 2
       ;;
-    --home-size)
-      HOME_SIZE="${2:-}"
-      shift 2
-      ;;
-    --var-size)
-      VAR_SIZE="${2:-}"
-      shift 2
-      ;;
     -h|--help)
       usage
       exit 0
@@ -115,9 +103,6 @@ if [[ -e "$OUT_ROOTFS" ]]; then
   exit 1
 fi
 
-HOME_BYTES="$(parse_size "$HOME_SIZE")" || { log "invalid --home-size value: $HOME_SIZE"; exit 1; }
-VAR_BYTES="$(parse_size "$VAR_SIZE")" || { log "invalid --var-size value: $VAR_SIZE"; exit 1; }
-
 log "copying base rootfs to $OUT_ROOTFS"
 cp --reflink=auto "$BASE_ROOTFS" "$OUT_ROOTFS"
 
@@ -143,8 +128,6 @@ mkdir -p "$VM_DIR"
 API_SOCK="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/banger/fc-$VM_TAG.sock"
 LOG_FILE="$VM_DIR/firecracker.log"
 TAP_DEV="tap-fc-$VM_TAG"
-HOME_PATH="$VM_DIR/home.ext4"
-VAR_PATH="$VM_DIR/var.ext4"
 DNS_NAME=""
 
 # Allocate guest IP
@@ -185,15 +168,6 @@ sudo ip link set "$TAP_DEV" master "$BR_DEV"
 sudo ip link set "$TAP_DEV" up
 sudo ip link set "$BR_DEV" up
 
-if ! command -v mkfs.ext4 >/dev/null 2>&1; then
-  log "mkfs.ext4 required to create home/var disks"
-  exit 1
-fi
-truncate -s "$HOME_BYTES" "$HOME_PATH"
-mkfs.ext4 -F "$HOME_PATH" >/dev/null
-truncate -s "$VAR_BYTES" "$VAR_PATH"
-mkfs.ext4 -F "$VAR_PATH" >/dev/null
-
 log "starting firecracker process"
 rm -f "$API_SOCK"
 nohup sudo -E "$FC_BIN" --api-sock "$API_SOCK" >"$LOG_FILE" 2>&1 &
@@ -215,7 +189,7 @@ sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/machine-config \
     "smt": false
   }' >/dev/null
 
-KCMD="console=ttyS0 reboot=k panic=1 pci=off root=/dev/vda rw ip=${GUEST_IP}::${BR_IP}:255.255.255.0:${VM_NAME}:eth0:off:${DNS_SERVER} hostname=${VM_NAME}"
+KCMD="console=ttyS0 reboot=k panic=1 pci=off root=/dev/vda rw ip=${GUEST_IP}::${BR_IP}:255.255.255.0:${VM_NAME}:eth0:off:${DNS_SERVER} hostname=${VM_NAME} systemd.mask=home.mount systemd.mask=var.mount"
 
 sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/boot-source \
   -H "Content-Type: application/json" \
@@ -234,24 +208,6 @@ sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/drives/rootfs \
     \"is_read_only\": false
   }" >/dev/null
 
-sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/drives/home \
-  -H "Content-Type: application/json" \
-  -d "{
-    \"drive_id\": \"home\",
-    \"path_on_host\": \"$HOME_PATH\",
-    \"is_root_device\": false,
-    \"is_read_only\": false
-  }" >/dev/null
-
-sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/drives/var \
-  -H "Content-Type: application/json" \
-  -d "{
-    \"drive_id\": \"var\",
-    \"path_on_host\": \"$VAR_PATH\",
-    \"is_root_device\": false,
-    \"is_read_only\": false
-  }" >/dev/null
-
 sudo -E curl --unix-socket "$API_SOCK" -X PUT http://localhost/network-interfaces/eth0 \
   -H "Content-Type: application/json" \
   -d "{