diff --git a/AGENTS.md b/AGENTS.md
index 5cfea46..60d086d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,55 +1,49 @@
 # Repository Guidelines
 
-## Project Structure & Module Organization
-- `cmd/banger` and `cmd/bangerd` are the primary user-facing entrypoints.
-- `internal/` contains the daemon, CLI, RPC, storage, Firecracker, and system integration code.
-- The VM lifecycle is now organized around daemon capabilities plus a structured guest-config builder. New host-integrated VM features should plug into that Go path instead of adding more one-off branches through `internal/daemon/vm.go`.
-- `scripts/customize.sh`, `scripts/make-rootfs.sh`, and `scripts/interactive.sh` remain as manual rootfs/customization helpers; normal VM lifecycle, NAT, `.vm` DNS, and daemon-driven image builds are handled by the Go control plane.
-- Source checkouts use a generated `./build/runtime/` bundle for Firecracker, kernels, modules, rootfs images, and helper copies. Bundle defaults come from `./build/runtime/bundle.json` when present. Those runtime artifacts are not meant to be tracked directly in Git.
-- The daemon keeps state under XDG directories rather than the old repo-local `state/` layout.
+## Project Structure
 
-## Build, Test, and Development Commands
-- `make build` builds `./build/bin/banger`, `./build/bin/bangerd`, and the bundled `./build/runtime/banger-vsock-agent` guest helper.
-- `make bench-create` benchmarks `vm create` and first-SSH readiness on the current host.
-- `make runtime-bundle` bootstraps `./build/runtime/` from the archive referenced by `RUNTIME_MANIFEST`; the checked-in `config/runtime-bundle.toml` is only a template.
-- `make void-kernel` downloads and stages a Void `linux6.12` kernel under `./build/runtime/void-kernel`, including extracted `vmlinux`, raw `vmlinuz`, a matching generated `initramfs`, config, and matching modules.
-- `make rootfs-void` builds an experimental local-only `x86_64-glibc` Void rootfs plus work-seed under `./build/runtime/`; it prefers staged `./build/runtime/void-kernel` modules when present, but does not replace the default Debian path or teach `banger image build` about Void.
-- `make verify-void` registers `void-exp` and runs the normal smoke test against that image.
-- `banger` validates required host tools per command and reports actionable missing-tool errors; do not assume one workstation's package set.
-- `./build/bin/banger vm create --name testbox` creates and starts a VM.
-- `./build/bin/banger vm create` now blocks until the guest reaches the daemon's default readiness checks and shows live progress stages on TTY stderr while it waits.
-- `./build/bin/banger vm ssh testbox` connects to a running guest using the runtime bundle SSH key and reminds the user if the VM is still running when the session exits.
-- `./build/bin/banger vm stop testbox` stops a VM while preserving its disks.
-- `./build/bin/banger vm stop vm-a vm-b vm-c` and `./build/bin/banger vm set --nat web-1 web-2` are supported; multi-VM lifecycle and `set` actions fan out concurrently through the CLI.
-- `./build/bin/banger doctor` reports runtime bundle, host tool, feature, and image-build readiness from the same Go checks used by the daemon.
-- `./build/bin/banger image register --name local --rootfs /abs/path/rootfs.ext4` creates or updates an unmanaged image record without changing the default image config; use it for experimental guest iteration paths such as Void.
-- `bangerd` now also serves a localhost web UI on `http://127.0.0.1:7777` by default unless `web_listen_addr = ""` disables it; the UI uses server-rendered templates, polls async VM/image operations, and keeps image path selection on the host via a server-side file picker.
+- `cmd/banger` and `cmd/bangerd` are the main user entrypoints.
+- `internal/` contains the daemon, CLI, RPC, storage, Firecracker integration, guest helpers, and web UI.
+- `scripts/` contains explicit manual helper workflows for rootfs and kernel preparation.
+- `build/bin/` is the canonical source-checkout build output.
+- `build/manual/` is the canonical source-checkout location for manual rootfs/kernel artifacts.
+
+## Build and Test
+
+- `make build` builds `./build/bin/banger`, `./build/bin/bangerd`, and `./build/bin/banger-vsock-agent`.
 - `make test` runs `go test ./...`.
-- `./scripts/verify.sh` runs the smoke test for the Go VM workflow.
+- `./build/bin/banger doctor` checks host readiness.
+- `./build/bin/banger image build --from-image <image>` builds a managed image from an existing registered image.
+- `./build/bin/banger image register ...` registers an unmanaged host-side image stack.
+- `./build/bin/banger image promote <image>` copies an unmanaged image into daemon-owned managed artifacts.
+- `make void-kernel`, `make rootfs-void`, and `make void-register` drive the experimental Void flow under `./build/manual`.
 
-## Coding Style & Naming Conventions
-- Go code should stay small, direct, and standard-library-first unless there is a clear reason otherwise.
-- Shell helpers use Bash with `set -euo pipefail`; keep remaining shell scripts strict and explicit.
-- Prefer lowercase filenames with short descriptive names.
-- Use `gofmt` for Go formatting; no extra formatter is configured for shell files.
+## Image Model
+
+- Managed images own the full boot set: rootfs, optional work-seed, kernel, optional initrd, and optional modules.
+- There is no runtime bundle and no auto-registered default image from disk paths.
+- `default_image_name` selects a registered image only.
+
+## Config
+
+- Config lives at `~/.config/banger/config.toml`.
+- Firecracker comes from `PATH` by default, or `firecracker_bin`.
+- SSH uses `ssh_key_path` or an auto-managed default key at `~/.config/banger/ssh/id_ed25519`.
+
+## Coding Style
+
+- Prefer small, direct Go code and standard library solutions.
+- Keep shell scripts strict with `set -euo pipefail`.
+- Use `gofmt` for Go formatting.
+
+## Testing Guidance
 
-## Testing Guidelines
 - Primary automated coverage is `go test ./...`.
-- Manual verification for VM lifecycle changes: `./build/bin/banger vm create`, confirm SSH access, then stop/delete the VM.
-- For host-integration changes, run `./build/bin/banger doctor` as a quick readiness check before the live VM smoke.
-- The web UI follows the same sudo model as the CLI path: bangerd stays unprivileged and privileged writes only work when `sudo -v` is already warm or sudo is passwordless.
-- Rebuilt images now include `mise`, `opencode`, a host-reachable default `opencode` server service on guest TCP port `4096`, `tmux-resurrect`/`tmux-continuum` defaults for `root`, and the `banger-vsock-agent` service used by the SSH reminder and guest health-check path; if you change guest provisioning, document whether users need to rebuild `./build/runtime/rootfs-docker.ext4` or another base image to pick it up.
-- The experimental Void rootfs path now includes the repo's basic dev baseline plus Docker and Compose, alongside boot, SSH, a guest network bootstrap sourced from the kernel `ip=` cmdline, the vsock HTTP health agent, pinned `mise` plus `opencode` for `root`, the default host-reachable `opencode` server service on guest TCP port `4096`, a `bash` root shell while leaving `/bin/sh` alone, and the `/root` work-seed. When `./build/runtime/void-kernel/` exists, the Void image registration path expects a complete staged Void kernel, initramfs, and modules tree and points `void-exp` at it. Keep further baked-in tooling deliberate and user-driven.
-- Rebuilt images also emit a `work-seed.ext4` sidecar used to speed up future VM creates. Older managed images may take one slower create to refresh seeded SSH access before they rejoin the fast path. If you touch `/root` provisioning, verify both the rootfs and the work-seed output.
-- The daemon may keep idle TAP devices in a pool for faster creates. Smoke tests should treat `tap-pool-*` devices as reusable capacity, not cleanup leaks.
-- If you add a new operational workflow, document how to exercise it in `README.md`.
-- For NAT changes, verify both guest outbound access and host rule cleanup, for example with `./scripts/verify.sh --nat`.
+- For lifecycle changes, smoke-test with `vm create`, `vm ssh`, `vm stop`, and `vm delete`.
+- If guest provisioning changes, document whether existing images must be rebuilt or recreated.
 
-## Commit & Pull Request Guidelines
-- Git history uses short, imperative subjects.
-- Prefer a real commit body when the change affects lifecycle behavior, storage semantics, or host integration.
-- PRs should call out runtime requirements, migration impact, and any host-side verification performed.
+## Security
 
-## Security & Configuration Tips
-- The VM workflow requires `sudo` and `/dev/kvm` access; do not commit secrets.
-- `id_ed25519` lives inside the runtime bundle; rotate or replace it before publishing a shared bundle.
+- Do not commit secrets.
+- VM workflows require `sudo` and `/dev/kvm`.
+- The default SSH key is local configuration, not a checked-in runtime artifact.
diff --git a/Makefile b/Makefile
index 50a17fa..1b4e37e 100644
--- a/Makefile
+++ b/Makefile
@@ -6,50 +6,40 @@ INSTALL ?= install
 PREFIX ?= $(HOME)/.local
 BINDIR ?= $(PREFIX)/bin
 LIBDIR ?= $(PREFIX)/lib
-RUNTIMEDIR ?= $(LIBDIR)/banger
 DESTDIR ?=
 BUILD_DIR ?= build
 BUILD_BIN_DIR ?= $(BUILD_DIR)/bin
-RUNTIME_MANIFEST ?= config/runtime-bundle.toml
-RUNTIME_SOURCE_DIR ?= $(BUILD_DIR)/runtime
-RUNTIME_ARCHIVE ?= $(BUILD_DIR)/dist/banger-runtime.tar.gz
+BUILD_MANUAL_DIR ?= $(BUILD_DIR)/manual
 BANGER_BIN ?= $(BUILD_BIN_DIR)/banger
 BANGERD_BIN ?= $(BUILD_BIN_DIR)/bangerd
-BINARIES := $(BANGER_BIN) $(BANGERD_BIN)
-RUNTIME_HELPERS := $(RUNTIME_SOURCE_DIR)/banger-vsock-agent
+VSOCK_AGENT_BIN ?= $(BUILD_BIN_DIR)/banger-vsock-agent
+BINARIES := $(BANGER_BIN) $(BANGERD_BIN) $(VSOCK_AGENT_BIN)
 GO_SOURCES := $(shell find cmd internal -type f -name '*.go' | sort)
-RUNTIME_EXECUTABLES := firecracker customize.sh packages.sh namegen banger-vsock-agent
-RUNTIME_DATA_FILES := packages.apt id_ed25519 rootfs-docker.ext4
-RUNTIME_OPTIONAL_DATA_FILES := rootfs.ext4 rootfs-docker.work-seed.ext4 bundle.json
-RUNTIME_BOOT_FILES := wtf/root/boot/vmlinux-6.8.0-94-generic wtf/root/boot/initrd.img-6.8.0-94-generic
-RUNTIME_MODULES_DIR := wtf/root/lib/modules/6.8.0-94-generic
 VOID_IMAGE_NAME ?= void-exp
 VOID_VM_NAME ?= void-dev
 
 .DEFAULT_GOAL := help
 
-.PHONY: help build banger bangerd test fmt tidy clean rootfs rootfs-void void-kernel void-register void-vm verify-void install runtime-bundle runtime-package check-runtime bench-create
+.PHONY: help build banger bangerd test fmt tidy clean rootfs rootfs-void void-kernel void-register void-vm verify-void install bench-create
 
 help:
 	@printf '%s\n' \
 	  'Targets:' \
-	  '  make build   Build ./build/bin/banger and ./build/bin/bangerd' \
-	  '  make runtime-bundle Fetch and unpack ./build/runtime from the archive referenced by $(RUNTIME_MANIFEST)' \
-	  '  make runtime-package Package $(RUNTIME_SOURCE_DIR) into $(RUNTIME_ARCHIVE) and print its SHA256' \
+	  '  make build   Build ./build/bin/banger, ./build/bin/bangerd, and ./build/bin/banger-vsock-agent' \
 	  '  make bench-create Benchmark vm create and SSH readiness with scripts/bench-create.sh' \
-	  '  make install Build and install binaries plus the runtime bundle into $(DESTDIR)$(BINDIR) and $(DESTDIR)$(RUNTIMEDIR)' \
+	  '  make install Build and install banger, bangerd, and the companion vsock helper' \
 	  '  make test    Run go test ./...' \
 	  '  make fmt     Format Go sources under cmd/ and internal/' \
 	  '  make tidy    Run go mod tidy' \
 	  '  make clean   Remove built Go binaries' \
-	  '  make rootfs  Rebuild the source-checkout default Debian rootfs image in ./build/runtime' \
-	  '  make void-kernel  Download and stage a Void kernel, initramfs, and modules under ./build/runtime/void-kernel' \
-	  '  make rootfs-void  Build an experimental Void Linux rootfs and work-seed in ./build/runtime' \
+	  '  make rootfs  Rebuild the manual Debian rootfs image in ./build/manual' \
+	  '  make void-kernel  Download and stage a Void kernel, initramfs, and modules under ./build/manual/void-kernel' \
+	  '  make rootfs-void  Build an experimental Void Linux rootfs and work-seed in ./build/manual' \
 	  '  make void-register  Register or update the experimental Void image as $(VOID_IMAGE_NAME)' \
 	  '  make void-vm  Register the experimental Void image and create a VM named $(VOID_VM_NAME)' \
 	  '  make verify-void  Register the experimental Void image and run scripts/verify.sh against it'
 
-build: $(BINARIES) $(RUNTIME_HELPERS)
+build: $(BINARIES)
 
 $(BANGER_BIN): $(GO_SOURCES) go.mod go.sum
 	mkdir -p "$(BUILD_BIN_DIR)"
@@ -59,9 +49,9 @@ $(BANGERD_BIN): $(GO_SOURCES) go.mod go.sum
 	mkdir -p "$(BUILD_BIN_DIR)"
 	$(GO) build -o "$(BANGERD_BIN)" ./cmd/bangerd
 
-$(RUNTIME_SOURCE_DIR)/banger-vsock-agent: $(GO_SOURCES) go.mod go.sum
-	mkdir -p "$(RUNTIME_SOURCE_DIR)"
-	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -o "$(RUNTIME_SOURCE_DIR)/banger-vsock-agent" ./cmd/banger-vsock-agent
+$(VSOCK_AGENT_BIN): $(GO_SOURCES) go.mod go.sum
+	mkdir -p "$(BUILD_BIN_DIR)"
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -o "$(VSOCK_AGENT_BIN)" ./cmd/banger-vsock-agent
 
 test:
 	$(GO) test ./...
@@ -74,55 +64,28 @@ tidy:
 
 clean:
 	rm -rf "$(BUILD_BIN_DIR)"
-	rm -f "$(RUNTIME_SOURCE_DIR)/banger-vsock-agent"
-
-runtime-bundle:
-	$(GO) run ./cmd/runtimebundle fetch --manifest "$(RUNTIME_MANIFEST)" --out "$(RUNTIME_SOURCE_DIR)"
-
-runtime-package:
-	$(GO) run ./cmd/runtimebundle package --manifest "$(RUNTIME_MANIFEST)" --runtime-dir "$(RUNTIME_SOURCE_DIR)" --out "$(RUNTIME_ARCHIVE)"
 
 bench-create: build
 	BANGER_BIN="$(abspath $(BANGER_BIN))" bash ./scripts/bench-create.sh $(ARGS)
 
-check-runtime:
-	@test -d "$(RUNTIME_SOURCE_DIR)" || { echo "missing runtime bundle directory: $(RUNTIME_SOURCE_DIR); run 'make runtime-bundle'" >&2; exit 1; }
-	@for path in $(RUNTIME_EXECUTABLES) $(RUNTIME_DATA_FILES) $(RUNTIME_BOOT_FILES) $(RUNTIME_MODULES_DIR); do \
-		test -e "$(RUNTIME_SOURCE_DIR)/$$path" || { echo "missing runtime artifact: $(RUNTIME_SOURCE_DIR)/$$path; run 'make runtime-bundle'" >&2; exit 1; }; \
-	done
-
-install: build check-runtime
+install: build
 	mkdir -p "$(DESTDIR)$(BINDIR)"
-	mkdir -p "$(DESTDIR)$(RUNTIMEDIR)"
-	mkdir -p "$(DESTDIR)$(RUNTIMEDIR)/wtf/root/boot"
-	mkdir -p "$(DESTDIR)$(RUNTIMEDIR)/wtf/root/lib/modules"
+	mkdir -p "$(DESTDIR)$(LIBDIR)/banger"
 	$(INSTALL) -m 0755 "$(BANGER_BIN)" "$(DESTDIR)$(BINDIR)/banger"
 	$(INSTALL) -m 0755 "$(BANGERD_BIN)" "$(DESTDIR)$(BINDIR)/bangerd"
-	@for path in $(RUNTIME_EXECUTABLES); do \
-		$(INSTALL) -m 0755 "$(RUNTIME_SOURCE_DIR)/$$path" "$(DESTDIR)$(RUNTIMEDIR)/$$path"; \
-	done
-	@for path in $(RUNTIME_DATA_FILES) $(RUNTIME_BOOT_FILES); do \
-		$(INSTALL) -m 0644 "$(RUNTIME_SOURCE_DIR)/$$path" "$(DESTDIR)$(RUNTIMEDIR)/$$path"; \
-	done
-	@for path in $(RUNTIME_OPTIONAL_DATA_FILES); do \
-		if test -e "$(RUNTIME_SOURCE_DIR)/$$path"; then \
-			$(INSTALL) -m 0644 "$(RUNTIME_SOURCE_DIR)/$$path" "$(DESTDIR)$(RUNTIMEDIR)/$$path"; \
-		fi; \
-	done
-	chmod 0600 "$(DESTDIR)$(RUNTIMEDIR)/id_ed25519"
-	cp -a "$(RUNTIME_SOURCE_DIR)/$(RUNTIME_MODULES_DIR)" "$(DESTDIR)$(RUNTIMEDIR)/wtf/root/lib/modules/"
+	$(INSTALL) -m 0755 "$(VSOCK_AGENT_BIN)" "$(DESTDIR)$(LIBDIR)/banger/banger-vsock-agent"
 
 rootfs:
-	BANGER_RUNTIME_DIR="$(abspath $(RUNTIME_SOURCE_DIR))" ./scripts/make-rootfs.sh
+	BANGER_MANUAL_DIR="$(abspath $(BUILD_MANUAL_DIR))" BANGER_BIN="$(abspath $(BANGER_BIN))" ./scripts/make-rootfs.sh $(ARGS)
 
 void-kernel:
-	BANGER_RUNTIME_DIR="$(abspath $(RUNTIME_SOURCE_DIR))" ./scripts/make-void-kernel.sh
+	BANGER_MANUAL_DIR="$(abspath $(BUILD_MANUAL_DIR))" ./scripts/make-void-kernel.sh $(ARGS)
 
 rootfs-void:
-	BANGER_RUNTIME_DIR="$(abspath $(RUNTIME_SOURCE_DIR))" ./scripts/make-rootfs-void.sh
+	BANGER_MANUAL_DIR="$(abspath $(BUILD_MANUAL_DIR))" BANGER_BIN="$(abspath $(BANGER_BIN))" ./scripts/make-rootfs-void.sh $(ARGS)
 
 void-register: build
-	BANGER_RUNTIME_DIR="$(abspath $(RUNTIME_SOURCE_DIR))" VOID_IMAGE_NAME="$(VOID_IMAGE_NAME)" BANGER_BIN="$(abspath $(BANGER_BIN))" ./scripts/register-void-image.sh
+	BANGER_MANUAL_DIR="$(abspath $(BUILD_MANUAL_DIR))" VOID_IMAGE_NAME="$(VOID_IMAGE_NAME)" BANGER_BIN="$(abspath $(BANGER_BIN))" ./scripts/register-void-image.sh
 
 void-vm: void-register
 	"$(abspath $(BANGER_BIN))" vm create --image "$(VOID_IMAGE_NAME)" --name "$(VOID_VM_NAME)"
diff --git a/README.md b/README.md
index b6b9235..88f8914 100644
--- a/README.md
+++ b/README.md
@@ -1,520 +1,196 @@
 # banger
 
-Persistent Firecracker development VMs managed through a Go daemon and CLI.
+`banger` manages Firecracker development VMs with a local daemon, managed image artifacts, and a localhost web UI.
 
 ## Requirements
-- Linux host with KVM (`/dev/kvm` access)
-- Vsock support for post-SSH liveness reminders (`/dev/vhost-vsock`)
-- Core VM lifecycle: `sudo`, `ip`, `dmsetup`, `losetup`, `blockdev`, `truncate`, `pgrep`, `chown`, `chmod`, `kill`
-- Guest rootfs patching: `e2cp`, `e2rm`, `debugfs`
-- Guest work disk creation/resizing: `mkfs.ext4`, `e2fsck`, `resize2fs`, `mount`, `umount`, `cp`
-- SSH and logs: `ssh`
-- Optional NAT: `iptables`, `sysctl`
-- Image build: the bundled SSH key plus the tools above; `banger image build` no longer shells out through `customize.sh`
 
-`banger` validates these per command and returns actionable errors instead of
-assuming one workstation layout.
+- Linux with `/dev/kvm`
+- `sudo`
+- Firecracker installed on `PATH`, or `firecracker_bin` set in config
+- The usual host tools checked by `./build/bin/banger doctor`
 
-## Runtime Bundle
-Runtime artifacts are no longer tracked directly in Git. Source checkouts use a
-generated `./build/runtime/` bundle, while installed binaries use
-`$(prefix)/lib/banger`.
+`banger` now owns complete managed image sets. A managed image includes:
 
-The bundle contains:
-- `firecracker`
-- `banger-vsock-agent` for the guest-side vsock HTTP health agent and SSH reminder checks
-- `bundle.json` with the bundle's default kernel/initrd/modules/rootfs paths
-- a kernel, initrd, and modules tree referenced by `bundle.json`
-- `rootfs-docker.ext4`
-- `rootfs-docker.work-seed.ext4` when present, used to seed `/root` quickly on
-  new VM creates
-- `rootfs.ext4` when present
-- `packages.apt`
-- `id_ed25519`
-- the helper scripts used by manual customization and installs
+- `rootfs`
+- optional `work-seed`
+- `kernel`
+- optional `initrd`
+- optional `modules`
 
-Bootstrap a source checkout from a local or published runtime archive. The
-checked-in [`config/runtime-bundle.toml`](/home/thales/projects/personal/banger/config/runtime-bundle.toml)
-is a template and intentionally ships with empty `url` and `sha256`.
-
-If you need to create a local archive first, do that from a checkout or machine
-that already has a populated `./build/runtime/` tree:
-```bash
-make runtime-package
-cp build/dist/banger-runtime.tar.gz /path/to/fresh-checkout/build/dist/
-```
-
-In the fresh checkout:
-```bash
-cp config/runtime-bundle.toml config/runtime-bundle.local.toml
-```
-
-Edit `config/runtime-bundle.local.toml` to point at the staged archive and checksum:
-```toml
-url = "./build/dist/banger-runtime.tar.gz"
-sha256 = "<sha256 printed by make runtime-package>"
-```
-
-Then bootstrap `./build/runtime/` with the local manifest copy:
-```bash
-make runtime-bundle RUNTIME_MANIFEST=config/runtime-bundle.local.toml
-```
-
-`url` may be a relative path, absolute path, `file:///...` URL, or HTTP(S)
-URL. `make install` will not fetch artifacts for you.
+There is no runtime bundle anymore.
 
 ## Build
+
 ```bash
 make build
 ```
 
-Run `make build` after `./build/runtime/` has been bootstrapped. It writes
-`./build/bin/banger`, `./build/bin/bangerd`, and refreshes the bundled
-`banger-vsock-agent` guest helper in `./build/runtime/`.
+This writes:
 
-Older ignored root artifacts such as `./runtime/`, `./banger`, and `./bangerd`
-are no longer the canonical source-checkout layout. Leave them alone if you
-still need them, or remove them manually after migrating to `build/`.
+- `./build/bin/banger`
+- `./build/bin/bangerd`
+- `./build/bin/banger-vsock-agent`
 
-If you have confirmed your current images and runtime settings no longer point
-at the old checkout-local paths, a one-time cleanup looks like:
-```bash
-rm -rf ./runtime ./banger ./bangerd
-```
+## Install
 
-Install into `~/.local/bin` by default, with the runtime bundle under
-`~/.local/lib/banger`:
 ```bash
 make install
 ```
 
-After `make install`, the installed `banger` and `bangerd` do not need the repo
-checkout to keep working.
+That installs:
 
-## Basic VM Workflow
-Create and boot a VM:
-```bash
-banger vm create --name calm-otter --disk-size 16G
-```
+- `banger`
+- `bangerd`
+- the `banger-vsock-agent` companion helper under `../lib/banger/`
 
-`banger vm create` now waits for full guest readiness by default, including the
-guest vsock agent and the default `opencode` service, and prints live progress
-stages on TTY stderr while it waits.
+## Config
 
-Check host/runtime readiness before creating VMs:
-```bash
-banger doctor
-```
+Config lives at `~/.config/banger/config.toml`.
 
-List VMs:
-```bash
-banger vm list
-```
+Supported keys:
 
-Inspect a VM:
-```bash
-banger vm show calm-otter
-banger vm stats calm-otter
-```
-
-SSH into a running VM:
-```bash
-banger vm ssh calm-otter
-```
-
-When the SSH session exits normally, `banger` checks the guest over vsock and
-reminds you if the VM is still running.
-
-Inspect host-reachable listening ports for a running VM:
-```bash
-banger vm ports calm-otter
-```
-
-Stop, restart, kill, or delete it:
-```bash
-banger vm stop calm-otter
-banger vm start calm-otter
-banger vm restart calm-otter
-banger vm kill --signal TERM calm-otter
-banger vm delete calm-otter
-```
-
-Update stopped VM settings:
-```bash
-banger vm set calm-otter --memory 2048 --vcpu 4 --disk-size 32G
-```
-
-Lifecycle and `set` actions also accept multiple VM refs and run them
-concurrently:
-```bash
-banger vm stop calm-otter buildbox api-1
-banger vm kill --signal KILL aa12bb34 cc56dd78
-banger vm set --nat web-1 web-2 web-3
-```
-
-## Daemon
-The CLI auto-starts `bangerd` when needed.
-
-Useful daemon commands:
-```bash
-banger daemon status
-banger daemon socket
-banger daemon stop
-```
-
-`banger daemon status` prints the daemon PID, socket path, daemon log path, and
-the built-in DNS listener address. The daemon also serves a local web UI on
-`http://127.0.0.1:7777` by default, and `daemon status` prints that URL when it
-is enabled.
-
-Use the web UI for dashboard, VM lifecycle, image inventory, VM create
-progress, ports/log inspection, and image build/register/promote/delete flows:
-```text
-http://127.0.0.1:7777
-```
-
-The image forms use a server-side host-path picker. They do not upload files
-through the browser; they select absolute paths that already exist on the host.
-Mutating actions in the UI require the same sudo readiness as the CLI-backed
-workflow. If the page shows writes as disabled, run:
-```bash
-sudo -v
-```
-and refresh the page.
-
-State lives under XDG directories:
-- config: `~/.config/banger`
-- state: `~/.local/state/banger`
-- cache: `~/.cache/banger`
-- runtime socket: `$XDG_RUNTIME_DIR/banger/bangerd.sock`
-
-Installed binaries resolve their runtime bundle from `../lib/banger` relative to
-the executable. Source-checkout binaries resolve it from `./build/runtime` next
-to `./build/bin/banger`, and still fall back to a legacy `./runtime` checkout
-bundle if that exists. You can override either with `runtime_dir` in
-`~/.config/banger/config.toml` or `BANGER_RUNTIME_DIR`.
-
-Useful config keys:
 - `log_level`
-- `runtime_dir`
-- `web_listen_addr` (`""` disables the web UI)
-- `tap_pool_size`
+- `web_listen_addr`
 - `firecracker_bin`
-- `namegen_path`
-- `customize_script` (manual helper compatibility; `banger image build` is Go-native)
-- `vsock_agent_path`
-- `default_rootfs`
-- `default_work_seed`
-- `default_base_rootfs`
-- `default_kernel`
-- `default_initrd`
-- `default_modules_dir`
-- `default_packages_file`
+- `ssh_key_path`
+- `default_image_name`
+- `auto_stop_stale_after`
+- `stats_poll_interval`
+- `metrics_poll_interval`
+- `bridge_name`
+- `bridge_ip`
+- `cidr`
+- `tap_pool_size`
+- `default_dns`
 
-Guest SSH access always uses the private key shipped in the resolved runtime
-bundle. `ssh_key_path` is no longer a supported override for `banger vm ssh`,
-VM start key injection, or daemon guest provisioning.
+If `ssh_key_path` is unset, banger creates and uses:
 
-## Doctor
-`banger doctor` runs the same readiness checks the Go control plane uses for VM
-start, host-integrated features, and image builds. It reports runtime bundle
-state, core VM host tools, current feature readiness, and image-build
-prerequisites in a concise pass/warn/fail list.
+- `~/.config/banger/ssh/id_ed25519`
 
-Use it when bringing up a new machine, after changing the runtime bundle, or
-before adding new host-integrated VM features.
+`default_image_name` now only means “use this registered image when `vm create` omits `--image`”. The daemon does not auto-register images from host paths.
 
-## Logs
-- daemon lifecycle logs: `~/.local/state/banger/bangerd.log`
-- raw Firecracker output per VM: `~/.local/state/banger/vms/<vm-id>/firecracker.log`
-- raw image-build helper output: `~/.local/state/banger/image-build/*.log`
+## Core Workflow
 
-`bangerd.log` is structured JSON. Set `log_level` in
-`~/.config/banger/config.toml` or `BANGER_LOG_LEVEL` to one of `debug`,
-`info`, `warn`, or `error`.
+Check the host:
 
-## Images
-List images:
 ```bash
-banger image list
+./build/bin/banger doctor
 ```
 
-Build a managed image:
+Register an existing host-side image stack:
+
 ```bash
-banger image build --name docker-dev --docker
+./build/bin/banger image register \
+  --name base \
+  --rootfs /abs/path/rootfs.ext4 \
+  --kernel /abs/path/vmlinux \
+  --initrd /abs/path/initrd.img \
+  --modules /abs/path/modules
 ```
 
-The web UI exposes both managed image build and unmanaged image register forms.
-Builds run through an async progress page; register, promote, and delete remain
-direct form actions.
+Build a managed image from an existing registered image:
 
-Rebuilt images install a pinned `mise` at `/usr/local/bin/mise`, activate it
-for bash login and interactive shells, install `opencode` through `mise`,
-expose `/usr/local/bin/opencode`, configure `tmux-resurrect` plus
-`tmux-continuum` for `root` with periodic autosaves and manual-only restore by
-default, start a host-reachable `opencode serve` service on guest TCP port
-`4096`, and bake in the `banger-vsock-agent` systemd service used by the
-post-SSH reminder path and guest health checks. They
-also emit a `work-seed.ext4` sidecar that lets new VMs clone a prepared `/root`
-work disk instead of rebuilding it from scratch on every create.
-
-Show or delete images:
 ```bash
-banger image show docker-dev
-banger image delete docker-dev
+./build/bin/banger image build \
+  --name devbox \
+  --from-image base \
+  --docker
 ```
 
-Promote an existing unmanaged image into a managed one:
+Promote an unmanaged image into daemon-owned managed artifacts:
+
 ```bash
-banger image promote default
-banger image promote void-exp
+./build/bin/banger image promote base
 ```
 
-Promotion copies the image's `rootfs` and optional `work-seed` into the
-daemon's managed image state directory and keeps the same image ID, so existing
-VM references stay valid. The image's kernel, initrd, modules, and package
-manifest paths stay pointed at their current locations.
+Create and use a VM:
 
-`banger` auto-registers the bundled `default_rootfs` image when it exists. If
-the bundle does not include a separate base `rootfs.ext4`, `image build` falls
-back to using `rootfs-docker.ext4` as its default base image.
-
-## Networking And DNS
-Enable NAT when creating or updating a VM:
 ```bash
-banger vm create --name web --nat
-banger vm set web --nat
-banger vm set web --no-nat
+./build/bin/banger vm create --image devbox --name testbox
+./build/bin/banger vm ssh testbox
+./build/bin/banger vm stop testbox
 ```
 
-NAT is applied by the Go control plane using host `iptables` rules derived from
-the VM's current guest IP and TAP device. The remaining shell helpers also
-route NAT changes through `banger` instead of a standalone shell NAT script.
+`vm create` stays synchronous by default, but on a TTY it now shows live progress until the VM is fully ready.
 
-`bangerd` also serves a tiny authoritative DNS service on `127.0.0.1:42069`
-for daemon-managed VMs. Known `A` records resolve `<vm-name>.vm` to the VM's
-guest IPv4 address. Integrate your local resolver separately if you want
-transparent `.vm` lookups on the host.
+## Web UI
 
-`banger vm ports` asks the guest-side `banger-vsock-agent` to run `ss`, then
-prints host-usable endpoints plus the owning process/command. TCP listeners get
-short best-effort HTTP and HTTPS probes; detected web listeners are shown as
-`http` or `https`, and the endpoint column becomes a clickable URL such as
-`https://<hostname>.vm:port/`. Older images without `ss` may need rebuilding
-before `vm ports` works.
+`bangerd` serves a local web UI by default at:
 
-Newly rebuilt images also start `opencode serve` by default on guest TCP port
-`4096`, bound on guest interfaces so the host can reach it directly at the
-guest IP or via the endpoint shown by `banger vm ports`.
+- `http://127.0.0.1:7777`
 
-## Storage Model
-- VMs share a read-only base rootfs image.
-- Each VM gets its own sparse writable system overlay for `/`.
-- Each VM gets its own persistent ext4 work disk mounted at `/root`.
-- When an image has a `work-seed.ext4` sidecar, new VM creates clone that seed
-  and only resize it when needed.
-- Older managed images without the seeded SSH metadata may take one slower
-  create to repair `/root` access and refresh their managed work-seed; later
-  creates use the fast path.
-- Images without any `work-seed.ext4` still work, but create more slowly
-  because `/root` must be built from scratch.
-- The daemon can keep a small idle TAP pool warm in the background so VM create
-  does not need to synchronously create a fresh TAP every time. `tap_pool_size`
-  controls the pool depth.
+See the effective URL with:
 
-## Architecture Notes
-The Go daemon is the primary control plane. VM host integrations such as the
-built-in `.vm` DNS service, NAT, and `/root` work-disk wiring now sit behind a
-capability pipeline in the daemon instead of being open-coded through the VM
-lifecycle. Guest boot-time files and mounts are rendered through a structured
-guest-config builder rather than ad hoc `fstab` string mutation.
-
-That split is intentional: future host-integrated features should plug into the
-daemon capability path and `banger doctor` checks first, with the remaining
-shell helpers treated as manual workflows rather than architecture drivers.
-- Stopping a VM preserves its overlay and work disk.
-
-## Rebuilding The Repo Default Rootfs
-`config/packages.apt` controls the base apt packages baked into rebuilt images,
-including guest tools such as `ss` used by `banger vm ports`.
-
-To rebuild the source-checkout default image in `./build/runtime/rootfs-docker.ext4`:
 ```bash
-make rootfs
+./build/bin/banger daemon status
 ```
 
-That rebuild also regenerates `./build/runtime/rootfs-docker.work-seed.ext4`, which
-the daemon uses to speed up future `vm create` calls, and bakes in the default
-host-reachable `opencode` server service.
+Disable it with:
 
-If your runtime bundle does not include `./build/runtime/rootfs.ext4`, pass an
-explicit base image instead:
-```bash
-./scripts/make-rootfs.sh --base-rootfs /path/to/base-rootfs.ext4
+```toml
+web_listen_addr = ""
 ```
 
-If the package manifest changed and you want a fresh source-checkout image:
+## Guest Services
+
+Provisioned images include:
+
+- `banger-vsock-agent`
+- guest networking bootstrap
+- `mise`
+- `opencode`
+- a default guest `opencode` service on `0.0.0.0:4096`
+
+From the host:
+
 ```bash
-rm -f ./build/runtime/rootfs-docker.ext4 ./build/runtime/rootfs-docker.ext4.packages.sha256
-make rootfs
+./build/bin/banger vm ports testbox
+opencode attach http://<guest-ip>:4096
 ```
 
-`make rootfs` expects a bootstrapped runtime bundle. If `./build/runtime/rootfs.ext4`
-is not available, pass an explicit `--base-rootfs` to `./scripts/make-rootfs.sh`.
-Existing VMs keep using their current image and disks; rebuilds only affect VMs
-created from the rebuilt image afterward. Restarting an existing VM is not
-enough to pick up guest provisioning changes such as the default `opencode`
-server service.
+## Manual Helpers
+
+The shell helpers are now explicit manual workflows under `./build/manual`.
+
+Rebuild a Debian-style manual rootfs:
+
+```bash
+make rootfs ARGS='--base-rootfs /abs/path/rootfs.ext4 --kernel /abs/path/vmlinux --initrd /abs/path/initrd.img --modules /abs/path/modules'
+```
+
+The output lands in:
+
+- `./build/manual/rootfs-docker.ext4`
+- `./build/manual/rootfs-docker.work-seed.ext4`
+
+## Experimental Void Flow
+
+Stage a Void kernel:
 
-## Experimental Void Rootfs
-There is also a separate, opt-in builder for an experimental Void Linux guest
-path:
 ```bash
 make void-kernel
+```
+
+Build the experimental Void rootfs:
+
+```bash
 make rootfs-void
 ```
 
-That writes:
-- `./build/runtime/void-kernel/` when `make void-kernel` is used
-- `./build/runtime/rootfs-void.ext4`
-- `./build/runtime/rootfs-void.work-seed.ext4`
+Register it:
 
-This path is intentionally local-only and does not change the default Debian
-image flow. `make void-kernel` stages an actual Void `linux6.12` kernel package
-under `./build/runtime/void-kernel/`, including the raw `vmlinuz`, extracted
-Firecracker `vmlinux`, a matching `initramfs`, the matching config, and the
-matching modules tree. The initramfs is generated locally with `dracut`
-against the downloaded Void sysroot so the kernel, initrd, and modules stay
-aligned. `make rootfs-void` then prefers that staged modules tree when it exists;
-otherwise it falls back to the runtime bundle modules. The rootfs builder
-itself still builds a lean `x86_64-glibc` Void userspace with:
-- `bash` installed for interactive/admin use
-- pinned `mise` installed at `/usr/local/bin/mise`, activated for `root` bash shells
-- `opencode` installed through `mise`, with `/usr/local/bin/opencode` available by default
-- a guest network bootstrap that configures the VM NIC from the kernel `ip=` boot arg
-- a host-reachable `opencode serve` runit service enabled on guest TCP port `4096`
-- `docker` plus `docker-compose` installed from Void packages
-- the `docker` runit service enabled, with Docker netfilter/forwarding kernel prep
-- `openssh` enabled under runit
-- the bundled `banger-vsock-agent` health agent enabled under runit
-- `root` normalized to `/bin/bash` while keeping `/bin/sh` as the distro's system shell
-- a generated `/root` work-seed for fast creates
-
-It still keeps some Debian-oriented extras out for now:
-- no tmux plugin defaults
-
-The builder fetches official static XBPS tools and packages from the Void
-mirror during the build. The kernel fetcher and rootfs builder currently
-support only `x86_64`.
-
-The package set comes from [`config/packages.void`](/home/thales/projects/personal/banger/config/packages.void).
-You can override the mirror, size, output path, or kernel package directly:
 ```bash
-./scripts/make-void-kernel.sh --kernel-package linux6.12
-./scripts/make-rootfs-void.sh --mirror https://repo-default.voidlinux.org --size 2G
-```
-
-The fastest local iteration loop does not require changing your default image
-config at all:
-```bash
-make void-kernel
-make rootfs-void
 make void-register
-./build/bin/banger vm create --image void-exp --name void-dev
-./build/bin/banger vm ssh void-dev
 ```
 
-Rebuild the staged Void kernel or Void rootfs, then recreate existing
-`void-exp` VMs after changing the package set, guest provisioning, or staged
-kernel artifacts; restart alone will not update the image contents, kernel, or
-`/root` work-seed.
+That flow uses:
 
-There is also a smoke path for the experimental image:
-```bash
-make verify-void
-```
+- `./build/manual/void-kernel/`
+- `./build/manual/rootfs-void.ext4`
+- `./build/manual/rootfs-void.work-seed.ext4`
 
-`make void-register` uses the unmanaged image registration path to create or
-update a `void-exp` image record in place, so repeated rebuilds do not require
-editing `~/.config/banger/config.toml`. It expects a complete staged Void
-kernel set under `./build/runtime/void-kernel/` and points the experimental image at
-the staged Void `vmlinux`, `initramfs`, and matching modules tree.
+## Notes
 
-There is also a one-step helper target:
-```bash
-make void-vm VOID_VM_NAME=void-a
-```
-
-If you really want the Void image to become your default for `vm create`
-without `--image`, use the checked-in override template at
-[`examples/void-exp.config.toml`](/home/thales/projects/personal/banger/examples/void-exp.config.toml)
-and merge its four settings into `~/.config/banger/config.toml`.
-
-`banger image build` remains Debian-only in this pass. Do not point
-`default_base_rootfs` at the Void artifact yet.
-
-## Registering Unmanaged Images
-You can also register any local rootfs as an unmanaged image record without
-changing global defaults:
-```bash
-banger image register --name local-test --rootfs /abs/path/rootfs.ext4
-```
-
-Optional paths let you point at an existing work seed, kernel, initrd, modules,
-and package manifest:
-```bash
-banger image register \
-  --name void-exp \
-  --rootfs ./build/runtime/rootfs-void.ext4 \
-  --work-seed ./build/runtime/rootfs-void.work-seed.ext4 \
-  --kernel ./build/runtime/void-kernel/boot/vmlinux-6.12.77_1 \
-  --initrd ./build/runtime/void-kernel/boot/initramfs-6.12.77_1.img \
-  --modules ./build/runtime/void-kernel/lib/modules/6.12.77_1 \
-  --packages ./config/packages.void
-```
-
-If an unmanaged image with the same name already exists, `image register`
-updates it in place so future `vm create --image <name>` calls pick up the new
-artifacts immediately.
-
-## Maintaining The Runtime Bundle
-The checked-in [`config/runtime-bundle.toml`](/home/thales/projects/personal/banger/config/runtime-bundle.toml)
-is a template. Keep `bundle_metadata` accurate there, but use a separate local
-manifest copy when you need concrete `url` and `sha256` values for bootstrap
-testing or publication.
-
-Package a local `./build/runtime/` tree into an archive:
-```bash
-make runtime-package
-```
-
-That writes `build/dist/banger-runtime.tar.gz` and prints its SHA256 so you can update
-a local manifest copy before testing bootstrap changes or publishing the
-archive elsewhere.
-
-## Benchmarking Create Time
-Benchmark the current host's `vm create` wall time plus first-SSH readiness:
-```bash
-make bench-create
-```
-
-Pass options through `ARGS`, for example:
-```bash
-make bench-create ARGS="--runs 3 --image docker-dev"
-```
-
-The benchmark prints JSON with:
-- `create_ms`: wall time for `banger vm create`, including full readiness
-  gating for the guest vsock agent and default `opencode` service
-- `ssh_ready_ms`: wall time from create start until `banger vm ssh <vm> -- true`
-  succeeds
-
-## Remaining Shell Helpers
-The runtime VM lifecycle is managed through `banger`. The remaining shell scripts are not the primary user interface:
-- `scripts/customize.sh`: manual reference flow for rootfs customization; `banger image build` is now Go-native, but the script still reads
-  assets from `BANGER_RUNTIME_DIR` and stores transient state under
-  `BANGER_STATE_DIR`/XDG state
-- `scripts/make-rootfs.sh`: convenience wrapper for rebuilding `./build/runtime/rootfs-docker.ext4`
-- `scripts/interactive.sh`: manual one-off rootfs customization over SSH
-- `scripts/lib/packages.sh`: shell helper library
-- `scripts/verify.sh`: smoke test for the Go workflow (`./scripts/verify.sh --nat` adds NAT coverage)
+- Firecracker is resolved from `PATH` by default.
+- Managed image delete removes the daemon-owned artifact dir.
+- The companion vsock helper is internal to the install/build layout, not a user-configured runtime path.
diff --git a/cmd/runtimebundle/main.go b/cmd/runtimebundle/main.go
deleted file mode 100644
index 28da9ea..0000000
--- a/cmd/runtimebundle/main.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package main
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"os"
-
-	"banger/internal/runtimebundle"
-)
-
-const (
-	defaultManifestPath = "config/runtime-bundle.toml"
-	defaultRuntimeDir   = "build/runtime"
-	defaultArchivePath  = "build/dist/banger-runtime.tar.gz"
-)
-
-func main() {
-	if len(os.Args) < 2 {
-		usage()
-		os.Exit(2)
-	}
-	switch os.Args[1] {
-	case "fetch":
-		if err := fetch(os.Args[2:]); err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-	case "package":
-		if err := pkg(os.Args[2:]); err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-	default:
-		usage()
-		os.Exit(2)
-	}
-}
-
-func fetch(args []string) error {
-	fs := flag.NewFlagSet("fetch", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-	manifestPath := fs.String("manifest", defaultManifestPath, "path to the runtime bundle manifest")
-	outDir := fs.String("out", defaultRuntimeDir, "destination runtime directory")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	manifest, err := runtimebundle.LoadManifest(*manifestPath)
-	if err != nil {
-		return err
-	}
-	return runtimebundle.Bootstrap(context.Background(), manifest, *manifestPath, *outDir)
-}
-
-func pkg(args []string) error {
-	fs := flag.NewFlagSet("package", flag.ContinueOnError)
-	fs.SetOutput(os.Stderr)
-	manifestPath := fs.String("manifest", defaultManifestPath, "path to the runtime bundle manifest")
-	runtimeDir := fs.String("runtime-dir", defaultRuntimeDir, "runtime directory to package")
-	outArchive := fs.String("out", defaultArchivePath, "output archive path")
-	if err := fs.Parse(args); err != nil {
-		return err
-	}
-	manifest, err := runtimebundle.LoadManifest(*manifestPath)
-	if err != nil {
-		return err
-	}
-	sum, err := runtimebundle.Package(*runtimeDir, *outArchive, manifest)
-	if err != nil {
-		return err
-	}
-	fmt.Println(sum)
-	return nil
-}
-
-func usage() {
-	fmt.Fprintln(os.Stderr, "usage: runtimebundle <fetch|package> [flags]")
-}
diff --git a/config/packages.apt b/config/packages.apt
deleted file mode 100644
index 54a5159..0000000
--- a/config/packages.apt
+++ /dev/null
@@ -1,10 +0,0 @@
-make
-git
-less
-tree
-ca-certificates
-curl
-wget
-iproute2
-vim
-tmux
diff --git a/config/packages.void b/config/packages.void
deleted file mode 100644
index 2b3b99e..0000000
--- a/config/packages.void
+++ /dev/null
@@ -1,27 +0,0 @@
-base-minimal
-base-devel
-bash
-openssh
-ca-certificates
-curl
-docker
-docker-compose
-fd
-fzf
-git
-iputils
-jq
-kmod
-iproute2
-less
-lsof
-make
-procps-ng
-psmisc
-ripgrep
-strace
-tmux
-vim
-unzip
-zip
-zstd
diff --git a/config/runtime-bundle.toml b/config/runtime-bundle.toml
deleted file mode 100644
index 460cb53..0000000
--- a/config/runtime-bundle.toml
+++ /dev/null
@@ -1,33 +0,0 @@
-# Template manifest for local or published runtime bundle archives.
-# Keep this checked-in file empty by default; use a local manifest copy with
-# concrete `url` and `sha256` values when bootstrapping `./build/runtime/`.
-version = "v0"
-url = ""
-sha256 = ""
-bundle_root = "runtime"
-required_paths = [
-  "firecracker",
-  "customize.sh",
-  "packages.sh",
-  "namegen",
-  "banger-vsock-agent",
-  "packages.apt",
-  "id_ed25519",
-  "rootfs-docker.ext4",
-  "wtf/root/boot/vmlinux-6.8.0-94-generic",
-  "wtf/root/boot/initrd.img-6.8.0-94-generic",
-  "wtf/root/lib/modules/6.8.0-94-generic",
-]
-
-[bundle_metadata]
-firecracker_bin = "firecracker"
-ssh_key_path = "id_ed25519"
-namegen_path = "namegen"
-customize_script = "customize.sh"
-vsock_agent_path = "banger-vsock-agent"
-default_packages_file = "packages.apt"
-default_rootfs = "rootfs-docker.ext4"
-default_work_seed = "rootfs-docker.work-seed.ext4"
-default_kernel = "wtf/root/boot/vmlinux-6.8.0-94-generic"
-default_initrd = "wtf/root/boot/initrd.img-6.8.0-94-generic"
-default_modules_dir = "wtf/root/lib/modules/6.8.0-94-generic"
diff --git a/examples/void-exp.config.toml b/examples/void-exp.config.toml
index 192f433..1266ada 100644
--- a/examples/void-exp.config.toml
+++ b/examples/void-exp.config.toml
@@ -1,14 +1,9 @@
 # Experimental Void Linux guest profile for local testing.
 #
-# Copy the values you want into ~/.config/banger/config.toml and replace
-# /abs/path/to/banger with your checkout path. Do not set default_base_rootfs
-# to the Void image yet; banger image build still assumes the Debian flow.
-# If you run `make void-kernel`, also merge the commented kernel/initrd/modules lines.
+# Register or promote a complete `void-exp` image first, then point the daemon
+# at it by name. Firecracker is resolved from PATH by default; set
+# `firecracker_bin` only if you need an override.
 
-runtime_dir = "/abs/path/to/banger/build/runtime"
 default_image_name = "void-exp"
-default_rootfs = "/abs/path/to/banger/build/runtime/rootfs-void.ext4"
-default_work_seed = "/abs/path/to/banger/build/runtime/rootfs-void.work-seed.ext4"
-# default_kernel = "/abs/path/to/banger/build/runtime/void-kernel/boot/vmlinux-6.12.77_1"
-# default_initrd = "/abs/path/to/banger/build/runtime/void-kernel/boot/initramfs-6.12.77_1.img"
-# default_modules_dir = "/abs/path/to/banger/build/runtime/void-kernel/lib/modules/6.12.77_1"
+# firecracker_bin = "/usr/bin/firecracker"
+# ssh_key_path = "/abs/path/to/private/key"
diff --git a/internal/api/types.go b/internal/api/types.go
index ca44542..fcd6961 100644
--- a/internal/api/types.go
+++ b/internal/api/types.go
@@ -149,7 +149,7 @@ type VMPortsResult struct {
 
 type ImageBuildParams struct {
 	Name       string `json:"name,omitempty"`
-	BaseRootfs string `json:"base_rootfs,omitempty"`
+	FromImage  string `json:"from_image,omitempty"`
 	Size       string `json:"size,omitempty"`
 	KernelPath string `json:"kernel_path,omitempty"`
 	InitrdPath string `json:"initrd_path,omitempty"`
@@ -164,7 +164,6 @@ type ImageRegisterParams struct {
 	KernelPath   string `json:"kernel_path,omitempty"`
 	InitrdPath   string `json:"initrd_path,omitempty"`
 	ModulesDir   string `json:"modules_dir,omitempty"`
-	PackagesPath string `json:"packages_path,omitempty"`
 	Docker       bool   `json:"docker,omitempty"`
 }
 
diff --git a/internal/cli/banger.go b/internal/cli/banger.go
index 89154e0..761172b 100644
--- a/internal/cli/banger.go
+++ b/internal/cli/banger.go
@@ -20,6 +20,7 @@ import (
 	"banger/internal/config"
 	"banger/internal/daemon"
 	"banger/internal/hostnat"
+	"banger/internal/imagepreset"
 	"banger/internal/model"
 	"banger/internal/paths"
 	"banger/internal/rpc"
@@ -101,7 +102,104 @@ func newInternalCommand() *cobra.Command {
 		Hidden: true,
 		RunE:   helpNoArgs,
 	}
-	cmd.AddCommand(newInternalNATCommand(), newInternalWorkSeedCommand())
+	cmd.AddCommand(
+		newInternalNATCommand(),
+		newInternalWorkSeedCommand(),
+		newInternalSSHKeyPathCommand(),
+		newInternalFirecrackerPathCommand(),
+		newInternalVSockAgentPathCommand(),
+		newInternalPackagesCommand(),
+	)
+	return cmd
+}
+
+func newInternalSSHKeyPathCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:    "ssh-key-path",
+		Hidden: true,
+		Args:   noArgsUsage("usage: banger internal ssh-key-path"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			layout, err := paths.Resolve()
+			if err != nil {
+				return err
+			}
+			cfg, err := config.Load(layout)
+			if err != nil {
+				return err
+			}
+			_, err = fmt.Fprintln(cmd.OutOrStdout(), cfg.SSHKeyPath)
+			return err
+		},
+	}
+}
+
+func newInternalFirecrackerPathCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:    "firecracker-path",
+		Hidden: true,
+		Args:   noArgsUsage("usage: banger internal firecracker-path"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			layout, err := paths.Resolve()
+			if err != nil {
+				return err
+			}
+			cfg, err := config.Load(layout)
+			if err != nil {
+				return err
+			}
+			if strings.TrimSpace(cfg.FirecrackerBin) == "" {
+				return errors.New("firecracker binary not configured; install firecracker or set firecracker_bin")
+			}
+			_, err = fmt.Fprintln(cmd.OutOrStdout(), cfg.FirecrackerBin)
+			return err
+		},
+	}
+}
+
+func newInternalVSockAgentPathCommand() *cobra.Command {
+	return &cobra.Command{
+		Use:    "vsock-agent-path",
+		Hidden: true,
+		Args:   noArgsUsage("usage: banger internal vsock-agent-path"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			path, err := paths.CompanionBinaryPath("banger-vsock-agent")
+			if err != nil {
+				return err
+			}
+			_, err = fmt.Fprintln(cmd.OutOrStdout(), path)
+			return err
+		},
+	}
+}
+
+func newInternalPackagesCommand() *cobra.Command {
+	var docker bool
+	cmd := &cobra.Command{
+		Use:    "packages <debian|void>",
+		Hidden: true,
+		Args:   exactArgsUsage(1, "usage: banger internal packages <debian|void> [--docker]"),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			var packages []string
+			switch strings.TrimSpace(args[0]) {
+			case "debian":
+				packages = imagepreset.DebianBasePackages()
+				if docker {
+					packages = append(packages, "docker.io")
+				}
+			case "void":
+				packages = imagepreset.VoidBasePackages()
+			default:
+				return fmt.Errorf("unknown package preset %q", args[0])
+			}
+			for _, pkg := range packages {
+				if _, err := fmt.Fprintln(cmd.OutOrStdout(), pkg); err != nil {
+					return err
+				}
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&docker, "docker", false, "include docker-specific additions")
 	return cmd
 }
 
@@ -630,7 +728,7 @@ func newImageBuildCommand() *cobra.Command {
 		},
 	}
 	cmd.Flags().StringVar(&params.Name, "name", "", "image name")
-	cmd.Flags().StringVar(&params.BaseRootfs, "base-rootfs", "", "base rootfs path")
+	cmd.Flags().StringVar(&params.FromImage, "from-image", "", "registered base image id or name")
 	cmd.Flags().StringVar(&params.Size, "size", "", "output image size")
 	cmd.Flags().StringVar(&params.KernelPath, "kernel", "", "kernel path")
 	cmd.Flags().StringVar(&params.InitrdPath, "initrd", "", "initrd path")
@@ -644,7 +742,7 @@ func newImageRegisterCommand() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   "register",
 		Short: "Register or update an unmanaged image",
-		Args:  noArgsUsage("usage: banger image register --name <name> --rootfs <path> [--work-seed <path>] [--kernel <path>] [--initrd <path>] [--modules <dir>] [--packages <path>]"),
+		Args:  noArgsUsage("usage: banger image register --name <name> --rootfs <path> [--work-seed <path>] --kernel <path> [--initrd <path>] [--modules <dir>]"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := absolutizeImageRegisterPaths(&params); err != nil {
 				return err
@@ -669,7 +767,6 @@ func newImageRegisterCommand() *cobra.Command {
 	cmd.Flags().StringVar(&params.KernelPath, "kernel", "", "kernel path")
 	cmd.Flags().StringVar(&params.InitrdPath, "initrd", "", "initrd path")
 	cmd.Flags().StringVar(&params.ModulesDir, "modules", "", "modules dir")
-	cmd.Flags().StringVar(&params.PackagesPath, "packages", "", "packages manifest path")
 	cmd.Flags().BoolVar(&params.Docker, "docker", false, "mark image as docker-prepared")
 	return cmd
 }
@@ -1158,13 +1255,13 @@ func validateSSHPrereqs(cfg model.DaemonConfig) error {
 	checks := system.NewPreflight()
 	checks.RequireCommand("ssh", "install openssh-client")
 	if strings.TrimSpace(cfg.SSHKeyPath) != "" {
-		checks.RequireFile(cfg.SSHKeyPath, "runtime ssh private key", `refresh the runtime bundle`)
+		checks.RequireFile(cfg.SSHKeyPath, "ssh private key", `set "ssh_key_path" or let banger create its default key`)
 	}
 	return checks.Err("ssh preflight failed")
 }
 
 func absolutizeImageBuildPaths(params *api.ImageBuildParams) error {
-	return absolutizePaths(&params.BaseRootfs, &params.KernelPath, &params.InitrdPath, &params.ModulesDir)
+	return absolutizePaths(&params.KernelPath, &params.InitrdPath, &params.ModulesDir)
 }
 
 func absolutizeImageRegisterPaths(params *api.ImageRegisterParams) error {
@@ -1174,7 +1271,6 @@ func absolutizeImageRegisterPaths(params *api.ImageRegisterParams) error {
 		&params.KernelPath,
 		&params.InitrdPath,
 		&params.ModulesDir,
-		&params.PackagesPath,
 	)
 }
 
diff --git a/internal/cli/cli_test.go b/internal/cli/cli_test.go
index b0b0f63..f82b76d 100644
--- a/internal/cli/cli_test.go
+++ b/internal/cli/cli_test.go
@@ -163,7 +163,7 @@ func TestImageRegisterFlagsExist(t *testing.T) {
 	if err != nil {
 		t.Fatalf("find register: %v", err)
 	}
-	for _, flagName := range []string{"name", "rootfs", "work-seed", "kernel", "initrd", "modules", "packages", "docker"} {
+	for _, flagName := range []string{"name", "rootfs", "work-seed", "kernel", "initrd", "modules", "docker"} {
 		if register.Flags().Lookup(flagName) == nil {
 			t.Fatalf("missing flag %q", flagName)
 		}
@@ -427,7 +427,6 @@ func TestAbsolutizeImageRegisterPaths(t *testing.T) {
 		KernelPath:   filepath.Join(".", "runtime", "vmlinux"),
 		InitrdPath:   filepath.Join(".", "runtime", "initrd.img"),
 		ModulesDir:   filepath.Join(".", "runtime", "modules"),
-		PackagesPath: filepath.Join(".", "config", "packages.void"),
 	}
 
 	wd, err := os.Getwd()
@@ -450,7 +449,6 @@ func TestAbsolutizeImageRegisterPaths(t *testing.T) {
 		params.KernelPath,
 		params.InitrdPath,
 		params.ModulesDir,
-		params.PackagesPath,
 	} {
 		if !filepath.IsAbs(value) {
 			t.Fatalf("path %q is not absolute", value)
@@ -828,7 +826,7 @@ func TestAbsolutizeImageBuildPaths(t *testing.T) {
 	})
 
 	params := api.ImageBuildParams{
-		BaseRootfs: "images/base.ext4",
+		FromImage:  "base-image",
 		KernelPath: "/kernel",
 		InitrdPath: "boot/initrd.img",
 		ModulesDir: "modules",
@@ -838,7 +836,7 @@ func TestAbsolutizeImageBuildPaths(t *testing.T) {
 	}
 
 	want := api.ImageBuildParams{
-		BaseRootfs: filepath.Join(dir, "images/base.ext4"),
+		FromImage:  "base-image",
 		KernelPath: "/kernel",
 		InitrdPath: filepath.Join(dir, "boot/initrd.img"),
 		ModulesDir: filepath.Join(dir, "modules"),
diff --git a/internal/config/config.go b/internal/config/config.go
index ebdca41..bfaf926 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -1,38 +1,29 @@
 package config
 
 import (
-	"errors"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+	"encoding/pem"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 
 	toml "github.com/pelletier/go-toml"
+	"golang.org/x/crypto/ssh"
 
 	"banger/internal/model"
 	"banger/internal/paths"
-	"banger/internal/runtimebundle"
+	"banger/internal/system"
 )
 
 type fileConfig struct {
-	RuntimeDir         string  `toml:"runtime_dir"`
-	RepoRoot           string  `toml:"repo_root"`
 	LogLevel           string  `toml:"log_level"`
 	WebListenAddr      *string `toml:"web_listen_addr"`
 	FirecrackerBin     string  `toml:"firecracker_bin"`
 	SSHKeyPath         string  `toml:"ssh_key_path"`
-	NamegenPath        string  `toml:"namegen_path"`
-	CustomizeScript    string  `toml:"customize_script"`
-	VSockAgent         string  `toml:"vsock_agent_path"`
-	VSockPingHelper    string  `toml:"vsock_ping_helper_path"`
-	DefaultWorkSeed    string  `toml:"default_work_seed"`
 	DefaultImageName   string  `toml:"default_image_name"`
-	DefaultRootfs      string  `toml:"default_rootfs"`
-	DefaultBaseRootfs  string  `toml:"default_base_rootfs"`
-	DefaultKernel      string  `toml:"default_kernel"`
-	DefaultInitrd      string  `toml:"default_initrd"`
-	DefaultModulesDir  string  `toml:"default_modules_dir"`
-	DefaultPackages    string  `toml:"default_packages_file"`
 	AutoStopStaleAfter string  `toml:"auto_stop_stale_after"`
 	StatsPollInterval  string  `toml:"stats_poll_interval"`
 	MetricsPoll        string  `toml:"metrics_poll_interval"`
@@ -58,202 +49,130 @@ func Load(layout paths.Layout) (model.DaemonConfig, error) {
 		DefaultImageName:    "default",
 	}
 
-	path := filepath.Join(layout.ConfigDir, "config.toml")
-	info, err := os.Stat(path)
 	var file fileConfig
-	if err != nil {
-		if !os.IsNotExist(err) {
-			return cfg, err
-		}
-	} else if !info.IsDir() {
-		data, err := os.ReadFile(path)
+	configPath := filepath.Join(layout.ConfigDir, "config.toml")
+	if info, err := os.Stat(configPath); err == nil && !info.IsDir() {
+		data, err := os.ReadFile(configPath)
 		if err != nil {
 			return cfg, err
 		}
 		if err := toml.Unmarshal(data, &file); err != nil {
 			return cfg, err
 		}
-	}
-
-	cfg.RuntimeDir = paths.ResolveRuntimeDir(file.RuntimeDir, file.RepoRoot)
-	if err := applyRuntimeDefaults(&cfg); err != nil {
+	} else if err != nil && !os.IsNotExist(err) {
 		return cfg, err
 	}
 
-	if file.FirecrackerBin != "" {
-		cfg.FirecrackerBin = file.FirecrackerBin
-	}
-	if file.LogLevel != "" {
-		cfg.LogLevel = file.LogLevel
+	if value := strings.TrimSpace(file.LogLevel); value != "" {
+		cfg.LogLevel = value
 	}
 	if file.WebListenAddr != nil {
 		cfg.WebListenAddr = strings.TrimSpace(*file.WebListenAddr)
 	}
-	if file.NamegenPath != "" {
-		cfg.NamegenPath = file.NamegenPath
+	if value := strings.TrimSpace(file.FirecrackerBin); value != "" {
+		cfg.FirecrackerBin = value
+	} else if path, err := system.LookupExecutable("firecracker"); err == nil {
+		cfg.FirecrackerBin = path
 	}
-	if file.CustomizeScript != "" {
-		cfg.CustomizeScript = file.CustomizeScript
+	if value := strings.TrimSpace(file.DefaultImageName); value != "" {
+		cfg.DefaultImageName = value
 	}
-	if file.VSockAgent != "" {
-		cfg.VSockAgentPath = file.VSockAgent
-	} else if file.VSockPingHelper != "" {
-		cfg.VSockAgentPath = file.VSockPingHelper
+	if value := strings.TrimSpace(file.BridgeName); value != "" {
+		cfg.BridgeName = value
 	}
-	if file.DefaultWorkSeed != "" {
-		cfg.DefaultWorkSeed = file.DefaultWorkSeed
+	if value := strings.TrimSpace(file.BridgeIP); value != "" {
+		cfg.BridgeIP = value
 	}
-	if file.DefaultImageName != "" {
-		cfg.DefaultImageName = file.DefaultImageName
-	}
-	if file.DefaultRootfs != "" {
-		cfg.DefaultRootfs = file.DefaultRootfs
-	}
-	if file.DefaultBaseRootfs != "" {
-		cfg.DefaultBaseRootfs = file.DefaultBaseRootfs
-	}
-	if file.DefaultKernel != "" {
-		cfg.DefaultKernel = file.DefaultKernel
-	}
-	if file.DefaultInitrd != "" {
-		cfg.DefaultInitrd = file.DefaultInitrd
-	}
-	if file.DefaultModulesDir != "" {
-		cfg.DefaultModulesDir = file.DefaultModulesDir
-	}
-	if file.DefaultPackages != "" {
-		cfg.DefaultPackagesFile = file.DefaultPackages
-	}
-	if file.BridgeName != "" {
-		cfg.BridgeName = file.BridgeName
-	}
-	if file.BridgeIP != "" {
-		cfg.BridgeIP = file.BridgeIP
-	}
-	if file.CIDR != "" {
-		cfg.CIDR = file.CIDR
+	if value := strings.TrimSpace(file.CIDR); value != "" {
+		cfg.CIDR = value
 	}
 	if file.TapPoolSize > 0 {
 		cfg.TapPoolSize = file.TapPoolSize
 	}
-	if file.DefaultDNS != "" {
-		cfg.DefaultDNS = file.DefaultDNS
+	if value := strings.TrimSpace(file.DefaultDNS); value != "" {
+		cfg.DefaultDNS = value
 	}
-	if file.AutoStopStaleAfter != "" {
-		duration, err := time.ParseDuration(file.AutoStopStaleAfter)
+	if value := strings.TrimSpace(file.AutoStopStaleAfter); value != "" {
+		duration, err := time.ParseDuration(value)
 		if err != nil {
 			return cfg, err
 		}
 		cfg.AutoStopStaleAfter = duration
 	}
-	if file.StatsPollInterval != "" {
-		duration, err := time.ParseDuration(file.StatsPollInterval)
+	if value := strings.TrimSpace(file.StatsPollInterval); value != "" {
+		duration, err := time.ParseDuration(value)
 		if err != nil {
 			return cfg, err
 		}
 		cfg.StatsPollInterval = duration
 	}
-	if file.MetricsPoll != "" {
-		duration, err := time.ParseDuration(file.MetricsPoll)
+	if value := strings.TrimSpace(file.MetricsPoll); value != "" {
+		duration, err := time.ParseDuration(value)
 		if err != nil {
 			return cfg, err
 		}
 		cfg.MetricsPollInterval = duration
 	}
-	if value := os.Getenv("BANGER_LOG_LEVEL"); value != "" {
+	if value := strings.TrimSpace(os.Getenv("BANGER_LOG_LEVEL")); value != "" {
 		cfg.LogLevel = value
 	}
+
+	sshKeyPath, err := resolveSSHKeyPath(layout, file.SSHKeyPath)
+	if err != nil {
+		return cfg, err
+	}
+	cfg.SSHKeyPath = sshKeyPath
 	return cfg, nil
 }
 
-func applyRuntimeDefaults(cfg *model.DaemonConfig) error {
-	if cfg.RuntimeDir == "" {
-		return nil
+func resolveSSHKeyPath(layout paths.Layout, configured string) (string, error) {
+	configured = strings.TrimSpace(configured)
+	if configured != "" {
+		return configured, nil
 	}
-	meta, err := runtimebundle.LoadBundleMetadata(cfg.RuntimeDir)
-	switch {
-	case err == nil:
-		applyBundleMetadataDefaults(cfg, cfg.RuntimeDir, meta)
-	case errors.Is(err, os.ErrNotExist):
-		applyLegacyRuntimeDefaults(cfg)
-	default:
+	return ensureDefaultSSHKey(filepath.Join(layout.ConfigDir, "ssh", "id_ed25519"))
+}
+
+func ensureDefaultSSHKey(path string) (string, error) {
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		return "", err
+	}
+	if _, err := os.Stat(path); err == nil {
+		if err := ensurePublicKeyFile(path); err != nil {
+			return "", err
+		}
+		return path, nil
+	} else if !os.IsNotExist(err) {
+		return "", err
+	}
+
+	_, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return "", err
+	}
+	pkcs8, err := x509.MarshalPKCS8PrivateKey(privateKey)
+	if err != nil {
+		return "", err
+	}
+	privatePEM := pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8})
+	if err := os.WriteFile(path, privatePEM, 0o600); err != nil {
+		return "", err
+	}
+	if err := ensurePublicKeyFile(path); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func ensurePublicKeyFile(privateKeyPath string) error {
+	data, err := os.ReadFile(privateKeyPath)
+	if err != nil {
 		return err
 	}
-	if cfg.DefaultRootfs == "" {
-		cfg.DefaultRootfs = firstExistingRuntimePath(
-			filepath.Join(cfg.RuntimeDir, "rootfs-docker.ext4"),
-			filepath.Join(cfg.RuntimeDir, "rootfs.ext4"),
-		)
+	signer, err := ssh.ParsePrivateKey(data)
+	if err != nil {
+		return err
 	}
-	if cfg.DefaultBaseRootfs == "" {
-		cfg.DefaultBaseRootfs = firstExistingRuntimePath(
-			filepath.Join(cfg.RuntimeDir, "rootfs.ext4"),
-			cfg.DefaultRootfs,
-		)
-	}
-	if cfg.DefaultWorkSeed == "" && cfg.DefaultRootfs != "" {
-		cfg.DefaultWorkSeed = firstExistingRuntimePath(associatedWorkSeedPath(cfg.DefaultRootfs))
-	}
-	return nil
-}
-
-func applyBundleMetadataDefaults(cfg *model.DaemonConfig, runtimeDir string, meta runtimebundle.BundleMetadata) {
-	cfg.FirecrackerBin = defaultRuntimePath(cfg.FirecrackerBin, runtimeDir, meta.FirecrackerBin)
-	cfg.SSHKeyPath = defaultRuntimePath(cfg.SSHKeyPath, runtimeDir, meta.SSHKeyPath)
-	cfg.NamegenPath = defaultRuntimePath(cfg.NamegenPath, runtimeDir, meta.NamegenPath)
-	cfg.CustomizeScript = defaultRuntimePath(cfg.CustomizeScript, runtimeDir, meta.CustomizeScript)
-	cfg.VSockAgentPath = defaultRuntimePath(cfg.VSockAgentPath, runtimeDir, meta.VSockAgentPath)
-	cfg.DefaultWorkSeed = defaultRuntimePath(cfg.DefaultWorkSeed, runtimeDir, meta.DefaultWorkSeed)
-	cfg.DefaultKernel = defaultRuntimePath(cfg.DefaultKernel, runtimeDir, meta.DefaultKernel)
-	cfg.DefaultInitrd = defaultRuntimePath(cfg.DefaultInitrd, runtimeDir, meta.DefaultInitrd)
-	cfg.DefaultModulesDir = defaultRuntimePath(cfg.DefaultModulesDir, runtimeDir, meta.DefaultModulesDir)
-	cfg.DefaultPackagesFile = defaultRuntimePath(cfg.DefaultPackagesFile, runtimeDir, meta.DefaultPackages)
-	cfg.DefaultRootfs = defaultRuntimePath(cfg.DefaultRootfs, runtimeDir, meta.DefaultRootfs)
-	cfg.DefaultBaseRootfs = defaultRuntimePath(cfg.DefaultBaseRootfs, runtimeDir, meta.DefaultBaseRootfs)
-}
-
-func applyLegacyRuntimeDefaults(cfg *model.DaemonConfig) {
-	cfg.FirecrackerBin = defaultRuntimePath(cfg.FirecrackerBin, cfg.RuntimeDir, "firecracker")
-	cfg.SSHKeyPath = defaultRuntimePath(cfg.SSHKeyPath, cfg.RuntimeDir, "id_ed25519")
-	cfg.NamegenPath = defaultRuntimePath(cfg.NamegenPath, cfg.RuntimeDir, "namegen")
-	cfg.CustomizeScript = defaultRuntimePath(cfg.CustomizeScript, cfg.RuntimeDir, "customize.sh")
-	cfg.VSockAgentPath = firstExistingRuntimePath(
-		defaultRuntimePath(cfg.VSockAgentPath, cfg.RuntimeDir, "banger-vsock-agent"),
-		filepath.Join(cfg.RuntimeDir, "banger-vsock-pingd"),
-	)
-	cfg.DefaultWorkSeed = defaultRuntimePath(cfg.DefaultWorkSeed, cfg.RuntimeDir, "rootfs-docker.work-seed.ext4")
-	cfg.DefaultKernel = defaultRuntimePath(cfg.DefaultKernel, cfg.RuntimeDir, "wtf/root/boot/vmlinux-6.8.0-94-generic")
-	cfg.DefaultInitrd = defaultRuntimePath(cfg.DefaultInitrd, cfg.RuntimeDir, "wtf/root/boot/initrd.img-6.8.0-94-generic")
-	cfg.DefaultModulesDir = defaultRuntimePath(cfg.DefaultModulesDir, cfg.RuntimeDir, "wtf/root/lib/modules/6.8.0-94-generic")
-	cfg.DefaultPackagesFile = defaultRuntimePath(cfg.DefaultPackagesFile, cfg.RuntimeDir, "packages.apt")
-}
-
-func defaultRuntimePath(current, runtimeDir, relative string) string {
-	if current != "" || relative == "" {
-		return current
-	}
-	return filepath.Join(runtimeDir, relative)
-}
-
-func firstExistingRuntimePath(paths ...string) string {
-	for _, candidate := range paths {
-		if candidate == "" {
-			continue
-		}
-		if _, err := os.Stat(candidate); err == nil {
-			return candidate
-		}
-	}
-	return ""
-}
-
-func associatedWorkSeedPath(rootfsPath string) string {
-	rootfsPath = strings.TrimSpace(rootfsPath)
-	if rootfsPath == "" {
-		return ""
-	}
-	if strings.HasSuffix(rootfsPath, ".ext4") {
-		return strings.TrimSuffix(rootfsPath, ".ext4") + ".work-seed.ext4"
-	}
-	return rootfsPath + ".work-seed"
+	publicKey := ssh.MarshalAuthorizedKey(signer.PublicKey())
+	return os.WriteFile(privateKeyPath+".pub", publicKey, 0o644)
 }
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index 665ab9b..1934c6a 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -1,154 +1,70 @@
 package config
 
 import (
-	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"banger/internal/paths"
-	"banger/internal/runtimebundle"
 )
 
-func TestLoadDerivesArtifactPathsFromRuntimeDir(t *testing.T) {
-	runtimeDir := t.TempDir()
-	meta := runtimebundle.BundleMetadata{
-		FirecrackerBin:    "bin/firecracker",
-		SSHKeyPath:        "keys/id_ed25519",
-		NamegenPath:       "bin/namegen",
-		CustomizeScript:   "scripts/customize.sh",
-		VSockAgentPath:    "bin/banger-vsock-agent",
-		DefaultPackages:   "config/packages.apt",
-		DefaultRootfs:     "images/rootfs-docker.ext4",
-		DefaultWorkSeed:   "images/rootfs-docker.work-seed.ext4",
-		DefaultKernel:     "kernels/vmlinux",
-		DefaultInitrd:     "kernels/initrd.img",
-		DefaultModulesDir: "modules/current",
-	}
-	for _, rel := range []string{
-		meta.FirecrackerBin,
-		meta.SSHKeyPath,
-		meta.NamegenPath,
-		meta.CustomizeScript,
-		meta.VSockAgentPath,
-		meta.DefaultPackages,
-		meta.DefaultRootfs,
-		meta.DefaultWorkSeed,
-		meta.DefaultKernel,
-		meta.DefaultInitrd,
-		filepath.Join(meta.DefaultModulesDir, "modules.dep"),
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
-		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
-		}
-	}
-	data, err := json.Marshal(meta)
-	if err != nil {
-		t.Fatalf("Marshal: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(runtimeDir, runtimebundle.BundleMetadataFile), data, 0o644); err != nil {
-		t.Fatalf("write bundle metadata: %v", err)
+func TestLoadDefaultsResolveFirecrackerAndGenerateSSHKey(t *testing.T) {
+	configDir := t.TempDir()
+	binDir := t.TempDir()
+	firecrackerPath := filepath.Join(binDir, "firecracker")
+	if err := os.WriteFile(firecrackerPath, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
+		t.Fatalf("write firecracker: %v", err)
 	}
+	t.Setenv("PATH", binDir)
 
-	t.Setenv("BANGER_RUNTIME_DIR", runtimeDir)
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
+	cfg, err := Load(paths.Layout{ConfigDir: configDir})
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
 
-	if cfg.RuntimeDir != runtimeDir {
-		t.Fatalf("RuntimeDir = %q, want %q", cfg.RuntimeDir, runtimeDir)
+	if cfg.FirecrackerBin != firecrackerPath {
+		t.Fatalf("FirecrackerBin = %q, want %q", cfg.FirecrackerBin, firecrackerPath)
 	}
-	if cfg.FirecrackerBin != filepath.Join(runtimeDir, meta.FirecrackerBin) {
-		t.Fatalf("FirecrackerBin = %q", cfg.FirecrackerBin)
+	wantKey := filepath.Join(configDir, "ssh", "id_ed25519")
+	if cfg.SSHKeyPath != wantKey {
+		t.Fatalf("SSHKeyPath = %q, want %q", cfg.SSHKeyPath, wantKey)
 	}
-	if cfg.SSHKeyPath != filepath.Join(runtimeDir, meta.SSHKeyPath) {
-		t.Fatalf("SSHKeyPath = %q", cfg.SSHKeyPath)
+	for _, path := range []string{wantKey, wantKey + ".pub"} {
+		if _, err := os.Stat(path); err != nil {
+			t.Fatalf("stat %s: %v", path, err)
+		}
 	}
-	if cfg.NamegenPath != filepath.Join(runtimeDir, meta.NamegenPath) {
-		t.Fatalf("NamegenPath = %q", cfg.NamegenPath)
+	if cfg.DefaultImageName != "default" {
+		t.Fatalf("DefaultImageName = %q, want default", cfg.DefaultImageName)
 	}
-	if cfg.CustomizeScript != filepath.Join(runtimeDir, meta.CustomizeScript) {
-		t.Fatalf("CustomizeScript = %q", cfg.CustomizeScript)
-	}
-	if cfg.VSockAgentPath != filepath.Join(runtimeDir, meta.VSockAgentPath) {
-		t.Fatalf("VSockAgentPath = %q", cfg.VSockAgentPath)
-	}
-	if cfg.DefaultRootfs != filepath.Join(runtimeDir, meta.DefaultRootfs) {
-		t.Fatalf("DefaultRootfs = %q", cfg.DefaultRootfs)
-	}
-	if cfg.DefaultWorkSeed != filepath.Join(runtimeDir, meta.DefaultWorkSeed) {
-		t.Fatalf("DefaultWorkSeed = %q", cfg.DefaultWorkSeed)
-	}
-	if cfg.DefaultBaseRootfs != filepath.Join(runtimeDir, meta.DefaultRootfs) {
-		t.Fatalf("DefaultBaseRootfs = %q", cfg.DefaultBaseRootfs)
-	}
-	if cfg.DefaultKernel != filepath.Join(runtimeDir, meta.DefaultKernel) {
-		t.Fatalf("DefaultKernel = %q", cfg.DefaultKernel)
-	}
-	if cfg.DefaultInitrd != filepath.Join(runtimeDir, meta.DefaultInitrd) {
-		t.Fatalf("DefaultInitrd = %q", cfg.DefaultInitrd)
-	}
-	if cfg.DefaultModulesDir != filepath.Join(runtimeDir, meta.DefaultModulesDir) {
-		t.Fatalf("DefaultModulesDir = %q", cfg.DefaultModulesDir)
-	}
-	if cfg.DefaultPackagesFile != filepath.Join(runtimeDir, meta.DefaultPackages) {
-		t.Fatalf("DefaultPackagesFile = %q", cfg.DefaultPackagesFile)
+	if cfg.WebListenAddr != "127.0.0.1:7777" {
+		t.Fatalf("WebListenAddr = %q", cfg.WebListenAddr)
 	}
 }
 
-func TestLoadFallsBackToLegacyRuntimeLayoutWithoutBundleMetadata(t *testing.T) {
-	runtimeDir := t.TempDir()
-	for _, rel := range []string{
-		"firecracker",
-		"id_ed25519",
-		"namegen",
-		"customize.sh",
-		"banger-vsock-agent",
-		"packages.apt",
-		"rootfs-docker.ext4",
-		"rootfs-docker.work-seed.ext4",
-		"wtf/root/boot/vmlinux-6.8.0-94-generic",
-		"wtf/root/boot/initrd.img-6.8.0-94-generic",
-		"wtf/root/lib/modules/6.8.0-94-generic/modules.dep",
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
-		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
-		}
+func TestLoadAppliesConfigOverrides(t *testing.T) {
+	configDir := t.TempDir()
+	data := []byte(`
+log_level = "debug"
+web_listen_addr = ""
+firecracker_bin = "/opt/firecracker"
+ssh_key_path = "/tmp/custom-key"
+default_image_name = "void-exp"
+auto_stop_stale_after = "1h"
+stats_poll_interval = "15s"
+metrics_poll_interval = "30s"
+bridge_name = "br-test"
+bridge_ip = "10.0.0.1"
+cidr = "25"
+tap_pool_size = 8
+default_dns = "9.9.9.9"
+`)
+	if err := os.WriteFile(filepath.Join(configDir, "config.toml"), data, 0o644); err != nil {
+		t.Fatalf("write config.toml: %v", err)
 	}
 
-	t.Setenv("BANGER_RUNTIME_DIR", runtimeDir)
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-
-	if cfg.FirecrackerBin != filepath.Join(runtimeDir, "firecracker") {
-		t.Fatalf("FirecrackerBin = %q", cfg.FirecrackerBin)
-	}
-	if cfg.VSockAgentPath != filepath.Join(runtimeDir, "banger-vsock-agent") {
-		t.Fatalf("VSockAgentPath = %q", cfg.VSockAgentPath)
-	}
-	if cfg.DefaultWorkSeed != filepath.Join(runtimeDir, "rootfs-docker.work-seed.ext4") {
-		t.Fatalf("DefaultWorkSeed = %q", cfg.DefaultWorkSeed)
-	}
-	if cfg.DefaultKernel != filepath.Join(runtimeDir, "wtf/root/boot/vmlinux-6.8.0-94-generic") {
-		t.Fatalf("DefaultKernel = %q", cfg.DefaultKernel)
-	}
-}
-
-func TestLoadAppliesLogLevelEnvOverride(t *testing.T) {
-	t.Setenv("BANGER_LOG_LEVEL", "debug")
-
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
+	cfg, err := Load(paths.Layout{ConfigDir: configDir})
 	if err != nil {
 		t.Fatalf("Load: %v", err)
 	}
@@ -156,158 +72,46 @@ func TestLoadAppliesLogLevelEnvOverride(t *testing.T) {
 	if cfg.LogLevel != "debug" {
 		t.Fatalf("LogLevel = %q", cfg.LogLevel)
 	}
-}
-
-func TestLoadDefaultsLogLevelToInfo(t *testing.T) {
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.LogLevel != "info" {
-		t.Fatalf("LogLevel = %q, want info", cfg.LogLevel)
-	}
-}
-
-func TestLoadIgnoresConfigSSHKeyOverrideForGuestAccess(t *testing.T) {
-	runtimeDir := t.TempDir()
-	meta := runtimebundle.BundleMetadata{
-		FirecrackerBin:    "bin/firecracker",
-		SSHKeyPath:        "keys/id_ed25519",
-		NamegenPath:       "bin/namegen",
-		CustomizeScript:   "scripts/customize.sh",
-		VSockAgentPath:    "bin/banger-vsock-agent",
-		DefaultPackages:   "config/packages.apt",
-		DefaultRootfs:     "images/rootfs.ext4",
-		DefaultWorkSeed:   "images/rootfs.work-seed.ext4",
-		DefaultKernel:     "kernels/vmlinux",
-		DefaultModulesDir: "modules/current",
-	}
-	for _, rel := range []string{
-		meta.FirecrackerBin,
-		meta.SSHKeyPath,
-		meta.NamegenPath,
-		meta.CustomizeScript,
-		meta.VSockAgentPath,
-		meta.DefaultPackages,
-		meta.DefaultRootfs,
-		meta.DefaultWorkSeed,
-		meta.DefaultKernel,
-		filepath.Join(meta.DefaultModulesDir, "modules.dep"),
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
-		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
-		}
-	}
-	data, err := json.Marshal(meta)
-	if err != nil {
-		t.Fatalf("Marshal: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(runtimeDir, runtimebundle.BundleMetadataFile), data, 0o644); err != nil {
-		t.Fatalf("write bundle metadata: %v", err)
-	}
-
-	configDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(configDir, "config.toml"), []byte("ssh_key_path = \"/tmp/override-key\"\n"), 0o644); err != nil {
-		t.Fatalf("write config.toml: %v", err)
-	}
-
-	t.Setenv("BANGER_RUNTIME_DIR", runtimeDir)
-	cfg, err := Load(paths.Layout{ConfigDir: configDir})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-
-	want := filepath.Join(runtimeDir, meta.SSHKeyPath)
-	if cfg.SSHKeyPath != want {
-		t.Fatalf("SSHKeyPath = %q, want runtime key %q", cfg.SSHKeyPath, want)
-	}
-}
-
-func TestLoadAcceptsLegacyBundleVsockPingHelperPath(t *testing.T) {
-	runtimeDir := t.TempDir()
-	meta := runtimebundle.BundleMetadata{
-		FirecrackerBin:      "bin/firecracker",
-		SSHKeyPath:          "keys/id_ed25519",
-		NamegenPath:         "bin/namegen",
-		CustomizeScript:     "scripts/customize.sh",
-		VSockPingHelperPath: "bin/banger-vsock-pingd",
-		DefaultPackages:     "config/packages.apt",
-		DefaultRootfs:       "images/rootfs.ext4",
-		DefaultKernel:       "kernels/vmlinux",
-	}
-	for _, rel := range []string{
-		meta.FirecrackerBin,
-		meta.SSHKeyPath,
-		meta.NamegenPath,
-		meta.CustomizeScript,
-		meta.VSockPingHelperPath,
-		meta.DefaultPackages,
-		meta.DefaultRootfs,
-		meta.DefaultKernel,
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
-		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
-		}
-	}
-	data, err := json.Marshal(meta)
-	if err != nil {
-		t.Fatalf("Marshal: %v", err)
-	}
-	if err := os.WriteFile(filepath.Join(runtimeDir, runtimebundle.BundleMetadataFile), data, 0o644); err != nil {
-		t.Fatalf("write bundle metadata: %v", err)
-	}
-
-	t.Setenv("BANGER_RUNTIME_DIR", runtimeDir)
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.VSockAgentPath != filepath.Join(runtimeDir, meta.VSockPingHelperPath) {
-		t.Fatalf("VSockAgentPath = %q", cfg.VSockAgentPath)
-	}
-}
-
-func TestLoadAcceptsLegacyConfigVsockPingHelperPath(t *testing.T) {
-	configDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(configDir, "config.toml"), []byte("vsock_ping_helper_path = \"/tmp/legacy-agent\"\n"), 0o644); err != nil {
-		t.Fatalf("write config.toml: %v", err)
-	}
-
-	cfg, err := Load(paths.Layout{ConfigDir: configDir})
-	if err != nil {
-		t.Fatalf("Load: %v", err)
-	}
-	if cfg.VSockAgentPath != "/tmp/legacy-agent" {
-		t.Fatalf("VSockAgentPath = %q", cfg.VSockAgentPath)
-	}
-}
-
-func TestLoadWebListenAddrDefaultsAndAllowsDisable(t *testing.T) {
-	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
-	if err != nil {
-		t.Fatalf("Load default config: %v", err)
-	}
-	if cfg.WebListenAddr != "127.0.0.1:7777" {
-		t.Fatalf("WebListenAddr = %q, want default 127.0.0.1:7777", cfg.WebListenAddr)
-	}
-
-	configDir := t.TempDir()
-	if err := os.WriteFile(filepath.Join(configDir, "config.toml"), []byte("web_listen_addr = \"\"\n"), 0o644); err != nil {
-		t.Fatalf("write config.toml: %v", err)
-	}
-	cfg, err = Load(paths.Layout{ConfigDir: configDir})
-	if err != nil {
-		t.Fatalf("Load disabled config: %v", err)
-	}
 	if cfg.WebListenAddr != "" {
-		t.Fatalf("WebListenAddr = %q, want disabled empty string", cfg.WebListenAddr)
+		t.Fatalf("WebListenAddr = %q, want empty", cfg.WebListenAddr)
+	}
+	if cfg.FirecrackerBin != "/opt/firecracker" {
+		t.Fatalf("FirecrackerBin = %q", cfg.FirecrackerBin)
+	}
+	if cfg.SSHKeyPath != "/tmp/custom-key" {
+		t.Fatalf("SSHKeyPath = %q", cfg.SSHKeyPath)
+	}
+	if cfg.DefaultImageName != "void-exp" {
+		t.Fatalf("DefaultImageName = %q", cfg.DefaultImageName)
+	}
+	if cfg.AutoStopStaleAfter != time.Hour {
+		t.Fatalf("AutoStopStaleAfter = %s", cfg.AutoStopStaleAfter)
+	}
+	if cfg.StatsPollInterval != 15*time.Second {
+		t.Fatalf("StatsPollInterval = %s", cfg.StatsPollInterval)
+	}
+	if cfg.MetricsPollInterval != 30*time.Second {
+		t.Fatalf("MetricsPollInterval = %s", cfg.MetricsPollInterval)
+	}
+	if cfg.BridgeName != "br-test" || cfg.BridgeIP != "10.0.0.1" || cfg.CIDR != "25" {
+		t.Fatalf("bridge config = %+v", cfg)
+	}
+	if cfg.TapPoolSize != 8 {
+		t.Fatalf("TapPoolSize = %d", cfg.TapPoolSize)
+	}
+	if cfg.DefaultDNS != "9.9.9.9" {
+		t.Fatalf("DefaultDNS = %q", cfg.DefaultDNS)
+	}
+}
+
+func TestLoadAppliesLogLevelEnvOverride(t *testing.T) {
+	t.Setenv("BANGER_LOG_LEVEL", "warn")
+
+	cfg, err := Load(paths.Layout{ConfigDir: t.TempDir()})
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.LogLevel != "warn" {
+		t.Fatalf("LogLevel = %q, want warn", cfg.LogLevel)
 	}
 }
diff --git a/internal/daemon/capabilities.go b/internal/daemon/capabilities.go
index 0b866bc..d2ec524 100644
--- a/internal/daemon/capabilities.go
+++ b/internal/daemon/capabilities.go
@@ -208,11 +208,13 @@ func (workDiskCapability) PrepareHost(ctx context.Context, d *Daemon, vm *model.
 }
 
 func (workDiskCapability) AddDoctorChecks(_ context.Context, d *Daemon, report *system.Report) {
-	if strings.TrimSpace(d.config.DefaultWorkSeed) != "" && exists(d.config.DefaultWorkSeed) {
-		checks := system.NewPreflight()
-		checks.RequireFile(d.config.DefaultWorkSeed, "default work seed image", `rebuild the default runtime rootfs to regenerate the /root seed`)
-		report.AddPreflight("feature /root work disk", checks, "seeded /root work disk artifact available")
-		return
+	if d.store != nil && strings.TrimSpace(d.config.DefaultImageName) != "" {
+		if image, err := d.store.GetImageByName(context.Background(), d.config.DefaultImageName); err == nil && strings.TrimSpace(image.WorkSeedPath) != "" && exists(image.WorkSeedPath) {
+			checks := system.NewPreflight()
+			checks.RequireFile(image.WorkSeedPath, "default image work-seed", `rebuild the default image to regenerate the /root seed`)
+			report.AddPreflight("feature /root work disk", checks, "seeded /root work disk artifact available")
+			return
+		}
 	}
 	checks := system.NewPreflight()
 	for _, command := range []string{"mkfs.ext4", "mount", "umount", "cp"} {
diff --git a/internal/daemon/daemon.go b/internal/daemon/daemon.go
index 1042caf..e142fd3 100644
--- a/internal/daemon/daemon.go
+++ b/internal/daemon/daemon.go
@@ -11,7 +11,6 @@ import (
 	"net"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"
 	"sync"
 	"time"
@@ -85,7 +84,7 @@ func Open(ctx context.Context) (d *Daemon, err error) {
 		closing: make(chan struct{}),
 		pid:     os.Getpid(),
 	}
-	d.logger.Info("daemon opened", "socket", layout.SocketPath, "state_dir", layout.StateDir, "runtime_dir", cfg.RuntimeDir, "log_level", cfg.LogLevel)
+	d.logger.Info("daemon opened", "socket", layout.SocketPath, "state_dir", layout.StateDir, "log_level", cfg.LogLevel)
 	if err = d.startVMDNS(vmdns.DefaultListenAddr); err != nil {
 		d.logger.Error("daemon open failed", "stage", "start_vm_dns", "error", err.Error())
 		return nil, err
@@ -95,10 +94,6 @@ func Open(ctx context.Context) (d *Daemon, err error) {
 			_ = d.stopVMDNS()
 		}
 	}()
-	if err = d.ensureDefaultImage(ctx); err != nil {
-		d.logger.Error("daemon open failed", "stage", "ensure_default_image", "error", err.Error())
-		return nil, err
-	}
 	if err = d.reconcile(ctx); err != nil {
 		d.logger.Error("daemon open failed", "stage", "reconcile", "error", err.Error())
 		return nil, err
@@ -499,95 +494,8 @@ func (d *Daemon) stopVMDNS() error {
 }
 
 func (d *Daemon) ensureDefaultImage(ctx context.Context) error {
-	if d.config.DefaultImageName == "" {
-		return nil
-	}
-	desired, ok := d.desiredDefaultImage()
-	if !ok {
-		if d.logger != nil {
-			d.logger.Debug("default image skipped", "image_name", d.config.DefaultImageName, "rootfs_path", d.config.DefaultRootfs, "kernel_path", d.config.DefaultKernel)
-		}
-		return nil
-	}
-
-	image, err := d.store.GetImageByName(ctx, d.config.DefaultImageName)
-	switch {
-	case err == nil:
-		if image.Managed {
-			if d.logger != nil {
-				d.logger.Debug("managed default image left untouched", append(imageLogAttrs(image), "managed", image.Managed)...)
-			}
-			return nil
-		}
-		if defaultImageMatches(image, desired) {
-			if d.logger != nil {
-				d.logger.Debug("default image already current", imageLogAttrs(image)...)
-			}
-			return nil
-		}
-		updated := desired
-		updated.ID = image.ID
-		updated.CreatedAt = image.CreatedAt
-		updated.UpdatedAt = model.Now()
-		if err := d.store.UpsertImage(ctx, updated); err != nil {
-			return err
-		}
-		if d.logger != nil {
-			d.logger.Info("default image reconciled", append(imageLogAttrs(updated), "previous_rootfs_path", image.RootfsPath, "previous_work_seed_path", image.WorkSeedPath, "previous_kernel_path", image.KernelPath)...)
-		}
-		return nil
-	case errors.Is(err, sql.ErrNoRows):
-		id, err := model.NewID()
-		if err != nil {
-			return err
-		}
-		now := model.Now()
-		desired.ID = id
-		desired.CreatedAt = now
-		desired.UpdatedAt = now
-		if err := d.store.UpsertImage(ctx, desired); err != nil {
-			return err
-		}
-		if d.logger != nil {
-			d.logger.Info("default image registered", append(imageLogAttrs(desired), "managed", desired.Managed)...)
-		}
-		return nil
-	default:
-		return err
-	}
-}
-
-func (d *Daemon) desiredDefaultImage() (model.Image, bool) {
-	rootfs := d.config.DefaultRootfs
-	kernel := d.config.DefaultKernel
-	if !exists(rootfs) || !exists(kernel) {
-		return model.Image{}, false
-	}
-	return model.Image{
-		Name:         d.config.DefaultImageName,
-		Managed:      false,
-		ArtifactDir:  "",
-		RootfsPath:   rootfs,
-		WorkSeedPath: d.config.DefaultWorkSeed,
-		KernelPath:   kernel,
-		InitrdPath:   d.config.DefaultInitrd,
-		ModulesDir:   d.config.DefaultModulesDir,
-		PackagesPath: d.config.DefaultPackagesFile,
-		Docker:       strings.Contains(filepath.Base(rootfs), "docker"),
-	}, true
-}
-
-func defaultImageMatches(current, desired model.Image) bool {
-	return current.Name == desired.Name &&
-		current.Managed == desired.Managed &&
-		current.ArtifactDir == desired.ArtifactDir &&
-		current.RootfsPath == desired.RootfsPath &&
-		current.WorkSeedPath == desired.WorkSeedPath &&
-		current.KernelPath == desired.KernelPath &&
-		current.InitrdPath == desired.InitrdPath &&
-		current.ModulesDir == desired.ModulesDir &&
-		current.PackagesPath == desired.PackagesPath &&
-		current.Docker == desired.Docker
+	_ = ctx
+	return nil
 }
 
 func (d *Daemon) reconcile(ctx context.Context) error {
diff --git a/internal/daemon/daemon_test.go b/internal/daemon/daemon_test.go
index 82ffa7f..dc43c59 100644
--- a/internal/daemon/daemon_test.go
+++ b/internal/daemon/daemon_test.go
@@ -1,722 +1,106 @@
 package daemon
 
 import (
-	"bufio"
-	"bytes"
 	"context"
-	"encoding/json"
-	"net"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
-	"time"
 
 	"banger/internal/api"
 	"banger/internal/model"
 	"banger/internal/paths"
-	"banger/internal/rpc"
-	"banger/internal/store"
+	"banger/internal/system"
 )
 
-func TestEnsureDefaultImageUsesConfiguredDefaultRootfs(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, _, _, _ := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-
+func TestBuildImageRequiresFromImage(t *testing.T) {
 	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultImageName: "default",
-			DefaultRootfs:    rootfs,
-			DefaultKernel:    kernel,
-		},
-		store: db,
+		layout: paths.Layout{ImagesDir: t.TempDir(), StateDir: t.TempDir()},
+		store:  openDaemonStore(t),
+		runner: system.NewRunner(),
 	}
 
-	if err := d.ensureDefaultImage(context.Background()); err != nil {
-		t.Fatalf("ensureDefaultImage: %v", err)
-	}
-
-	image, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if image.RootfsPath != rootfs {
-		t.Fatalf("RootfsPath = %q, want %q", image.RootfsPath, rootfs)
-	}
-	if image.KernelPath != kernel {
-		t.Fatalf("KernelPath = %q, want %q", image.KernelPath, kernel)
-	}
-	if image.Managed {
-		t.Fatal("default image should be unmanaged")
+	_, err := d.BuildImage(context.Background(), api.ImageBuildParams{Name: "missing-base"})
+	if err == nil || !strings.Contains(err.Error(), "from-image is required") {
+		t.Fatalf("BuildImage() error = %v", err)
 	}
 }
 
-func TestEnsureDefaultImageLeavesCurrentUnmanagedDefaultUntouched(t *testing.T) {
+func TestRegisterImageRequiresKernel(t *testing.T) {
+	rootfs := filepath.Join(t.TempDir(), "rootfs.ext4")
+	if err := os.WriteFile(rootfs, []byte("rootfs"), 0o644); err != nil {
+		t.Fatalf("write rootfs: %v", err)
+	}
+	d := &Daemon{store: openDaemonStore(t)}
+
+	_, err := d.RegisterImage(context.Background(), api.ImageRegisterParams{
+		Name:       "missing-kernel",
+		RootfsPath: rootfs,
+	})
+	if err == nil || !strings.Contains(err.Error(), "kernel path is required") {
+		t.Fatalf("RegisterImage() error = %v", err)
+	}
+}
+
+func TestPromoteImageCopiesBootArtifactsIntoArtifactDir(t *testing.T) {
 	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, packages := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
+	rootfs := filepath.Join(dir, "rootfs.ext4")
+	kernel := filepath.Join(dir, "vmlinux")
+	initrd := filepath.Join(dir, "initrd.img")
+	modulesDir := filepath.Join(dir, "modules")
+	if err := os.MkdirAll(modulesDir, 0o755); err != nil {
+		t.Fatalf("mkdir modules: %v", err)
+	}
+	for path, data := range map[string]string{
+		rootfs:                              "rootfs",
+		kernel:                              "kernel",
+		initrd:                              "initrd",
+		filepath.Join(modulesDir, "depmod"): "modules",
+	} {
+		if err := os.WriteFile(path, []byte(data), 0o644); err != nil {
+			t.Fatalf("write %s: %v", path, err)
+		}
+	}
+
+	db := openDaemonStore(t)
 	image := model.Image{
-		ID:           "default-id",
-		Name:         "default",
-		Managed:      false,
-		RootfsPath:   rootfs,
-		KernelPath:   kernel,
-		InitrdPath:   initrd,
-		ModulesDir:   modulesDir,
-		PackagesPath: packages,
-		Docker:       true,
-		CreatedAt:    now,
-		UpdatedAt:    now,
+		ID:         "img-promote",
+		Name:       "void-exp",
+		Managed:    false,
+		RootfsPath: rootfs,
+		KernelPath: kernel,
+		InitrdPath: initrd,
+		ModulesDir: modulesDir,
+		CreatedAt:  model.Now(),
+		UpdatedAt:  model.Now(),
 	}
 	if err := db.UpsertImage(context.Background(), image); err != nil {
 		t.Fatalf("UpsertImage: %v", err)
 	}
 
-	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultImageName:    "default",
-			DefaultRootfs:       rootfs,
-			DefaultKernel:       kernel,
-			DefaultInitrd:       initrd,
-			DefaultModulesDir:   modulesDir,
-			DefaultPackagesFile: packages,
-		},
-		store: db,
-	}
-
-	if err := d.ensureDefaultImage(context.Background()); err != nil {
-		t.Fatalf("ensureDefaultImage: %v", err)
-	}
-
-	got, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if got.ID != image.ID {
-		t.Fatalf("ID = %q, want %q", got.ID, image.ID)
-	}
-	if !got.UpdatedAt.Equal(image.UpdatedAt) {
-		t.Fatalf("UpdatedAt = %s, want unchanged %s", got.UpdatedAt, image.UpdatedAt)
-	}
-}
-
-func TestEnsureDefaultImageReconcilesStaleUnmanagedDefaultInPlace(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, packages := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
-	stale := model.Image{
-		ID:           "default-id",
-		Name:         "default",
-		Managed:      false,
-		RootfsPath:   "/home/thales/projects/personal/banger/build/runtime/rootfs-docker.ext4",
-		KernelPath:   "/home/thales/projects/personal/banger/build/runtime/wtf/root/boot/vmlinux-6.8.0-94-generic",
-		InitrdPath:   "/home/thales/projects/personal/banger/build/runtime/wtf/root/boot/initrd.img-6.8.0-94-generic",
-		ModulesDir:   "/home/thales/projects/personal/banger/build/runtime/wtf/root/lib/modules/6.8.0-94-generic",
-		PackagesPath: "/home/thales/projects/personal/banger/build/runtime/packages.apt",
-		Docker:       true,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}
-	if err := db.UpsertImage(context.Background(), stale); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	vm := testVM("uses-default", stale.ID, "172.16.0.25")
-	if err := db.UpsertVM(context.Background(), vm); err != nil {
-		t.Fatalf("UpsertVM: %v", err)
+	imagesDir := filepath.Join(dir, "images")
+	if err := os.MkdirAll(imagesDir, 0o755); err != nil {
+		t.Fatalf("mkdir images dir: %v", err)
 	}
 
 	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultImageName:    "default",
-			DefaultRootfs:       rootfs,
-			DefaultKernel:       kernel,
-			DefaultInitrd:       initrd,
-			DefaultModulesDir:   modulesDir,
-			DefaultPackagesFile: packages,
-		},
-		store: db,
-	}
-
-	if err := d.ensureDefaultImage(context.Background()); err != nil {
-		t.Fatalf("ensureDefaultImage: %v", err)
-	}
-
-	got, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if got.ID != stale.ID {
-		t.Fatalf("ID = %q, want preserved %q", got.ID, stale.ID)
-	}
-	if !got.CreatedAt.Equal(stale.CreatedAt) {
-		t.Fatalf("CreatedAt = %s, want preserved %s", got.CreatedAt, stale.CreatedAt)
-	}
-	if got.RootfsPath != rootfs || got.KernelPath != kernel || got.InitrdPath != initrd || got.ModulesDir != modulesDir || got.PackagesPath != packages {
-		t.Fatalf("stale default not reconciled: %+v", got)
-	}
-	if !got.UpdatedAt.After(stale.UpdatedAt) {
-		t.Fatalf("UpdatedAt = %s, want newer than %s", got.UpdatedAt, stale.UpdatedAt)
-	}
-	gotVM, err := db.GetVMByID(context.Background(), vm.ID)
-	if err != nil {
-		t.Fatalf("GetVMByID: %v", err)
-	}
-	if gotVM.ImageID != stale.ID {
-		t.Fatalf("VM image ID = %q, want preserved %q", gotVM.ImageID, stale.ID)
-	}
-}
-
-func TestEnsureDefaultImageLeavesManagedDefaultUntouched(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, _, _, _ := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
-	managed := model.Image{
-		ID:         "managed-default",
-		Name:       "default",
-		Managed:    true,
-		RootfsPath: "/managed/rootfs.ext4",
-		KernelPath: "/managed/vmlinux",
-		CreatedAt:  now,
-		UpdatedAt:  now,
-	}
-	if err := db.UpsertImage(context.Background(), managed); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-
-	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultImageName: "default",
-			DefaultRootfs:    rootfs,
-			DefaultKernel:    kernel,
-		},
-		store: db,
-	}
-
-	if err := d.ensureDefaultImage(context.Background()); err != nil {
-		t.Fatalf("ensureDefaultImage: %v", err)
-	}
-
-	got, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if got.RootfsPath != managed.RootfsPath || got.KernelPath != managed.KernelPath {
-		t.Fatalf("managed default was rewritten: %+v", got)
-	}
-}
-
-func TestEnsureDefaultImageSkipsRewriteWhenCurrentArtifactsMissing(t *testing.T) {
-	dir := t.TempDir()
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
-	stale := model.Image{
-		ID:         "default-id",
-		Name:       "default",
-		Managed:    false,
-		RootfsPath: "/old/rootfs.ext4",
-		KernelPath: "/old/vmlinux",
-		CreatedAt:  now,
-		UpdatedAt:  now,
-	}
-	if err := db.UpsertImage(context.Background(), stale); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-
-	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultImageName: "default",
-			DefaultRootfs:    filepath.Join(dir, "missing-rootfs.ext4"),
-			DefaultKernel:    filepath.Join(dir, "missing-vmlinux"),
-		},
-		store: db,
-	}
-
-	if err := d.ensureDefaultImage(context.Background()); err != nil {
-		t.Fatalf("ensureDefaultImage: %v", err)
-	}
-
-	got, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if got.RootfsPath != stale.RootfsPath || got.KernelPath != stale.KernelPath {
-		t.Fatalf("default image should have stayed stale when no current artifacts exist: %+v", got)
-	}
-}
-
-func TestRegisterImageCreatesUnmanagedImage(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, _ := writeDefaultImageArtifacts(t, dir)
-	workSeed := filepath.Join(dir, "rootfs-void.work-seed.ext4")
-	packages := filepath.Join(dir, "packages.void")
-	if err := os.WriteFile(workSeed, []byte("seed"), 0o644); err != nil {
-		t.Fatalf("WriteFile(workSeed): %v", err)
-	}
-	if err := os.WriteFile(packages, []byte("base-minimal\nopenssh\n"), 0o644); err != nil {
-		t.Fatalf("WriteFile(packages): %v", err)
-	}
-	db := openDefaultImageStore(t, dir)
-	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultKernel:     kernel,
-			DefaultInitrd:     initrd,
-			DefaultModulesDir: modulesDir,
-		},
-		store: db,
-	}
-
-	image, err := d.RegisterImage(context.Background(), api.ImageRegisterParams{
-		Name:         "void-exp",
-		RootfsPath:   rootfs,
-		WorkSeedPath: workSeed,
-		PackagesPath: packages,
-	})
-	if err != nil {
-		t.Fatalf("RegisterImage: %v", err)
-	}
-	if image.Managed {
-		t.Fatal("registered image should be unmanaged")
-	}
-	if image.Name != "void-exp" || image.RootfsPath != rootfs || image.WorkSeedPath != workSeed || image.KernelPath != kernel {
-		t.Fatalf("registered image = %+v", image)
-	}
-}
-
-func TestRegisterImageUpdatesExistingUnmanagedImageInPlace(t *testing.T) {
-	dir := t.TempDir()
-	_, kernel, initrd, modulesDir, _ := writeDefaultImageArtifacts(t, dir)
-	newRootfs := filepath.Join(dir, "rootfs-void-next.ext4")
-	newWorkSeed := filepath.Join(dir, "rootfs-void-next.work-seed.ext4")
-	packages := filepath.Join(dir, "packages.void")
-	for _, path := range []string{newRootfs, newWorkSeed} {
-		if err := os.WriteFile(path, []byte("next"), 0o644); err != nil {
-			t.Fatalf("WriteFile(%s): %v", path, err)
-		}
-	}
-	if err := os.WriteFile(packages, []byte("base-minimal\n"), 0o644); err != nil {
-		t.Fatalf("WriteFile(packages): %v", err)
-	}
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
-	existing := model.Image{
-		ID:           "void-image-id",
-		Name:         "void-exp",
-		Managed:      false,
-		RootfsPath:   filepath.Join(dir, "old-rootfs.ext4"),
-		KernelPath:   kernel,
-		InitrdPath:   initrd,
-		ModulesDir:   modulesDir,
-		PackagesPath: packages,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}
-	if err := db.UpsertImage(context.Background(), existing); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	d := &Daemon{
-		config: model.DaemonConfig{
-			DefaultKernel:     kernel,
-			DefaultInitrd:     initrd,
-			DefaultModulesDir: modulesDir,
-		},
-		store: db,
-	}
-
-	image, err := d.RegisterImage(context.Background(), api.ImageRegisterParams{
-		Name:         "void-exp",
-		RootfsPath:   newRootfs,
-		WorkSeedPath: newWorkSeed,
-		PackagesPath: packages,
-	})
-	if err != nil {
-		t.Fatalf("RegisterImage: %v", err)
-	}
-	if image.ID != existing.ID || !image.CreatedAt.Equal(existing.CreatedAt) {
-		t.Fatalf("updated image identity changed: %+v", image)
-	}
-	if image.RootfsPath != newRootfs || image.WorkSeedPath != newWorkSeed {
-		t.Fatalf("updated image paths not applied: %+v", image)
-	}
-}
-
-func TestRegisterImageRejectsManagedOverwrite(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, _, _, _ := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 16, 12, 0, 0, 0, time.UTC)
-	if err := db.UpsertImage(context.Background(), model.Image{
-		ID:         "managed-id",
-		Name:       "void-exp",
-		Managed:    true,
-		RootfsPath: rootfs,
-		KernelPath: kernel,
-		CreatedAt:  now,
-		UpdatedAt:  now,
-	}); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	d := &Daemon{config: model.DaemonConfig{DefaultKernel: kernel}, store: db}
-
-	_, err := d.RegisterImage(context.Background(), api.ImageRegisterParams{
-		Name:       "void-exp",
-		RootfsPath: rootfs,
-	})
-	if err == nil || !strings.Contains(err.Error(), "cannot be updated via register") {
-		t.Fatalf("RegisterImage(managed) error = %v", err)
-	}
-}
-
-func TestPromoteImageCopiesArtifactsAndPreservesIdentity(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, packages := writeDefaultImageArtifacts(t, dir)
-	workSeed := filepath.Join(dir, "rootfs-docker.work-seed.ext4")
-	workSeedContent := []byte("seed-data")
-	if err := os.WriteFile(workSeed, workSeedContent, 0o644); err != nil {
-		t.Fatalf("WriteFile(workSeed): %v", err)
-	}
-
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 20, 12, 0, 0, 0, time.UTC)
-	existing := model.Image{
-		ID:           "promote-image-id",
-		Name:         "default",
-		Managed:      false,
-		RootfsPath:   rootfs,
-		WorkSeedPath: workSeed,
-		KernelPath:   kernel,
-		InitrdPath:   initrd,
-		ModulesDir:   modulesDir,
-		PackagesPath: packages,
-		Docker:       true,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}
-	if err := db.UpsertImage(context.Background(), existing); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	vm := testVM("uses-default", existing.ID, "172.16.0.44")
-	if err := db.UpsertVM(context.Background(), vm); err != nil {
-		t.Fatalf("UpsertVM: %v", err)
-	}
-
-	d := &Daemon{
-		layout: modelPathsLayoutForTest(dir),
+		layout: paths.Layout{ImagesDir: imagesDir},
 		store:  db,
+		runner: system.NewRunner(),
 	}
-
-	image, err := d.PromoteImage(context.Background(), "default")
+	got, err := d.PromoteImage(context.Background(), image.Name)
 	if err != nil {
 		t.Fatalf("PromoteImage: %v", err)
 	}
-	if !image.Managed {
+	if !got.Managed {
 		t.Fatal("promoted image should be managed")
 	}
-	if image.ID != existing.ID || image.Name != existing.Name {
-		t.Fatalf("promoted image identity changed: %+v", image)
-	}
-	if !image.CreatedAt.Equal(existing.CreatedAt) {
-		t.Fatalf("CreatedAt = %s, want preserved %s", image.CreatedAt, existing.CreatedAt)
-	}
-	if !image.UpdatedAt.After(existing.UpdatedAt) {
-		t.Fatalf("UpdatedAt = %s, want newer than %s", image.UpdatedAt, existing.UpdatedAt)
-	}
-	wantArtifactDir := filepath.Join(d.layout.ImagesDir, existing.ID)
-	if image.ArtifactDir != wantArtifactDir {
-		t.Fatalf("ArtifactDir = %q, want %q", image.ArtifactDir, wantArtifactDir)
-	}
-	if image.RootfsPath != filepath.Join(wantArtifactDir, "rootfs.ext4") {
-		t.Fatalf("RootfsPath = %q, want managed copy", image.RootfsPath)
-	}
-	if image.WorkSeedPath != filepath.Join(wantArtifactDir, "work-seed.ext4") {
-		t.Fatalf("WorkSeedPath = %q, want managed copy", image.WorkSeedPath)
-	}
-	if image.KernelPath != kernel || image.InitrdPath != initrd || image.ModulesDir != modulesDir || image.PackagesPath != packages {
-		t.Fatalf("boot support paths changed unexpectedly: %+v", image)
-	}
-
-	rootfsContent, err := os.ReadFile(rootfs)
-	if err != nil {
-		t.Fatalf("ReadFile(rootfs): %v", err)
-	}
-	managedRootfsContent, err := os.ReadFile(image.RootfsPath)
-	if err != nil {
-		t.Fatalf("ReadFile(managed rootfs): %v", err)
-	}
-	if !bytes.Equal(managedRootfsContent, rootfsContent) {
-		t.Fatal("managed rootfs copy content mismatch")
-	}
-	managedWorkSeedContent, err := os.ReadFile(image.WorkSeedPath)
-	if err != nil {
-		t.Fatalf("ReadFile(managed work seed): %v", err)
-	}
-	if !bytes.Equal(managedWorkSeedContent, workSeedContent) {
-		t.Fatal("managed work seed copy content mismatch")
-	}
-
-	got, err := db.GetImageByName(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("GetImageByName: %v", err)
-	}
-	if got.RootfsPath != image.RootfsPath || !got.Managed || got.ArtifactDir != image.ArtifactDir {
-		t.Fatalf("stored promoted image = %+v, want %+v", got, image)
-	}
-	gotVM, err := db.GetVMByID(context.Background(), vm.ID)
-	if err != nil {
-		t.Fatalf("GetVMByID: %v", err)
-	}
-	if gotVM.ImageID != existing.ID {
-		t.Fatalf("VM image ID = %q, want preserved %q", gotVM.ImageID, existing.ID)
-	}
-}
-
-func TestPromoteImageRejectsManagedImage(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, packages := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 20, 12, 0, 0, 0, time.UTC)
-	if err := db.UpsertImage(context.Background(), model.Image{
-		ID:           "managed-id",
-		Name:         "default",
-		Managed:      true,
-		ArtifactDir:  filepath.Join(dir, "images", "managed-id"),
-		RootfsPath:   rootfs,
-		KernelPath:   kernel,
-		InitrdPath:   initrd,
-		ModulesDir:   modulesDir,
-		PackagesPath: packages,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	d := &Daemon{
-		layout: modelPathsLayoutForTest(dir),
-		store:  db,
-	}
-
-	_, err := d.PromoteImage(context.Background(), "default")
-	if err == nil || !strings.Contains(err.Error(), "already managed") {
-		t.Fatalf("PromoteImage(managed) error = %v", err)
-	}
-}
-
-func TestPromoteImageSkipsMissingWorkSeed(t *testing.T) {
-	dir := t.TempDir()
-	rootfs, kernel, initrd, modulesDir, packages := writeDefaultImageArtifacts(t, dir)
-	db := openDefaultImageStore(t, dir)
-	now := time.Date(2026, time.March, 20, 12, 0, 0, 0, time.UTC)
-	existing := model.Image{
-		ID:           "promote-missing-seed",
-		Name:         "default",
-		Managed:      false,
-		RootfsPath:   rootfs,
-		WorkSeedPath: filepath.Join(dir, "missing.work-seed.ext4"),
-		KernelPath:   kernel,
-		InitrdPath:   initrd,
-		ModulesDir:   modulesDir,
-		PackagesPath: packages,
-		CreatedAt:    now,
-		UpdatedAt:    now,
-	}
-	if err := db.UpsertImage(context.Background(), existing); err != nil {
-		t.Fatalf("UpsertImage: %v", err)
-	}
-	d := &Daemon{
-		layout: modelPathsLayoutForTest(dir),
-		store:  db,
-	}
-
-	image, err := d.PromoteImage(context.Background(), "default")
-	if err != nil {
-		t.Fatalf("PromoteImage: %v", err)
-	}
-	if image.WorkSeedPath != "" {
-		t.Fatalf("WorkSeedPath = %q, want empty for missing source work seed", image.WorkSeedPath)
-	}
-	if _, err := os.Stat(filepath.Join(image.ArtifactDir, "work-seed.ext4")); !os.IsNotExist(err) {
-		t.Fatalf("managed work-seed should not exist, stat error = %v", err)
-	}
-}
-
-func openDefaultImageStore(t *testing.T, dir string) *store.Store {
-	t.Helper()
-	db, err := store.Open(filepath.Join(dir, "state.db"))
-	if err != nil {
-		t.Fatalf("open store: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = db.Close()
-	})
-	return db
-}
-
-func writeDefaultImageArtifacts(t *testing.T, dir string) (rootfs, kernel, initrd, modulesDir, packages string) {
-	t.Helper()
-	rootfs = filepath.Join(dir, "rootfs-docker.ext4")
-	kernel = filepath.Join(dir, "vmlinux")
-	initrd = filepath.Join(dir, "initrd.img")
-	modulesDir = filepath.Join(dir, "modules")
-	packages = filepath.Join(dir, "packages.apt")
-	files := []string{
-		rootfs,
-		kernel,
-		initrd,
-		packages,
-		filepath.Join(modulesDir, "modules.dep"),
-	}
-	for _, path := range files {
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
+	for _, path := range []string{got.RootfsPath, got.KernelPath, got.InitrdPath, got.ModulesDir} {
+		if !strings.HasPrefix(path, got.ArtifactDir) {
+			t.Fatalf("artifact path %q does not live under %q", path, got.ArtifactDir)
 		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
+		if _, err := os.Stat(path); err != nil {
+			t.Fatalf("stat %s: %v", path, err)
 		}
 	}
-	return rootfs, kernel, initrd, modulesDir, packages
-}
-
-func modelPathsLayoutForTest(dir string) paths.Layout {
-	return paths.Layout{
-		ImagesDir: filepath.Join(dir, "images"),
-	}
-}
-
-func TestStartVMDNSFailsWhenAddressBusy(t *testing.T) {
-	t.Parallel()
-
-	packetConn, err := net.ListenPacket("udp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("ListenPacket: %v", err)
-	}
-	defer packetConn.Close()
-
-	d := &Daemon{}
-	if err := d.startVMDNS(packetConn.LocalAddr().String()); err == nil {
-		t.Fatal("startVMDNS() succeeded on occupied address, want failure")
-	}
-}
-
-func TestSetDNSPublishesIntoDaemonServer(t *testing.T) {
-	t.Parallel()
-
-	d := &Daemon{}
-	if err := d.startVMDNS("127.0.0.1:0"); err != nil {
-		t.Fatalf("startVMDNS: %v", err)
-	}
-	defer d.stopVMDNS()
-
-	if err := d.setDNS(context.Background(), "devbox", "172.16.0.8"); err != nil {
-		t.Fatalf("setDNS: %v", err)
-	}
-	if _, ok := d.vmDNS.Lookup("devbox.vm"); !ok {
-		t.Fatal("devbox.vm missing after setDNS")
-	}
-}
-
-func TestDispatchUsesPassedContext(t *testing.T) {
-	t.Parallel()
-
-	db := openDefaultImageStore(t, t.TempDir())
-	d := &Daemon{store: db}
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	resp := d.dispatch(ctx, rpc.Request{
-		Version: rpc.Version,
-		Method:  "vm.list",
-		Params:  mustJSON(t, api.Empty{}),
-	})
-
-	if resp.OK {
-		t.Fatal("dispatch() succeeded with canceled context")
-	}
-	if resp.Error == nil || !strings.Contains(resp.Error.Message, context.Canceled.Error()) {
-		t.Fatalf("dispatch() error = %+v, want context canceled", resp.Error)
-	}
-}
-
-func TestHandleConnCancelsRequestWhenClientDisconnects(t *testing.T) {
-	t.Parallel()
-
-	server, client := net.Pipe()
-	defer client.Close()
-
-	requestCanceled := make(chan struct{})
-	done := make(chan struct{})
-	d := &Daemon{
-		closing: make(chan struct{}),
-		requestHandler: func(ctx context.Context, req rpc.Request) rpc.Response {
-			if req.Method != "block" {
-				t.Errorf("request method = %q, want block", req.Method)
-			}
-			<-ctx.Done()
-			close(requestCanceled)
-			return rpc.NewError("operation_failed", ctx.Err().Error())
-		},
-	}
-
-	go func() {
-		d.handleConn(server)
-		close(done)
-	}()
-
-	if err := json.NewEncoder(client).Encode(rpc.Request{Version: rpc.Version, Method: "block"}); err != nil {
-		t.Fatalf("encode request: %v", err)
-	}
-	if err := client.Close(); err != nil {
-		t.Fatalf("close client: %v", err)
-	}
-
-	select {
-	case <-requestCanceled:
-	case <-time.After(2 * time.Second):
-		t.Fatal("request context was not canceled after client disconnect")
-	}
-
-	select {
-	case <-done:
-	case <-time.After(2 * time.Second):
-		t.Fatal("handleConn did not return after client disconnect")
-	}
-}
-
-func TestWatchRequestDisconnectCancelsContextOnEOF(t *testing.T) {
-	t.Parallel()
-
-	server, client := net.Pipe()
-	defer server.Close()
-
-	reader := bufio.NewReader(server)
-	ctx, cancel := context.WithCancel(context.Background())
-	t.Cleanup(cancel)
-
-	d := &Daemon{closing: make(chan struct{})}
-	stop := d.watchRequestDisconnect(server, reader, "block", cancel)
-	defer stop()
-
-	if err := client.Close(); err != nil {
-		t.Fatalf("close client: %v", err)
-	}
-
-	select {
-	case <-ctx.Done():
-		if !strings.Contains(ctx.Err().Error(), context.Canceled.Error()) {
-			t.Fatalf("ctx.Err() = %v, want canceled", ctx.Err())
-		}
-	case <-time.After(2 * time.Second):
-		t.Fatal("watchRequestDisconnect did not cancel context")
-	}
-}
-
-func mustJSON(t *testing.T, v any) []byte {
-	t.Helper()
-	data, err := json.Marshal(v)
-	if err != nil {
-		t.Fatalf("json.Marshal(%T): %v", v, err)
-	}
-	return data
 }
diff --git a/internal/daemon/doctor.go b/internal/daemon/doctor.go
index e4c9802..b29c312 100644
--- a/internal/daemon/doctor.go
+++ b/internal/daemon/doctor.go
@@ -2,12 +2,13 @@ package daemon
 
 import (
 	"context"
-	"fmt"
+	"database/sql"
 	"strings"
 
 	"banger/internal/config"
 	"banger/internal/model"
 	"banger/internal/paths"
+	"banger/internal/store"
 	"banger/internal/system"
 )
 
@@ -25,34 +26,49 @@ func Doctor(ctx context.Context) (system.Report, error) {
 		config: cfg,
 		runner: system.NewRunner(),
 	}
+	db, err := store.Open(layout.DBPath)
+	if err == nil {
+		defer db.Close()
+		d.store = db
+	}
 	return d.doctorReport(ctx), nil
 }
 
 func (d *Daemon) doctorReport(ctx context.Context) system.Report {
 	report := system.Report{}
 
-	report.AddPreflight("runtime bundle", d.runtimeBundleChecks(), runtimeBundleStatus(d.config))
+	report.AddPreflight("host runtime", d.runtimeChecks(), runtimeStatus(d.config))
 	report.AddPreflight("core vm lifecycle", d.coreVMLifecycleChecks(), "required host tools available")
-	report.AddPreflight("vsock guest agent", d.vsockChecks(), "vsock agent prerequisites available")
+	report.AddPreflight("vsock guest agent", d.vsockChecks(), "vsock guest agent prerequisites available")
 	d.addCapabilityDoctorChecks(ctx, &report)
 	report.AddPreflight("image build", d.imageBuildChecks(ctx), "image build prerequisites available")
 
 	return report
 }
 
-func (d *Daemon) runtimeBundleChecks() *system.Preflight {
+func (d *Daemon) runtimeChecks() *system.Preflight {
 	checks := system.NewPreflight()
-	hint := paths.RuntimeBundleHint()
-	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", hint)
-	checks.RequireFile(d.config.SSHKeyPath, "runtime ssh private key", `refresh the runtime bundle`)
-	checks.RequireExecutable(d.config.VSockAgentPath, "vsock agent", `run 'make build' or refresh the runtime bundle`)
-	checks.RequireFile(d.config.DefaultRootfs, "default rootfs image", `set "default_rootfs" or refresh the runtime bundle`)
-	checks.RequireFile(d.config.DefaultKernel, "kernel image", `set "default_kernel" or refresh the runtime bundle`)
-	if strings.TrimSpace(d.config.DefaultInitrd) != "" {
-		checks.RequireFile(d.config.DefaultInitrd, "initrd image", `set "default_initrd" or refresh the runtime bundle`)
+	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", `install firecracker or set "firecracker_bin"`)
+	checks.RequireFile(d.config.SSHKeyPath, "ssh private key", `set "ssh_key_path" or let banger create its default key`)
+	if helper, err := d.vsockAgentBinary(); err == nil {
+		checks.RequireExecutable(helper, "vsock agent helper", `run 'make build' or reinstall banger`)
+	} else {
+		checks.Addf("%v", err)
 	}
-	if strings.TrimSpace(d.config.DefaultPackagesFile) != "" {
-		checks.RequireFile(d.config.DefaultPackagesFile, "package manifest", `set "default_packages_file" or refresh the runtime bundle`)
+	if d.store != nil && strings.TrimSpace(d.config.DefaultImageName) != "" {
+		image, err := d.store.GetImageByName(context.Background(), d.config.DefaultImageName)
+		switch {
+		case err == nil:
+			checks.RequireFile(image.RootfsPath, "default image rootfs", `re-register or rebuild the default image`)
+			checks.RequireFile(image.KernelPath, "default image kernel", `re-register or rebuild the default image`)
+			if strings.TrimSpace(image.InitrdPath) != "" {
+				checks.RequireFile(image.InitrdPath, "default image initrd", `re-register or rebuild the default image`)
+			}
+		case err != nil && err != sql.ErrNoRows:
+			checks.Addf("failed to inspect default image %q: %v", d.config.DefaultImageName, err)
+		default:
+			checks.Addf("default image %q is not registered", d.config.DefaultImageName)
+		}
 	}
 	return checks
 }
@@ -65,37 +81,33 @@ func (d *Daemon) coreVMLifecycleChecks() *system.Preflight {
 
 func (d *Daemon) imageBuildChecks(ctx context.Context) *system.Preflight {
 	checks := system.NewPreflight()
-	d.addImageBuildPrereqs(
-		ctx,
-		checks,
-		firstNonEmpty(d.config.DefaultBaseRootfs, d.config.DefaultRootfs),
-		d.config.DefaultKernel,
-		d.config.DefaultInitrd,
-		d.config.DefaultModulesDir,
-		"",
-	)
+	if d.store == nil || strings.TrimSpace(d.config.DefaultImageName) == "" {
+		checks.Addf("default image is not available for build inheritance")
+		return checks
+	}
+	image, err := d.store.GetImageByName(ctx, d.config.DefaultImageName)
+	if err != nil {
+		checks.Addf("default image %q is not registered", d.config.DefaultImageName)
+		return checks
+	}
+	d.addImageBuildPrereqs(ctx, checks, image.RootfsPath, image.KernelPath, image.InitrdPath, image.ModulesDir, "")
 	return checks
 }
 
 func (d *Daemon) vsockChecks() *system.Preflight {
 	checks := system.NewPreflight()
-	checks.RequireExecutable(d.config.VSockAgentPath, "vsock agent", `run 'make build' or refresh the runtime bundle`)
+	if helper, err := d.vsockAgentBinary(); err == nil {
+		checks.RequireExecutable(helper, "vsock agent helper", `run 'make build' or reinstall banger`)
+	} else {
+		checks.Addf("%v", err)
+	}
 	checks.RequireFile(vsockHostDevicePath, "vsock host device", "load the vhost_vsock kernel module on the host")
 	return checks
 }
 
-func runtimeBundleStatus(cfg model.DaemonConfig) string {
-	if strings.TrimSpace(cfg.RuntimeDir) == "" {
-		return "runtime dir not configured"
+func runtimeStatus(cfg model.DaemonConfig) string {
+	if strings.TrimSpace(cfg.FirecrackerBin) == "" {
+		return "firecracker not configured"
 	}
-	return fmt.Sprintf("runtime dir %s", cfg.RuntimeDir)
-}
-
-func firstNonEmpty(values ...string) string {
-	for _, value := range values {
-		if strings.TrimSpace(value) != "" {
-			return value
-		}
-	}
-	return ""
+	return "firecracker and ssh key resolved"
 }
diff --git a/internal/daemon/imagebuild.go b/internal/daemon/imagebuild.go
index bccf6f3..f22f040 100644
--- a/internal/daemon/imagebuild.go
+++ b/internal/daemon/imagebuild.go
@@ -3,7 +3,6 @@ package daemon
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"errors"
 	"fmt"
 	"io"
@@ -16,6 +15,7 @@ import (
 	"banger/internal/guest"
 	"banger/internal/guestnet"
 	"banger/internal/hostnat"
+	"banger/internal/imagepreset"
 	"banger/internal/model"
 	"banger/internal/opencode"
 	"banger/internal/system"
@@ -39,13 +39,13 @@ const (
 type imageBuildSpec struct {
 	ID            string
 	Name          string
-	BaseRootfs    string
+	SourceRootfs  string
 	RootfsPath    string
 	BuildLog      io.Writer
 	KernelPath    string
 	InitrdPath    string
 	ModulesDir    string
-	PackagesPath  string
+	Packages      []string
 	InstallDocker bool
 	Size          string
 }
@@ -66,15 +66,11 @@ func (d *Daemon) runImageBuild(ctx context.Context, spec imageBuildSpec) error {
 }
 
 func (d *Daemon) runImageBuildNative(ctx context.Context, spec imageBuildSpec) (err error) {
-	packages, err := system.ReadNormalizedLines(spec.PackagesPath)
-	if err != nil {
-		return err
-	}
-	if err := system.CopyFilePreferClone(spec.BaseRootfs, spec.RootfsPath); err != nil {
+	if err := system.CopyFilePreferClone(spec.SourceRootfs, spec.RootfsPath); err != nil {
 		return err
 	}
 	if spec.Size != "" {
-		if err := resizeRootfs(spec.BaseRootfs, spec.RootfsPath, spec.Size); err != nil {
+		if err := resizeRootfs(spec.SourceRootfs, spec.RootfsPath, spec.Size); err != nil {
 			return err
 		}
 	}
@@ -110,7 +106,11 @@ func (d *Daemon) runImageBuildNative(ctx context.Context, spec imageBuildSpec) (
 		return err
 	}
 
-	helperBytes, err := os.ReadFile(d.config.VSockAgentPath)
+	vsockAgentPath, err := d.vsockAgentBinary()
+	if err != nil {
+		return err
+	}
+	helperBytes, err := os.ReadFile(vsockAgentPath)
 	if err != nil {
 		return err
 	}
@@ -123,7 +123,7 @@ func (d *Daemon) runImageBuildNative(ctx context.Context, spec imageBuildSpec) (
 	if err := writeBuildLog(spec.BuildLog, "configuring guest"); err != nil {
 		return err
 	}
-	if err := client.RunScript(ctx, buildProvisionScript(vm.Name, d.config.DefaultDNS, string(authorizedKey), packages, spec.InstallDocker), spec.BuildLog); err != nil {
+	if err := client.RunScript(ctx, buildProvisionScript(vm.Name, d.config.DefaultDNS, string(authorizedKey), spec.Packages, spec.InstallDocker), spec.BuildLog); err != nil {
 		return err
 	}
 	if strings.TrimSpace(spec.ModulesDir) != "" {
@@ -428,6 +428,5 @@ func writeBuildLog(w io.Writer, message string) error {
 }
 
 func packagesHash(lines []string) string {
-	sum := sha256.Sum256([]byte(strings.Join(lines, "\n") + "\n"))
-	return fmt.Sprintf("%x", sum)
+	return imagepreset.Hash(lines)
 }
diff --git a/internal/daemon/images.go b/internal/daemon/images.go
index 365e53d..b20873e 100644
--- a/internal/daemon/images.go
+++ b/internal/daemon/images.go
@@ -10,8 +10,8 @@ import (
 	"strings"
 
 	"banger/internal/api"
+	"banger/internal/imagepreset"
 	"banger/internal/model"
-	"banger/internal/paths"
 	"banger/internal/system"
 )
 
@@ -37,12 +37,13 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (i
 	if _, err := d.FindImage(ctx, name); err == nil {
 		return model.Image{}, fmt.Errorf("image name already exists: %s", name)
 	}
-	baseRootfs := params.BaseRootfs
-	if baseRootfs == "" {
-		baseRootfs = d.config.DefaultBaseRootfs
+	fromImage := strings.TrimSpace(params.FromImage)
+	if fromImage == "" {
+		return model.Image{}, fmt.Errorf("from-image is required")
 	}
-	if baseRootfs == "" {
-		return model.Image{}, fmt.Errorf("base rootfs is required; %s", paths.RuntimeBundleHint())
+	baseImage, err := d.FindImage(ctx, fromImage)
+	if err != nil {
+		return model.Image{}, err
 	}
 	id, err := model.NewID()
 	if err != nil {
@@ -50,9 +51,6 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (i
 	}
 	now := model.Now()
 	artifactDir := filepath.Join(d.layout.ImagesDir, id)
-	if err := os.MkdirAll(artifactDir, 0o755); err != nil {
-		return model.Image{}, err
-	}
 	buildLogDir := filepath.Join(d.layout.StateDir, "image-build")
 	if err := os.MkdirAll(buildLogDir, 0o755); err != nil {
 		return model.Image{}, err
@@ -64,73 +62,80 @@ func (d *Daemon) BuildImage(ctx context.Context, params api.ImageBuildParams) (i
 		return model.Image{}, err
 	}
 	defer logFile.Close()
-	rootfsPath := filepath.Join(artifactDir, "rootfs.ext4")
-	workSeedPath := filepath.Join(artifactDir, "work-seed.ext4")
-	kernelPath := params.KernelPath
-	if kernelPath == "" {
-		kernelPath = d.config.DefaultKernel
-	}
-	initrdPath := params.InitrdPath
-	if initrdPath == "" {
-		initrdPath = d.config.DefaultInitrd
-	}
-	modulesDir := params.ModulesDir
-	if modulesDir == "" {
-		modulesDir = d.config.DefaultModulesDir
-	}
-	if err := d.validateImageBuildPrereqs(ctx, baseRootfs, kernelPath, initrdPath, modulesDir, params.Size); err != nil {
+	stageDir, err := os.MkdirTemp(d.layout.ImagesDir, id+".build-")
+	if err != nil {
 		return model.Image{}, err
 	}
+	cleanupStage := true
+	defer func() {
+		if cleanupStage {
+			_ = os.RemoveAll(stageDir)
+		}
+	}()
+	rootfsPath := filepath.Join(stageDir, "rootfs.ext4")
+	workSeedPath := filepath.Join(stageDir, "work-seed.ext4")
+	kernelSource := firstNonEmpty(params.KernelPath, baseImage.KernelPath)
+	initrdSource := firstNonEmpty(params.InitrdPath, baseImage.InitrdPath)
+	modulesSource := firstNonEmpty(params.ModulesDir, baseImage.ModulesDir)
+	if err := d.validateImageBuildPrereqs(ctx, baseImage.RootfsPath, kernelSource, initrdSource, modulesSource, params.Size); err != nil {
+		return model.Image{}, err
+	}
+	kernelPath, initrdPath, modulesDir, err := stageManagedBootArtifacts(ctx, d.runner, stageDir, kernelSource, initrdSource, modulesSource)
+	if err != nil {
+		return model.Image{}, err
+	}
+	packages := imagepreset.DebianBasePackages()
+	metadataPackages := imageBuildMetadataPackages(params.Docker)
 	spec := imageBuildSpec{
 		ID:            id,
 		Name:          name,
-		BaseRootfs:    baseRootfs,
+		SourceRootfs:  baseImage.RootfsPath,
 		RootfsPath:    rootfsPath,
 		BuildLog:      logFile,
 		KernelPath:    kernelPath,
 		InitrdPath:    initrdPath,
 		ModulesDir:    modulesDir,
-		PackagesPath:  d.config.DefaultPackagesFile,
+		Packages:      packages,
 		InstallDocker: params.Docker,
 		Size:          params.Size,
 	}
-	op.stage("launch_builder", "build_log_path", buildLogPath, "artifact_dir", artifactDir)
+	op.stage("launch_builder", "build_log_path", buildLogPath, "artifact_dir", artifactDir, "from_image", baseImage.Name)
 	imageBuildStage(ctx, "launch_builder", "building rootfs from base image")
 	if err := d.runImageBuild(ctx, spec); err != nil {
 		_ = logFile.Sync()
-		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
 	imageBuildStage(ctx, "prepare_work_seed", "building reusable work seed")
 	if err := system.BuildWorkSeedImage(ctx, d.runner, rootfsPath, workSeedPath); err != nil {
 		_ = logFile.Sync()
-		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
 	imageBuildStage(ctx, "seed_ssh", "seeding runtime SSH access")
 	seededSSHPublicKeyFingerprint, err := d.seedAuthorizedKeyOnExt4Image(ctx, workSeedPath)
 	if err != nil {
 		_ = logFile.Sync()
-		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
 	imageBuildStage(ctx, "write_metadata", "writing image metadata")
-	if err := writePackagesMetadata(rootfsPath, d.config.DefaultPackagesFile); err != nil {
+	if err := writePackagesMetadata(rootfsPath, metadataPackages); err != nil {
 		_ = logFile.Sync()
-		_ = os.RemoveAll(artifactDir)
 		return model.Image{}, err
 	}
+	op.stage("activate_artifacts", "artifact_dir", artifactDir)
+	if err := os.Rename(stageDir, artifactDir); err != nil {
+		return model.Image{}, err
+	}
+	cleanupStage = false
 	image = model.Image{
 		ID:                            id,
 		Name:                          name,
 		Managed:                       true,
 		ArtifactDir:                   artifactDir,
-		RootfsPath:                    rootfsPath,
-		WorkSeedPath:                  workSeedPath,
-		KernelPath:                    kernelPath,
-		InitrdPath:                    initrdPath,
-		ModulesDir:                    modulesDir,
-		PackagesPath:                  d.config.DefaultPackagesFile,
+		RootfsPath:                    filepath.Join(artifactDir, "rootfs.ext4"),
+		WorkSeedPath:                  filepath.Join(artifactDir, "work-seed.ext4"),
+		KernelPath:                    filepath.Join(artifactDir, "kernel"),
+		InitrdPath:                    stageOptionalArtifactPath(artifactDir, initrdPath, "initrd.img"),
+		ModulesDir:                    stageOptionalArtifactPath(artifactDir, modulesDir, "modules"),
 		BuildSize:                     params.Size,
 		SeededSSHPublicKeyFingerprint: seededSSHPublicKeyFingerprint,
 		Docker:                        params.Docker,
@@ -174,19 +179,12 @@ func (d *Daemon) RegisterImage(ctx context.Context, params api.ImageRegisterPara
 	}
 	kernelPath := strings.TrimSpace(params.KernelPath)
 	if kernelPath == "" {
-		kernelPath = d.config.DefaultKernel
+		return model.Image{}, fmt.Errorf("kernel path is required")
 	}
 	initrdPath := strings.TrimSpace(params.InitrdPath)
-	if initrdPath == "" {
-		initrdPath = d.config.DefaultInitrd
-	}
 	modulesDir := strings.TrimSpace(params.ModulesDir)
-	if modulesDir == "" {
-		modulesDir = d.config.DefaultModulesDir
-	}
-	packagesPath := strings.TrimSpace(params.PackagesPath)
 
-	if err := validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir, packagesPath); err != nil {
+	if err := validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir); err != nil {
 		return model.Image{}, err
 	}
 
@@ -203,7 +201,6 @@ func (d *Daemon) RegisterImage(ctx context.Context, params api.ImageRegisterPara
 		image.KernelPath = kernelPath
 		image.InitrdPath = initrdPath
 		image.ModulesDir = modulesDir
-		image.PackagesPath = packagesPath
 		image.Docker = params.Docker
 		image.UpdatedAt = now
 	case errors.Is(lookupErr, sql.ErrNoRows):
@@ -220,7 +217,6 @@ func (d *Daemon) RegisterImage(ctx context.Context, params api.ImageRegisterPara
 			KernelPath:   kernelPath,
 			InitrdPath:   initrdPath,
 			ModulesDir:   modulesDir,
-			PackagesPath: packagesPath,
 			Docker:       params.Docker,
 			CreatedAt:    now,
 			UpdatedAt:    now,
@@ -255,7 +251,7 @@ func (d *Daemon) PromoteImage(ctx context.Context, idOrName string) (image model
 	if image.Managed {
 		return model.Image{}, fmt.Errorf("image %s is already managed", image.Name)
 	}
-	if err := validateImagePromotePaths(image.RootfsPath, image.KernelPath, image.InitrdPath, image.ModulesDir, image.PackagesPath); err != nil {
+	if err := validateImagePromotePaths(image.RootfsPath, image.KernelPath, image.InitrdPath, image.ModulesDir); err != nil {
 		return model.Image{}, err
 	}
 	if strings.TrimSpace(d.layout.ImagesDir) == "" {
@@ -313,6 +309,10 @@ func (d *Daemon) PromoteImage(ctx context.Context, idOrName string) (image model
 	} else {
 		image.SeededSSHPublicKeyFingerprint = ""
 	}
+	_, initrdPath, modulesDir, err := stageManagedBootArtifacts(ctx, d.runner, stageDir, image.KernelPath, image.InitrdPath, image.ModulesDir)
+	if err != nil {
+		return model.Image{}, err
+	}
 
 	op.stage("activate_artifacts", "artifact_dir", artifactDir)
 	if err := os.Rename(stageDir, artifactDir); err != nil {
@@ -326,6 +326,9 @@ func (d *Daemon) PromoteImage(ctx context.Context, idOrName string) (image model
 	if workSeedPath != "" {
 		image.WorkSeedPath = filepath.Join(artifactDir, "work-seed.ext4")
 	}
+	image.KernelPath = filepath.Join(artifactDir, "kernel")
+	image.InitrdPath = stageOptionalArtifactPath(artifactDir, initrdPath, "initrd.img")
+	image.ModulesDir = stageOptionalArtifactPath(artifactDir, modulesDir, "modules")
 	image.UpdatedAt = model.Now()
 	if err := d.store.UpsertImage(ctx, image); err != nil {
 		_ = os.RemoveAll(artifactDir)
@@ -334,26 +337,23 @@ func (d *Daemon) PromoteImage(ctx context.Context, idOrName string) (image model
 	return image, nil
 }
 
-func validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir, packagesPath string) error {
+func validateImageRegisterPaths(rootfsPath, workSeedPath, kernelPath, initrdPath, modulesDir string) error {
 	checks := system.NewPreflight()
 	checks.RequireFile(rootfsPath, "rootfs image", `pass --rootfs <path>`)
-	checks.RequireFile(kernelPath, "kernel image", `pass --kernel <path> or set "default_kernel"`)
+	checks.RequireFile(kernelPath, "kernel image", `pass --kernel <path>`)
 	if workSeedPath != "" {
 		checks.RequireFile(workSeedPath, "work-seed image", `pass --work-seed <path> or rebuild the image with a work seed`)
 	}
 	if initrdPath != "" {
-		checks.RequireFile(initrdPath, "initrd image", `pass --initrd <path> or set "default_initrd"`)
+		checks.RequireFile(initrdPath, "initrd image", `pass --initrd <path>`)
 	}
 	if modulesDir != "" {
-		checks.RequireDir(modulesDir, "kernel modules dir", `pass --modules <dir> or set "default_modules_dir"`)
-	}
-	if packagesPath != "" {
-		checks.RequireFile(packagesPath, "packages manifest", `pass --packages <path>`)
+		checks.RequireDir(modulesDir, "kernel modules dir", `pass --modules <dir>`)
 	}
 	return checks.Err("image register failed")
 }
 
-func validateImagePromotePaths(rootfsPath, kernelPath, initrdPath, modulesDir, packagesPath string) error {
+func validateImagePromotePaths(rootfsPath, kernelPath, initrdPath, modulesDir string) error {
 	checks := system.NewPreflight()
 	checks.RequireFile(rootfsPath, "rootfs image", `re-register the image with a valid rootfs`)
 	checks.RequireFile(kernelPath, "kernel image", `re-register the image with a valid kernel`)
@@ -363,22 +363,15 @@ func validateImagePromotePaths(rootfsPath, kernelPath, initrdPath, modulesDir, p
 	if modulesDir != "" {
 		checks.RequireDir(modulesDir, "kernel modules dir", `re-register the image with a valid modules dir`)
 	}
-	if packagesPath != "" {
-		checks.RequireFile(packagesPath, "packages manifest", `re-register the image with a valid packages manifest`)
-	}
 	return checks.Err("image promote failed")
 }
 
-func writePackagesMetadata(rootfsPath, packagesPath string) error {
-	if rootfsPath == "" || packagesPath == "" {
+func writePackagesMetadata(rootfsPath string, packages []string) error {
+	if rootfsPath == "" || len(packages) == 0 {
 		return nil
 	}
-	lines, err := system.ReadNormalizedLines(packagesPath)
-	if err != nil {
-		return err
-	}
 	metadataPath := rootfsPath + ".packages.sha256"
-	return os.WriteFile(metadataPath, []byte(packagesHash(lines)+"\n"), 0o644)
+	return os.WriteFile(metadataPath, []byte(packagesHash(packages)+"\n"), 0o644)
 }
 
 func (d *Daemon) DeleteImage(ctx context.Context, idOrName string) (model.Image, error) {
@@ -406,3 +399,52 @@ func (d *Daemon) DeleteImage(ctx context.Context, idOrName string) (model.Image,
 	}
 	return image, nil
 }
+
+func stageManagedBootArtifacts(ctx context.Context, runner system.CommandRunner, artifactDir, kernelSource, initrdSource, modulesSource string) (string, string, string, error) {
+	kernelPath := filepath.Join(artifactDir, "kernel")
+	if err := system.CopyFilePreferClone(kernelSource, kernelPath); err != nil {
+		return "", "", "", err
+	}
+	initrdPath := ""
+	if strings.TrimSpace(initrdSource) != "" {
+		initrdPath = filepath.Join(artifactDir, "initrd.img")
+		if err := system.CopyFilePreferClone(initrdSource, initrdPath); err != nil {
+			return "", "", "", err
+		}
+	}
+	modulesDir := ""
+	if strings.TrimSpace(modulesSource) != "" {
+		modulesDir = filepath.Join(artifactDir, "modules")
+		if err := os.MkdirAll(modulesDir, 0o755); err != nil {
+			return "", "", "", err
+		}
+		if err := system.CopyDirContents(ctx, runner, modulesSource, modulesDir, false); err != nil {
+			return "", "", "", err
+		}
+	}
+	return kernelPath, initrdPath, modulesDir, nil
+}
+
+func imageBuildMetadataPackages(docker bool) []string {
+	packages := imagepreset.DebianBasePackages()
+	if docker {
+		packages = append(packages, "#feature:docker")
+	}
+	return packages
+}
+
+func stageOptionalArtifactPath(artifactDir, stagedPath, name string) string {
+	if strings.TrimSpace(stagedPath) == "" {
+		return ""
+	}
+	return filepath.Join(artifactDir, name)
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, value := range values {
+		if strings.TrimSpace(value) != "" {
+			return value
+		}
+	}
+	return ""
+}
diff --git a/internal/daemon/logger_test.go b/internal/daemon/logger_test.go
index d848064..4ad9e29 100644
--- a/internal/daemon/logger_test.go
+++ b/internal/daemon/logger_test.go
@@ -69,6 +69,7 @@ func TestStartVMLockedLogsBridgeFailure(t *testing.T) {
 	if err := os.WriteFile(vsockHelper, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
 		t.Fatalf("write vsock helper: %v", err)
 	}
+	t.Setenv("BANGER_VSOCK_AGENT_BIN", vsockHelper)
 	rootfsPath := filepath.Join(t.TempDir(), "rootfs.ext4")
 	kernelPath := filepath.Join(t.TempDir(), "vmlinux")
 	for _, path := range []string{rootfsPath, kernelPath} {
@@ -109,7 +110,6 @@ func TestStartVMLockedLogsBridgeFailure(t *testing.T) {
 			BridgeIP:          model.DefaultBridgeIP,
 			DefaultDNS:        model.DefaultDNS,
 			FirecrackerBin:    firecrackerBin,
-			VSockAgentPath:    vsockHelper,
 			StatsPollInterval: model.DefaultStatsPollInterval,
 		},
 		runner: runner,
@@ -148,11 +148,10 @@ func TestBuildImagePreservesBuildLogOnFailure(t *testing.T) {
 
 	baseRootfs := filepath.Join(t.TempDir(), "base.ext4")
 	kernelPath := filepath.Join(t.TempDir(), "vmlinux")
-	packagesPath := filepath.Join(t.TempDir(), "packages.apt")
 	sshKeyPath := filepath.Join(t.TempDir(), "id_ed25519")
 	firecrackerBin := filepath.Join(t.TempDir(), "firecracker")
 	vsockHelper := filepath.Join(t.TempDir(), "banger-vsock-agent")
-	for _, path := range []string{baseRootfs, kernelPath, packagesPath, sshKeyPath} {
+	for _, path := range []string{baseRootfs, kernelPath, sshKeyPath} {
 		if err := os.WriteFile(path, []byte("artifact"), 0o644); err != nil {
 			t.Fatalf("write %s: %v", path, err)
 		}
@@ -160,6 +159,7 @@ func TestBuildImagePreservesBuildLogOnFailure(t *testing.T) {
 	if err := os.WriteFile(vsockHelper, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
 		t.Fatalf("write %s: %v", vsockHelper, err)
 	}
+	t.Setenv("BANGER_VSOCK_AGENT_BIN", vsockHelper)
 	if err := os.WriteFile(firecrackerBin, []byte("#!/bin/sh\nexit 0\n"), 0o755); err != nil {
 		t.Fatalf("write %s: %v", firecrackerBin, err)
 	}
@@ -175,18 +175,26 @@ func TestBuildImagePreservesBuildLogOnFailure(t *testing.T) {
 	if err != nil {
 		t.Fatalf("newDaemonLogger: %v", err)
 	}
+	baseImage := model.Image{
+		ID:         "base-image",
+		Name:       "base-image",
+		RootfsPath: baseRootfs,
+		KernelPath: kernelPath,
+		CreatedAt:  model.Now(),
+		UpdatedAt:  model.Now(),
+	}
+	if err := store.UpsertImage(ctx, baseImage); err != nil {
+		t.Fatalf("UpsertImage(base): %v", err)
+	}
 	d := &Daemon{
 		layout: paths.Layout{
 			StateDir:  stateDir,
 			ImagesDir: imagesDir,
 		},
 		config: model.DaemonConfig{
-			RuntimeDir:          t.TempDir(),
-			DefaultImageName:    "default",
-			DefaultPackagesFile: packagesPath,
-			SSHKeyPath:          sshKeyPath,
-			FirecrackerBin:      firecrackerBin,
-			VSockAgentPath:      vsockHelper,
+			DefaultImageName: "base-image",
+			SSHKeyPath:       sshKeyPath,
+			FirecrackerBin:   firecrackerBin,
 		},
 		store:  store,
 		runner: runner,
@@ -195,7 +203,7 @@ func TestBuildImagePreservesBuildLogOnFailure(t *testing.T) {
 			if _, err := fmt.Fprintln(spec.BuildLog, "builder-stdout"); err != nil {
 				return err
 			}
-			if spec.BaseRootfs != baseRootfs || spec.KernelPath != kernelPath || spec.PackagesPath != packagesPath {
+			if spec.SourceRootfs != baseRootfs || spec.KernelPath == kernelPath || len(spec.Packages) == 0 {
 				t.Fatalf("unexpected image build spec: %+v", spec)
 			}
 			return errors.New("builder failed")
@@ -204,7 +212,7 @@ func TestBuildImagePreservesBuildLogOnFailure(t *testing.T) {
 
 	_, err = d.BuildImage(ctx, api.ImageBuildParams{
 		Name:       "broken-image",
-		BaseRootfs: baseRootfs,
+		FromImage:  baseImage.Name,
 		KernelPath: kernelPath,
 	})
 	if err == nil || !strings.Contains(err.Error(), "inspect ") {
diff --git a/internal/daemon/preflight.go b/internal/daemon/preflight.go
index c4dd41c..0d3c251 100644
--- a/internal/daemon/preflight.go
+++ b/internal/daemon/preflight.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"banger/internal/model"
-	"banger/internal/paths"
 	"banger/internal/system"
 )
 
@@ -50,16 +49,18 @@ func (d *Daemon) addNATPrereqs(ctx context.Context, checks *system.Preflight) {
 }
 
 func (d *Daemon) addBaseStartPrereqs(checks *system.Preflight, image model.Image) {
-	hint := paths.RuntimeBundleHint()
-
 	d.addBaseStartCommandPrereqs(checks)
-	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", hint)
-	checks.RequireExecutable(d.config.VSockAgentPath, "vsock agent", `run 'make build' or refresh the runtime bundle`)
+	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", `install firecracker or set "firecracker_bin"`)
+	if helper, err := d.vsockAgentBinary(); err == nil {
+		checks.RequireExecutable(helper, "vsock agent helper", `run 'make build' or reinstall banger`)
+	} else {
+		checks.Addf("%v", err)
+	}
 	checks.RequireFile(vsockHostDevicePath, "vsock host device", "load the vhost_vsock kernel module on the host")
-	checks.RequireFile(image.RootfsPath, "rootfs image", "select a valid image or rebuild the runtime bundle")
-	checks.RequireFile(image.KernelPath, "kernel image", `set "default_kernel" or refresh the runtime bundle`)
+	checks.RequireFile(image.RootfsPath, "rootfs image", "select a valid registered image")
+	checks.RequireFile(image.KernelPath, "kernel image", `re-register or rebuild the image with a valid kernel`)
 	if strings.TrimSpace(image.InitrdPath) != "" {
-		checks.RequireFile(image.InitrdPath, "initrd image", `set "default_initrd" or refresh the runtime bundle`)
+		checks.RequireFile(image.InitrdPath, "initrd image", `re-register or rebuild the image with a valid initrd`)
 	}
 }
 
@@ -70,30 +71,26 @@ func (d *Daemon) addBaseStartCommandPrereqs(checks *system.Preflight) {
 }
 
 func (d *Daemon) addImageBuildPrereqs(ctx context.Context, checks *system.Preflight, baseRootfs, kernelPath, initrdPath, modulesDir, sizeSpec string) {
-	hint := paths.RuntimeBundleHint()
-
 	for _, command := range []string{"sudo", "ip", "pgrep", "chown", "chmod", "kill"} {
 		checks.RequireCommand(command, toolHint(command))
 	}
 	for _, command := range []string{"mkfs.ext4", "mount", "umount", "cp"} {
 		checks.RequireCommand(command, toolHint(command))
 	}
-	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", hint)
-	checks.RequireFile(d.config.SSHKeyPath, "runtime ssh private key", `refresh the runtime bundle`)
-	checks.RequireExecutable(d.config.VSockAgentPath, "vsock agent", `run 'make build' or refresh the runtime bundle`)
-	checks.RequireFile(baseRootfs, "base rootfs image", `pass --base-rootfs or set "default_base_rootfs"`)
-	checks.RequireFile(kernelPath, "kernel image", `pass --kernel or set "default_kernel"`)
-	checks.RequireFile(d.config.DefaultPackagesFile, "package manifest", `set "default_packages_file" or refresh the runtime bundle`)
+	checks.RequireExecutable(d.config.FirecrackerBin, "firecracker binary", `install firecracker or set "firecracker_bin"`)
+	checks.RequireFile(d.config.SSHKeyPath, "ssh private key", `set "ssh_key_path" or let banger create its default key`)
+	if helper, err := d.vsockAgentBinary(); err == nil {
+		checks.RequireExecutable(helper, "vsock agent helper", `run 'make build' or reinstall banger`)
+	} else {
+		checks.Addf("%v", err)
+	}
+	checks.RequireFile(baseRootfs, "base image rootfs", `pass --from-image with a valid registered image`)
+	checks.RequireFile(kernelPath, "kernel image", `pass --kernel or build from an image with a valid kernel`)
 	if strings.TrimSpace(initrdPath) != "" {
-		checks.RequireFile(initrdPath, "initrd image", `pass --initrd or set "default_initrd"`)
+		checks.RequireFile(initrdPath, "initrd image", `pass --initrd or build from an image with a valid initrd`)
 	}
 	if strings.TrimSpace(modulesDir) != "" {
-		checks.RequireDir(modulesDir, "modules directory", `pass --modules or set "default_modules_dir"`)
-	}
-	if strings.TrimSpace(d.config.DefaultPackagesFile) != "" {
-		if _, err := system.ReadNormalizedLines(d.config.DefaultPackagesFile); err != nil {
-			checks.Addf("package manifest at %s is invalid: %v", d.config.DefaultPackagesFile, err)
-		}
+		checks.RequireDir(modulesDir, "modules directory", `pass --modules or build from an image with a valid modules dir`)
 	}
 	if strings.TrimSpace(sizeSpec) != "" {
 		checks.RequireCommand("e2fsck", toolHint("e2fsck"))
diff --git a/internal/daemon/runtime_assets.go b/internal/daemon/runtime_assets.go
new file mode 100644
index 0000000..16c4cf6
--- /dev/null
+++ b/internal/daemon/runtime_assets.go
@@ -0,0 +1,15 @@
+package daemon
+
+import (
+	"fmt"
+
+	"banger/internal/paths"
+)
+
+func (d *Daemon) vsockAgentBinary() (string, error) {
+	path, err := paths.CompanionBinaryPath("banger-vsock-agent")
+	if err != nil {
+		return "", fmt.Errorf("vsock agent helper not available: %w", err)
+	}
+	return path, nil
+}
diff --git a/internal/daemon/vm.go b/internal/daemon/vm.go
index a602f1a..251f039 100644
--- a/internal/daemon/vm.go
+++ b/internal/daemon/vm.go
@@ -16,7 +16,7 @@ import (
 	"banger/internal/guest"
 	"banger/internal/guestconfig"
 	"banger/internal/model"
-	"banger/internal/paths"
+	"banger/internal/namegen"
 	"banger/internal/system"
 	"banger/internal/vmdns"
 	"banger/internal/vsockagent"
@@ -998,13 +998,20 @@ func (d *Daemon) createTap(ctx context.Context, tap string) error {
 
 func (d *Daemon) firecrackerBinary() (string, error) {
 	if d.config.FirecrackerBin == "" {
-		return "", fmt.Errorf("firecracker binary not configured; %s", paths.RuntimeBundleHint())
+		return "", fmt.Errorf("firecracker binary not configured; install firecracker or set firecracker_bin")
 	}
 	path := d.config.FirecrackerBin
-	if !exists(path) {
-		return "", fmt.Errorf("firecracker binary not found at %s; %s", path, paths.RuntimeBundleHint())
+	if strings.ContainsRune(path, os.PathSeparator) {
+		if !exists(path) {
+			return "", fmt.Errorf("firecracker binary not found at %s; install firecracker or set firecracker_bin", path)
+		}
+		return path, nil
 	}
-	return path, nil
+	resolved, err := system.LookupExecutable(path)
+	if err != nil {
+		return "", fmt.Errorf("firecracker binary %q not found in PATH; install firecracker or set firecracker_bin", path)
+	}
+	return resolved, nil
 }
 
 func (d *Daemon) ensureSocketAccess(ctx context.Context, socketPath, label string) error {
@@ -1190,14 +1197,9 @@ func (d *Daemon) killVMProcess(ctx context.Context, pid int) error {
 }
 
 func (d *Daemon) generateName(ctx context.Context) (string, error) {
-	if exists(d.config.NamegenPath) {
-		out, err := d.runner.Run(ctx, d.config.NamegenPath)
-		if err == nil {
-			name := strings.TrimSpace(string(out))
-			if name != "" {
-				return name, nil
-			}
-		}
+	_ = ctx
+	if name := strings.TrimSpace(namegen.Generate()); name != "" {
+		return name, nil
 	}
 	return "vm-" + strconv.FormatInt(time.Now().Unix(), 10), nil
 }
diff --git a/internal/daemon/vm_test.go b/internal/daemon/vm_test.go
index 3298a69..74c1881 100644
--- a/internal/daemon/vm_test.go
+++ b/internal/daemon/vm_test.go
@@ -4,13 +4,14 @@ import (
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
+	"crypto/tls"
 	"crypto/x509"
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"math/big"
 	"net"
 	"net/http"
-	"net/http/httptest"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -183,6 +184,7 @@ func TestRebuildDNSIncludesOnlyLiveRunningVMs(t *testing.T) {
 
 	server, err := vmdns.New("127.0.0.1:0", nil)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("vmdns.New: %v", err)
 	}
 	t.Cleanup(func() {
@@ -274,6 +276,7 @@ func TestHealthVMReturnsHealthyForRunningGuest(t *testing.T) {
 	vsockSock := filepath.Join(t.TempDir(), "fc.vsock")
 	listener, err := net.Listen("unix", vsockSock)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("listen vsock: %v", err)
 	}
 	t.Cleanup(func() {
@@ -367,6 +370,7 @@ func TestPingVMAliasReturnsAliveForHealthyVM(t *testing.T) {
 	vsockSock := filepath.Join(t.TempDir(), "fc.vsock")
 	listener, err := net.Listen("unix", vsockSock)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("listen vsock: %v", err)
 	}
 	t.Cleanup(func() {
@@ -441,32 +445,17 @@ func TestPortsVMReturnsEnrichedPortsAndWebSchemes(t *testing.T) {
 		_ = fake.Wait()
 	})
 
-	webServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	webAddr := startHTTPServerOnTCP4(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNoContent)
 	}))
-	t.Cleanup(webServer.Close)
-	webAddr, err := net.ResolveTCPAddr("tcp", strings.TrimPrefix(webServer.URL, "http://"))
-	if err != nil {
-		t.Fatalf("ResolveTCPAddr: %v", err)
-	}
-	tlsServer := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	tlsAddr := startHTTPSServerOnTCP4(t, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusAccepted)
 	}))
-	tlsListener, err := net.Listen("tcp4", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen tls: %v", err)
-	}
-	tlsServer.Listener = tlsListener
-	tlsServer.StartTLS()
-	t.Cleanup(tlsServer.Close)
-	tlsAddr, err := net.ResolveTCPAddr("tcp", strings.TrimPrefix(tlsServer.URL, "https://"))
-	if err != nil {
-		t.Fatalf("ResolveTCPAddr(tls): %v", err)
-	}
 
 	vsockSock := filepath.Join(t.TempDir(), "fc.vsock")
 	listener, err := net.Listen("unix", vsockSock)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("listen vsock: %v", err)
 	}
 	t.Cleanup(func() {
@@ -1263,6 +1252,7 @@ func startFakeFirecrackerAPI(t *testing.T, apiSock string) {
 	}
 	listener, err := net.Listen("unix", apiSock)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("listen unix %s: %v", apiSock, err)
 	}
 	mux := http.NewServeMux()
@@ -1283,6 +1273,72 @@ func startFakeFirecrackerAPI(t *testing.T, apiSock string) {
 	})
 }
 
+func skipIfSocketRestricted(t *testing.T, err error) {
+	t.Helper()
+	if err == nil {
+		return
+	}
+	if strings.Contains(strings.ToLower(err.Error()), "operation not permitted") {
+		t.Skipf("socket creation is restricted in this environment: %v", err)
+	}
+}
+
+func startHTTPServerOnTCP4(t *testing.T, handler http.Handler) *net.TCPAddr {
+	t.Helper()
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		skipIfSocketRestricted(t, err)
+		t.Fatalf("listen http: %v", err)
+	}
+	server := &http.Server{Handler: handler}
+	go func() {
+		_ = server.Serve(listener)
+	}()
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+	return listener.Addr().(*net.TCPAddr)
+}
+
+func startHTTPSServerOnTCP4(t *testing.T, handler http.Handler) *net.TCPAddr {
+	t.Helper()
+	privateKey, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatalf("GenerateKey: %v", err)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &privateKey.PublicKey, privateKey)
+	if err != nil {
+		t.Fatalf("CreateCertificate: %v", err)
+	}
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
+	cert, err := tls.X509KeyPair(certPEM, keyPEM)
+	if err != nil {
+		t.Fatalf("X509KeyPair: %v", err)
+	}
+	listener, err := net.Listen("tcp4", "127.0.0.1:0")
+	if err != nil {
+		skipIfSocketRestricted(t, err)
+		t.Fatalf("listen https: %v", err)
+	}
+	server := &http.Server{Handler: handler}
+	go func() {
+		_ = server.Serve(tls.NewListener(listener, &tls.Config{Certificates: []tls.Certificate{cert}}))
+	}()
+	t.Cleanup(func() {
+		_ = server.Close()
+	})
+	return listener.Addr().(*net.TCPAddr)
+}
+
 type processKillingRunner struct {
 	*scriptedRunner
 	proc *exec.Cmd
diff --git a/internal/imagepreset/preset.go b/internal/imagepreset/preset.go
new file mode 100644
index 0000000..d1de16e
--- /dev/null
+++ b/internal/imagepreset/preset.go
@@ -0,0 +1,57 @@
+package imagepreset
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"strings"
+)
+
+var debianBase = []string{
+	"make",
+	"git",
+	"less",
+	"tree",
+	"ca-certificates",
+	"curl",
+	"wget",
+	"iproute2",
+	"vim",
+	"tmux",
+}
+
+var voidBase = []string{
+	"base-minimal",
+	"base-devel",
+	"bash",
+	"ca-certificates",
+	"curl",
+	"docker",
+	"docker-compose",
+	"e2fsprogs",
+	"git",
+	"iproute2",
+	"less",
+	"make",
+	"openssh",
+	"procps-ng",
+	"runit",
+	"shadow",
+	"sudo",
+	"tmux",
+	"tree",
+	"vim",
+	"wget",
+}
+
+func DebianBasePackages() []string {
+	return append([]string(nil), debianBase...)
+}
+
+func VoidBasePackages() []string {
+	return append([]string(nil), voidBase...)
+}
+
+func Hash(lines []string) string {
+	sum := sha256.Sum256([]byte(strings.Join(lines, "\n") + "\n"))
+	return fmt.Sprintf("%x", sum)
+}
diff --git a/internal/model/types.go b/internal/model/types.go
index 2955765..f986505 100644
--- a/internal/model/types.go
+++ b/internal/model/types.go
@@ -35,15 +35,10 @@ const (
 )
 
 type DaemonConfig struct {
-	RuntimeDir          string
 	LogLevel            string
 	WebListenAddr       string
 	FirecrackerBin      string
 	SSHKeyPath          string
-	NamegenPath         string
-	CustomizeScript     string
-	VSockAgentPath      string
-	DefaultWorkSeed     string
 	AutoStopStaleAfter  time.Duration
 	StatsPollInterval   time.Duration
 	MetricsPollInterval time.Duration
@@ -53,12 +48,6 @@ type DaemonConfig struct {
 	TapPoolSize         int
 	DefaultDNS          string
 	DefaultImageName    string
-	DefaultRootfs       string
-	DefaultBaseRootfs   string
-	DefaultKernel       string
-	DefaultInitrd       string
-	DefaultModulesDir   string
-	DefaultPackagesFile string
 }
 
 type Image struct {
@@ -71,7 +60,6 @@ type Image struct {
 	KernelPath                    string    `json:"kernel_path"`
 	InitrdPath                    string    `json:"initrd_path,omitempty"`
 	ModulesDir                    string    `json:"modules_dir,omitempty"`
-	PackagesPath                  string    `json:"packages_path,omitempty"`
 	BuildSize                     string    `json:"build_size,omitempty"`
 	SeededSSHPublicKeyFingerprint string    `json:"seeded_ssh_public_key_fingerprint,omitempty"`
 	Docker                        bool      `json:"docker"`
@@ -152,7 +140,7 @@ type VMSetRequest struct {
 
 type ImageBuildRequest struct {
 	Name       string
-	BaseRootfs string
+	FromImage  string
 	Size       string
 	KernelPath string
 	InitrdPath string
diff --git a/internal/namegen/namegen.go b/internal/namegen/namegen.go
new file mode 100644
index 0000000..b3edfad
--- /dev/null
+++ b/internal/namegen/namegen.go
@@ -0,0 +1,71 @@
+package namegen
+
+import (
+	"crypto/rand"
+	"encoding/binary"
+)
+
+var adjectives = []string{
+	"ace", "apt", "fit", "fun", "odd", "top", "able", "beau", "bold", "calm",
+	"chic", "cool", "deep", "deft", "easy", "epic", "fair", "fine", "free", "full",
+	"game", "glad", "glow", "good", "holy", "keen", "kind", "lean", "mild", "neat",
+	"nice", "open", "pure", "real", "snug", "spry", "tidy", "true", "warm", "wavy",
+	"wise", "adept", "agile", "alert", "alive", "ample", "angel", "awake", "aware", "brave",
+	"brisk", "chill", "clean", "clear", "close", "comic", "eager", "elite", "first", "fleet",
+	"fresh", "grace", "grand", "great", "happy", "hardy", "ideal", "jolly", "light", "lithe",
+	"loyal", "lucid", "lucky", "lunar", "magic", "merry", "nifty", "noble", "peppy", "perky",
+	"proud", "quick", "quiet", "ready", "regal", "savvy", "sharp", "smart", "solid", "sound",
+	"sunny", "super", "sweet", "swift", "vivid", "witty", "zesty",
+}
+
+var substantives = []string{
+	"ox", "aim", "air", "arm", "bud", "day", "hay", "jam", "jay", "joy",
+	"key", "map", "may", "nod", "ore", "pen", "sky", "sun", "way", "zen",
+	"ant", "ape", "auk", "bat", "bee", "cat", "cod", "cow", "dog", "elk",
+	"fox", "hen", "owl", "pig", "ram", "rat", "yak", "boar", "buck", "bull",
+	"calf", "carp", "crab", "crow", "deer", "dove", "fish", "foal", "frog", "goat",
+	"gull", "hare", "hawk", "ibex", "kiwi", "kudu", "lamb", "lion", "lynx", "mink",
+	"mole", "mule", "newt", "orca", "oryx", "puma", "seal", "slug", "stag", "swan",
+	"tern", "toad", "tuna", "wasp", "wolf", "zebu", "bison", "camel", "crane", "eagle",
+	"finch", "goose", "heron", "hippo", "horse", "hyena", "koala", "llama", "macaw", "moose",
+	"otter", "quail", "raven", "robin", "shark", "sheep", "shrew", "skunk", "sloth", "snail",
+	"squid", "tapir", "tiger", "trout", "whale", "zebra", "ally", "arch", "area", "aura",
+	"axis", "bank", "barn", "beam", "bell", "belt", "bend", "bird", "boat", "bond",
+	"book", "boot", "bowl", "brim", "calm", "camp", "card", "care", "cell", "city",
+	"clan", "club", "code", "core", "crux", "dawn", "deal", "film", "firm", "flag",
+	"flow", "foam", "gate", "gift", "glow", "hall", "hand", "harp", "hill", "home",
+	"hope", "host", "idea", "isle", "item", "keel", "knot", "land", "leaf", "link",
+	"lion", "loom", "love", "luck", "mark", "moon", "moss", "nook", "note", "pact",
+	"page", "path", "peak", "poem", "port", "ring", "road", "rock", "roof", "rule",
+	"sail", "seal", "seed", "song", "star", "tide", "tree", "tune", "walk", "ward",
+	"wave", "well", "wind", "wing", "wish", "wood", "work", "zone", "amity", "asset",
+	"bloom", "brook", "bunch", "charm", "chart", "cheer", "chord", "cliff", "cloud", "coast",
+	"comet", "craft", "crane", "crest", "crowd", "crown", "cycle", "faith", "field", "flame",
+	"fleet", "focus", "forge", "frame", "fruit", "glade", "grace", "grain", "grove", "guide",
+	"guild", "haven", "heart", "honey", "honor", "humor", "image", "index", "jewel", "judge",
+	"kudos", "lumen", "lunar", "magic", "march", "marsh", "mercy", "model", "moral", "music",
+	"niche", "oasis", "ocean", "opera", "orbit", "order", "peace", "pearl", "petal", "phase",
+	"piano", "pilot", "place", "plaza", "prism", "proof", "pulse", "quest", "quiet", "quill",
+	"radar", "rally", "range", "realm", "reign", "river", "route", "scene", "scope", "score",
+	"shade", "shape", "shore", "skill", "spark", "spice", "spire", "spoke", "stone", "story",
+	"table", "token", "trend", "tribe", "trust", "unity", "valor", "value", "verse", "vista",
+	"voice", "world",
+}
+
+func Generate() string {
+	if len(adjectives) == 0 || len(substantives) == 0 {
+		return ""
+	}
+	return adjectives[randomIndex(len(adjectives))] + "-" + substantives[randomIndex(len(substantives))]
+}
+
+func randomIndex(length int) int {
+	if length <= 1 {
+		return 0
+	}
+	var buf [8]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		return 0
+	}
+	return int(binary.BigEndian.Uint64(buf[:]) % uint64(length))
+}
diff --git a/internal/paths/paths.go b/internal/paths/paths.go
index 8608a19..0eeacba 100644
--- a/internal/paths/paths.go
+++ b/internal/paths/paths.go
@@ -5,10 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
-
-	"banger/internal/runtimebundle"
 )
 
 type Layout struct {
@@ -69,71 +66,6 @@ func Ensure(layout Layout) error {
 
 var executablePath = os.Executable
 
-func ResolveRuntimeDir(configuredRuntimeDir, deprecatedRepoRoot string) string {
-	for _, candidate := range []string{
-		os.Getenv("BANGER_RUNTIME_DIR"),
-		os.Getenv("BANGER_REPO_ROOT"),
-		configuredRuntimeDir,
-		deprecatedRepoRoot,
-	} {
-		if candidate = strings.TrimSpace(candidate); candidate != "" {
-			return filepath.Clean(candidate)
-		}
-	}
-	exe, err := executablePath()
-	if err != nil {
-		return ""
-	}
-	exeDir := filepath.Dir(exe)
-	if filepath.Base(exeDir) == "bin" {
-		if filepath.Base(filepath.Dir(exeDir)) == "build" {
-			buildRuntimeDir := filepath.Clean(filepath.Join(exeDir, "..", "runtime"))
-			if HasRuntimeBundle(buildRuntimeDir) {
-				return buildRuntimeDir
-			}
-		}
-		installRuntimeDir := filepath.Clean(filepath.Join(exeDir, "..", "lib", "banger"))
-		if HasRuntimeBundle(installRuntimeDir) {
-			return installRuntimeDir
-		}
-	}
-	for _, sourceRuntimeDir := range []string{
-		filepath.Join(exeDir, "build", "runtime"),
-		filepath.Join(exeDir, "runtime"),
-	} {
-		if HasRuntimeBundle(sourceRuntimeDir) {
-			return sourceRuntimeDir
-		}
-	}
-	return ""
-}
-
-func HasRuntimeBundle(dir string) bool {
-	if strings.TrimSpace(dir) == "" {
-		return false
-	}
-	if _, err := runtimebundle.LoadBundleMetadata(dir); err == nil {
-		return true
-	}
-	required := []string{
-		"firecracker",
-		"customize.sh",
-		"packages.apt",
-		"wtf/root/boot/vmlinux-6.8.0-94-generic",
-	}
-	for _, name := range required {
-		if _, err := os.Stat(filepath.Join(dir, name)); err != nil {
-			return false
-		}
-	}
-	for _, name := range []string{"rootfs-docker.ext4", "rootfs.ext4"} {
-		if _, err := os.Stat(filepath.Join(dir, name)); err == nil {
-			return true
-		}
-	}
-	return false
-}
-
 func BangerdPath() (string, error) {
 	if env := os.Getenv("BANGER_DAEMON_BIN"); env != "" {
 		return env, nil
@@ -154,8 +86,33 @@ func BangerdPath() (string, error) {
 	return "", errors.New("bangerd binary not found next to banger; run `make build`")
 }
 
-func RuntimeBundleHint() string {
-	return "run `make runtime-bundle` or set runtime_dir in ~/.config/banger/config.toml"
+func CompanionBinaryPath(name string) (string, error) {
+	envNames := []string{
+		"BANGER_" + strings.ToUpper(strings.NewReplacer("-", "_", ".", "_").Replace(name)) + "_BIN",
+	}
+	if trimmed, ok := strings.CutPrefix(name, "banger-"); ok {
+		envNames = append(envNames, "BANGER_"+strings.ToUpper(strings.NewReplacer("-", "_", ".", "_").Replace(trimmed))+"_BIN")
+	}
+	for _, envName := range envNames {
+		if env := strings.TrimSpace(os.Getenv(envName)); env != "" {
+			return env, nil
+		}
+	}
+	exe, err := executablePath()
+	if err != nil {
+		return "", err
+	}
+	exeDir := filepath.Dir(exe)
+	for _, candidate := range []string{
+		filepath.Join(exeDir, name),
+		filepath.Join(exeDir, "..", "lib", "banger", name),
+		filepath.Join(exeDir, "..", "libexec", "banger", name),
+	} {
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate, nil
+		}
+	}
+	return "", fmt.Errorf("%s companion binary not found; run `make build` or reinstall banger", name)
 }
 
 func getenvDefault(key, fallback string) string {
@@ -164,7 +121,3 @@ func getenvDefault(key, fallback string) string {
 	}
 	return fallback
 }
-
-func RuntimeFallbackLabel() string {
-	return strconv.Itoa(os.Getuid())
-}
diff --git a/internal/paths/paths_test.go b/internal/paths/paths_test.go
index 68771a9..5ec7a53 100644
--- a/internal/paths/paths_test.go
+++ b/internal/paths/paths_test.go
@@ -1,44 +1,29 @@
 package paths
 
 import (
-	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
-
-	"banger/internal/runtimebundle"
 )
 
-func TestResolveRuntimeDirPrefersEnv(t *testing.T) {
-	t.Setenv("BANGER_RUNTIME_DIR", "/env/runtime")
+func TestCompanionBinaryPathPrefersEnv(t *testing.T) {
+	t.Setenv("BANGER_VSOCK_AGENT_BIN", "/tmp/custom-vsock-agent")
 
-	if got := ResolveRuntimeDir("/config/runtime", "/deprecated/repo"); got != "/env/runtime" {
-		t.Fatalf("ResolveRuntimeDir() = %q, want /env/runtime", got)
+	got, err := CompanionBinaryPath("banger-vsock-agent")
+	if err != nil {
+		t.Fatalf("CompanionBinaryPath: %v", err)
+	}
+	if got != "/tmp/custom-vsock-agent" {
+		t.Fatalf("CompanionBinaryPath() = %q", got)
 	}
 }
 
-func TestResolveRuntimeDirUsesInstalledLayout(t *testing.T) {
+func TestCompanionBinaryPathUsesSiblingBinary(t *testing.T) {
 	root := t.TempDir()
-	runtimeDir := filepath.Join(root, "lib", "banger")
-	createRuntimeBundle(t, runtimeDir)
-
-	origExecutablePath := executablePath
-	executablePath = func() (string, error) {
-		return filepath.Join(root, "bin", "banger"), nil
+	companion := filepath.Join(root, "banger-vsock-agent")
+	if err := os.WriteFile(companion, []byte("test"), 0o755); err != nil {
+		t.Fatalf("write companion: %v", err)
 	}
-	t.Cleanup(func() {
-		executablePath = origExecutablePath
-	})
-
-	if got := ResolveRuntimeDir("", ""); got != runtimeDir {
-		t.Fatalf("ResolveRuntimeDir() = %q, want %q", got, runtimeDir)
-	}
-}
-
-func TestResolveRuntimeDirUsesBuildRuntimeForSourceCheckoutBinary(t *testing.T) {
-	root := t.TempDir()
-	runtimeDir := filepath.Join(root, "build", "runtime")
-	createRuntimeBundle(t, runtimeDir)
 
 	origExecutablePath := executablePath
 	executablePath = func() (string, error) {
@@ -48,64 +33,38 @@ func TestResolveRuntimeDirUsesBuildRuntimeForSourceCheckoutBinary(t *testing.T)
 		executablePath = origExecutablePath
 	})
 
-	if got := ResolveRuntimeDir("", ""); got != runtimeDir {
-		t.Fatalf("ResolveRuntimeDir() = %q, want %q", got, runtimeDir)
+	got, err := CompanionBinaryPath("banger-vsock-agent")
+	if err != nil {
+		t.Fatalf("CompanionBinaryPath: %v", err)
+	}
+	if got != companion {
+		t.Fatalf("CompanionBinaryPath() = %q, want %q", got, companion)
 	}
 }
 
-func TestResolveRuntimeDirUsesBuildRuntimeForBuildBinExecutable(t *testing.T) {
+func TestCompanionBinaryPathUsesInstalledLibDir(t *testing.T) {
 	root := t.TempDir()
-	runtimeDir := filepath.Join(root, "build", "runtime")
-	createRuntimeBundle(t, runtimeDir)
+	companion := filepath.Join(root, "lib", "banger", "banger-vsock-agent")
+	if err := os.MkdirAll(filepath.Dir(companion), 0o755); err != nil {
+		t.Fatalf("mkdir companion dir: %v", err)
+	}
+	if err := os.WriteFile(companion, []byte("test"), 0o755); err != nil {
+		t.Fatalf("write companion: %v", err)
+	}
 
 	origExecutablePath := executablePath
 	executablePath = func() (string, error) {
-		return filepath.Join(root, "build", "bin", "banger"), nil
+		return filepath.Join(root, "bin", "banger"), nil
 	}
 	t.Cleanup(func() {
 		executablePath = origExecutablePath
 	})
 
-	if got := ResolveRuntimeDir("", ""); got != runtimeDir {
-		t.Fatalf("ResolveRuntimeDir() = %q, want %q", got, runtimeDir)
-	}
-}
-
-func createRuntimeBundle(t *testing.T, runtimeDir string) {
-	t.Helper()
-	metadata := runtimebundle.BundleMetadata{
-		FirecrackerBin:  "bin/firecracker",
-		SSHKeyPath:      "keys/id_ed25519",
-		NamegenPath:     "bin/namegen",
-		CustomizeScript: "scripts/customize.sh",
-		VSockAgentPath:  "bin/banger-vsock-agent",
-		DefaultPackages: "config/packages.apt",
-		DefaultRootfs:   "images/rootfs-docker.ext4",
-		DefaultKernel:   "kernels/vmlinux",
-	}
-	for _, rel := range []string{
-		metadata.FirecrackerBin,
-		metadata.SSHKeyPath,
-		metadata.NamegenPath,
-		metadata.CustomizeScript,
-		metadata.VSockAgentPath,
-		metadata.DefaultPackages,
-		metadata.DefaultRootfs,
-		metadata.DefaultKernel,
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("mkdir %s: %v", filepath.Dir(path), err)
-		}
-		if err := os.WriteFile(path, []byte("test"), 0o644); err != nil {
-			t.Fatalf("write %s: %v", path, err)
-		}
-	}
-	data, err := json.Marshal(metadata)
+	got, err := CompanionBinaryPath("banger-vsock-agent")
 	if err != nil {
-		t.Fatalf("Marshal: %v", err)
+		t.Fatalf("CompanionBinaryPath: %v", err)
 	}
-	if err := os.WriteFile(filepath.Join(runtimeDir, runtimebundle.BundleMetadataFile), data, 0o644); err != nil {
-		t.Fatalf("write bundle metadata: %v", err)
+	if got != companion {
+		t.Fatalf("CompanionBinaryPath() = %q, want %q", got, companion)
 	}
 }
diff --git a/internal/runtimebundle/bundle.go b/internal/runtimebundle/bundle.go
deleted file mode 100644
index 111cb60..0000000
--- a/internal/runtimebundle/bundle.go
+++ /dev/null
@@ -1,497 +0,0 @@
-package runtimebundle
-
-import (
-	"archive/tar"
-	"compress/gzip"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	toml "github.com/pelletier/go-toml"
-)
-
-type Manifest struct {
-	Version       string         `toml:"version"`
-	URL           string         `toml:"url"`
-	SHA256        string         `toml:"sha256"`
-	BundleRoot    string         `toml:"bundle_root"`
-	RequiredPaths []string       `toml:"required_paths"`
-	BundleMeta    BundleMetadata `toml:"bundle_metadata"`
-}
-
-type BundleMetadata struct {
-	FirecrackerBin      string `json:"firecracker_bin" toml:"firecracker_bin"`
-	SSHKeyPath          string `json:"ssh_key_path" toml:"ssh_key_path"`
-	NamegenPath         string `json:"namegen_path" toml:"namegen_path"`
-	CustomizeScript     string `json:"customize_script" toml:"customize_script"`
-	VSockAgentPath      string `json:"vsock_agent_path,omitempty" toml:"vsock_agent_path"`
-	VSockPingHelperPath string `json:"vsock_ping_helper_path,omitempty" toml:"vsock_ping_helper_path"`
-	DefaultPackages     string `json:"default_packages_file" toml:"default_packages_file"`
-	DefaultRootfs       string `json:"default_rootfs" toml:"default_rootfs"`
-	DefaultBaseRootfs   string `json:"default_base_rootfs,omitempty" toml:"default_base_rootfs"`
-	DefaultWorkSeed     string `json:"default_work_seed,omitempty" toml:"default_work_seed"`
-	DefaultKernel       string `json:"default_kernel" toml:"default_kernel"`
-	DefaultInitrd       string `json:"default_initrd,omitempty" toml:"default_initrd"`
-	DefaultModulesDir   string `json:"default_modules_dir,omitempty" toml:"default_modules_dir"`
-}
-
-const BundleMetadataFile = "bundle.json"
-
-func LoadManifest(path string) (Manifest, error) {
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return Manifest{}, err
-	}
-	var manifest Manifest
-	if err := toml.Unmarshal(data, &manifest); err != nil {
-		return Manifest{}, err
-	}
-	manifest.BundleRoot = strings.TrimSpace(manifest.BundleRoot)
-	manifest.URL = strings.TrimSpace(manifest.URL)
-	manifest.SHA256 = strings.ToLower(strings.TrimSpace(manifest.SHA256))
-	manifest.BundleMeta = normalizeBundleMetadata(manifest.BundleMeta)
-	for i, required := range manifest.RequiredPaths {
-		manifest.RequiredPaths[i] = filepath.Clean(strings.TrimSpace(required))
-	}
-	sort.Strings(manifest.RequiredPaths)
-	if len(manifest.RequiredPaths) == 0 {
-		return Manifest{}, fmt.Errorf("runtime bundle manifest %s has no required_paths", path)
-	}
-	return manifest, nil
-}
-
-func Bootstrap(ctx context.Context, manifest Manifest, manifestPath, outDir string) error {
-	if manifest.URL == "" {
-		return fmt.Errorf("runtime bundle manifest %s has no url; point a local manifest copy at a staged or published runtime bundle archive", manifestPath)
-	}
-	if manifest.SHA256 == "" {
-		return fmt.Errorf("runtime bundle manifest %s has no sha256; add the checksum for the staged or published runtime bundle archive", manifestPath)
-	}
-	manifestDir := filepath.Dir(manifestPath)
-	parentDir := filepath.Dir(outDir)
-	if err := os.MkdirAll(parentDir, 0o755); err != nil {
-		return err
-	}
-
-	workDir, err := os.MkdirTemp(parentDir, ".runtime-bundle-*")
-	if err != nil {
-		return err
-	}
-	defer os.RemoveAll(workDir)
-
-	archivePath := filepath.Join(workDir, "bundle.tar.gz")
-	if err := downloadArchive(ctx, resolveSource(manifestDir, manifest.URL), archivePath); err != nil {
-		return err
-	}
-	sum, err := fileSHA256(archivePath)
-	if err != nil {
-		return err
-	}
-	if sum != manifest.SHA256 {
-		return fmt.Errorf("runtime bundle checksum mismatch: got %s want %s", sum, manifest.SHA256)
-	}
-
-	extractDir := filepath.Join(workDir, "extract")
-	if err := extractTarGz(archivePath, extractDir); err != nil {
-		return err
-	}
-
-	bundleDir := extractDir
-	if manifest.BundleRoot != "" {
-		bundleDir = filepath.Join(extractDir, manifest.BundleRoot)
-	}
-	if err := ValidateBundle(bundleDir, manifest.RequiredPaths); err != nil {
-		return err
-	}
-	if _, err := LoadBundleMetadata(bundleDir); err != nil && !errors.Is(err, os.ErrNotExist) {
-		return err
-	}
-
-	stageDir := filepath.Join(workDir, "stage")
-	if err := os.Rename(bundleDir, stageDir); err != nil {
-		return err
-	}
-
-	if err := os.RemoveAll(outDir); err != nil {
-		return err
-	}
-	if err := os.Rename(stageDir, outDir); err != nil {
-		return err
-	}
-	return nil
-}
-
-func ValidateBundle(bundleDir string, requiredPaths []string) error {
-	for _, rel := range requiredPaths {
-		if rel == "." || strings.HasPrefix(rel, "..") {
-			return fmt.Errorf("invalid required bundle path: %s", rel)
-		}
-		if _, err := os.Stat(filepath.Join(bundleDir, rel)); err != nil {
-			return fmt.Errorf("runtime bundle missing %s", rel)
-		}
-	}
-	return nil
-}
-
-func Package(runtimeDir, outArchive string, manifest Manifest) (string, error) {
-	if err := ValidateBundle(runtimeDir, manifest.RequiredPaths); err != nil {
-		return "", err
-	}
-	metadata, err := metadataArchiveBytes(runtimeDir, manifest.BundleMeta)
-	if err != nil {
-		return "", err
-	}
-	if err := os.MkdirAll(filepath.Dir(outArchive), 0o755); err != nil {
-		return "", err
-	}
-	file, err := os.Create(outArchive)
-	if err != nil {
-		return "", err
-	}
-	defer file.Close()
-
-	hash := sha256.New()
-	multi := io.MultiWriter(file, hash)
-	gz := gzip.NewWriter(multi)
-	defer gz.Close()
-	tw := tar.NewWriter(gz)
-	defer tw.Close()
-
-	for _, rel := range manifest.RequiredPaths {
-		if err := addPathToArchive(tw, runtimeDir, manifest.BundleRoot, rel); err != nil {
-			return "", err
-		}
-	}
-	if len(metadata) != 0 {
-		if err := addBytesToArchive(tw, manifest.BundleRoot, BundleMetadataFile, metadata, 0o644); err != nil {
-			return "", err
-		}
-	}
-	if err := tw.Close(); err != nil {
-		return "", err
-	}
-	if err := gz.Close(); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(hash.Sum(nil)), nil
-}
-
-func LoadBundleMetadata(runtimeDir string) (BundleMetadata, error) {
-	path := filepath.Join(runtimeDir, BundleMetadataFile)
-	data, err := os.ReadFile(path)
-	if err != nil {
-		return BundleMetadata{}, err
-	}
-	var meta BundleMetadata
-	if err := json.Unmarshal(data, &meta); err != nil {
-		return BundleMetadata{}, fmt.Errorf("parse %s: %w", path, err)
-	}
-	meta = normalizeBundleMetadata(meta)
-	if err := validateBundleMetadata(runtimeDir, meta); err != nil {
-		return BundleMetadata{}, err
-	}
-	return meta, nil
-}
-
-func validateBundleMetadata(runtimeDir string, meta BundleMetadata) error {
-	required := []struct {
-		value string
-		label string
-	}{
-		{meta.FirecrackerBin, "firecracker_bin"},
-		{meta.SSHKeyPath, "ssh_key_path"},
-		{meta.NamegenPath, "namegen_path"},
-		{meta.CustomizeScript, "customize_script"},
-		{meta.VSockAgentPath, "vsock_agent_path"},
-		{meta.DefaultPackages, "default_packages_file"},
-		{meta.DefaultRootfs, "default_rootfs"},
-		{meta.DefaultKernel, "default_kernel"},
-	}
-	for _, field := range required {
-		if strings.TrimSpace(field.value) == "" {
-			return fmt.Errorf("runtime bundle metadata missing %s", field.label)
-		}
-	}
-	for _, field := range []struct {
-		value    string
-		label    string
-		required bool
-	}{
-		{meta.FirecrackerBin, "firecracker_bin", true},
-		{meta.SSHKeyPath, "ssh_key_path", true},
-		{meta.NamegenPath, "namegen_path", true},
-		{meta.CustomizeScript, "customize_script", true},
-		{meta.VSockAgentPath, "vsock_agent_path", true},
-		{meta.DefaultPackages, "default_packages_file", true},
-		{meta.DefaultRootfs, "default_rootfs", true},
-		{meta.DefaultBaseRootfs, "default_base_rootfs", false},
-		{meta.DefaultWorkSeed, "default_work_seed", false},
-		{meta.DefaultKernel, "default_kernel", true},
-		{meta.DefaultInitrd, "default_initrd", false},
-		{meta.DefaultModulesDir, "default_modules_dir", false},
-	} {
-		if strings.TrimSpace(field.value) == "" {
-			continue
-		}
-		resolved, err := resolveMetadataPath(runtimeDir, field.value)
-		if err != nil {
-			return fmt.Errorf("runtime bundle metadata %s: %w", field.label, err)
-		}
-		if _, err := os.Stat(resolved); err != nil {
-			if field.required || !errors.Is(err, os.ErrNotExist) {
-				return fmt.Errorf("runtime bundle metadata %s points to missing path %s", field.label, resolved)
-			}
-		}
-	}
-	return nil
-}
-
-func resolveMetadataPath(runtimeDir, rel string) (string, error) {
-	rel = filepath.Clean(strings.TrimSpace(rel))
-	if rel == "." || rel == "" || filepath.IsAbs(rel) || strings.HasPrefix(rel, "..") {
-		return "", fmt.Errorf("invalid relative path %q", rel)
-	}
-	return filepath.Join(runtimeDir, rel), nil
-}
-
-func metadataArchiveBytes(runtimeDir string, meta BundleMetadata) ([]byte, error) {
-	meta = normalizeBundleMetadata(meta)
-	if strings.TrimSpace(meta.FirecrackerBin) == "" &&
-		strings.TrimSpace(meta.SSHKeyPath) == "" &&
-		strings.TrimSpace(meta.NamegenPath) == "" &&
-		strings.TrimSpace(meta.CustomizeScript) == "" &&
-		strings.TrimSpace(meta.VSockAgentPath) == "" &&
-		strings.TrimSpace(meta.DefaultPackages) == "" &&
-		strings.TrimSpace(meta.DefaultRootfs) == "" &&
-		strings.TrimSpace(meta.DefaultBaseRootfs) == "" &&
-		strings.TrimSpace(meta.DefaultWorkSeed) == "" &&
-		strings.TrimSpace(meta.DefaultKernel) == "" &&
-		strings.TrimSpace(meta.DefaultInitrd) == "" &&
-		strings.TrimSpace(meta.DefaultModulesDir) == "" {
-		return nil, nil
-	}
-	if err := validateBundleMetadata(runtimeDir, meta); err != nil {
-		return nil, err
-	}
-	return json.MarshalIndent(meta, "", "  ")
-}
-
-func normalizeBundleMetadata(meta BundleMetadata) BundleMetadata {
-	meta.FirecrackerBin = strings.TrimSpace(meta.FirecrackerBin)
-	meta.SSHKeyPath = strings.TrimSpace(meta.SSHKeyPath)
-	meta.NamegenPath = strings.TrimSpace(meta.NamegenPath)
-	meta.CustomizeScript = strings.TrimSpace(meta.CustomizeScript)
-	meta.VSockAgentPath = strings.TrimSpace(meta.VSockAgentPath)
-	meta.VSockPingHelperPath = strings.TrimSpace(meta.VSockPingHelperPath)
-	if meta.VSockAgentPath == "" {
-		meta.VSockAgentPath = meta.VSockPingHelperPath
-	}
-	meta.DefaultPackages = strings.TrimSpace(meta.DefaultPackages)
-	meta.DefaultRootfs = strings.TrimSpace(meta.DefaultRootfs)
-	meta.DefaultBaseRootfs = strings.TrimSpace(meta.DefaultBaseRootfs)
-	meta.DefaultWorkSeed = strings.TrimSpace(meta.DefaultWorkSeed)
-	meta.DefaultKernel = strings.TrimSpace(meta.DefaultKernel)
-	meta.DefaultInitrd = strings.TrimSpace(meta.DefaultInitrd)
-	meta.DefaultModulesDir = strings.TrimSpace(meta.DefaultModulesDir)
-	return meta
-}
-
-func addPathToArchive(tw *tar.Writer, runtimeDir, bundleRoot, rel string) error {
-	srcPath := filepath.Join(runtimeDir, rel)
-	info, err := os.Lstat(srcPath)
-	if err != nil {
-		return err
-	}
-	archiveName := rel
-	if bundleRoot != "" {
-		archiveName = filepath.Join(bundleRoot, rel)
-	}
-	if info.IsDir() {
-		header, err := tar.FileInfoHeader(info, "")
-		if err != nil {
-			return err
-		}
-		header.Name = filepath.ToSlash(archiveName) + "/"
-		if err := tw.WriteHeader(header); err != nil {
-			return err
-		}
-		entries, err := os.ReadDir(srcPath)
-		if err != nil {
-			return err
-		}
-		for _, entry := range entries {
-			childRel := filepath.Join(rel, entry.Name())
-			if err := addPathToArchive(tw, runtimeDir, bundleRoot, childRel); err != nil {
-				return err
-			}
-		}
-		return nil
-	}
-
-	header, err := tar.FileInfoHeader(info, "")
-	if err != nil {
-		return err
-	}
-	header.Name = filepath.ToSlash(archiveName)
-	if err := tw.WriteHeader(header); err != nil {
-		return err
-	}
-	file, err := os.Open(srcPath)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-	_, err = io.Copy(tw, file)
-	return err
-}
-
-func addBytesToArchive(tw *tar.Writer, bundleRoot, rel string, data []byte, mode int64) error {
-	name := rel
-	if bundleRoot != "" {
-		name = filepath.Join(bundleRoot, rel)
-	}
-	header := &tar.Header{
-		Name: filepath.ToSlash(name),
-		Mode: mode,
-		Size: int64(len(data)),
-	}
-	if err := tw.WriteHeader(header); err != nil {
-		return err
-	}
-	_, err := tw.Write(data)
-	return err
-}
-
-func resolveSource(manifestDir, source string) string {
-	parsed, err := url.Parse(source)
-	if err == nil && parsed.Scheme != "" {
-		return source
-	}
-	if filepath.IsAbs(source) {
-		return source
-	}
-	return filepath.Join(manifestDir, source)
-}
-
-func downloadArchive(ctx context.Context, source, dst string) error {
-	switch {
-	case strings.HasPrefix(source, "http://"), strings.HasPrefix(source, "https://"):
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, source, nil)
-		if err != nil {
-			return err
-		}
-		resp, err := http.DefaultClient.Do(req)
-		if err != nil {
-			return err
-		}
-		defer resp.Body.Close()
-		if resp.StatusCode != http.StatusOK {
-			return fmt.Errorf("download runtime bundle: %s", resp.Status)
-		}
-		return writeFileFromReader(dst, resp.Body)
-	case strings.HasPrefix(source, "file://"):
-		parsed, err := url.Parse(source)
-		if err != nil {
-			return err
-		}
-		return copyFile(parsed.Path, dst)
-	default:
-		return copyFile(source, dst)
-	}
-}
-
-func writeFileFromReader(dst string, reader io.Reader) error {
-	file, err := os.Create(dst)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-	_, err = io.Copy(file, reader)
-	return err
-}
-
-func copyFile(src, dst string) error {
-	in, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer in.Close()
-	return writeFileFromReader(dst, in)
-}
-
-func extractTarGz(archivePath, outDir string) error {
-	if err := os.MkdirAll(outDir, 0o755); err != nil {
-		return err
-	}
-	file, err := os.Open(archivePath)
-	if err != nil {
-		return err
-	}
-	defer file.Close()
-	gz, err := gzip.NewReader(file)
-	if err != nil {
-		return err
-	}
-	defer gz.Close()
-	tr := tar.NewReader(gz)
-	for {
-		header, err := tr.Next()
-		if err == io.EOF {
-			return nil
-		}
-		if err != nil {
-			return err
-		}
-		name := filepath.Clean(header.Name)
-		if name == "." || strings.HasPrefix(name, "..") || filepath.IsAbs(name) {
-			return fmt.Errorf("invalid archive entry: %s", header.Name)
-		}
-		target := filepath.Join(outDir, name)
-		switch header.Typeflag {
-		case tar.TypeDir:
-			if err := os.MkdirAll(target, os.FileMode(header.Mode)); err != nil {
-				return err
-			}
-		case tar.TypeReg, tar.TypeRegA:
-			if err := os.MkdirAll(filepath.Dir(target), 0o755); err != nil {
-				return err
-			}
-			file, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR|os.O_TRUNC, os.FileMode(header.Mode))
-			if err != nil {
-				return err
-			}
-			if _, err := io.Copy(file, tr); err != nil {
-				file.Close()
-				return err
-			}
-			if err := file.Close(); err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("unsupported archive entry type: %s", header.Name)
-		}
-	}
-}
-
-func fileSHA256(path string) (string, error) {
-	file, err := os.Open(path)
-	if err != nil {
-		return "", err
-	}
-	defer file.Close()
-	hash := sha256.New()
-	if _, err := io.Copy(hash, file); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(hash.Sum(nil)), nil
-}
diff --git a/internal/runtimebundle/bundle_test.go b/internal/runtimebundle/bundle_test.go
deleted file mode 100644
index ea8c56c..0000000
--- a/internal/runtimebundle/bundle_test.go
+++ /dev/null
@@ -1,288 +0,0 @@
-package runtimebundle
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestBootstrapExtractsBundleAndValidatesChecksum(t *testing.T) {
-	manifestDir := t.TempDir()
-	bundleData := buildArchive(t, map[string]string{
-		"runtime/firecracker":                                       "fc",
-		"runtime/id_ed25519":                                        "key",
-		"runtime/namegen":                                           "namegen",
-		"runtime/banger-vsock-agent":                                "agent",
-		"runtime/customize.sh":                                      "#!/bin/bash\n",
-		"runtime/packages.sh":                                       "#!/bin/bash\n",
-		"runtime/packages.apt":                                      "vim\n",
-		"runtime/rootfs-docker.ext4":                                "rootfs",
-		"runtime/wtf/root/boot/vmlinux-6.8.0-94-generic":            "kernel",
-		"runtime/wtf/root/boot/initrd.img-6.8.0-94-generic":         "initrd",
-		"runtime/wtf/root/lib/modules/6.8.0-94-generic/modules.dep": "dep",
-		"runtime/bundle.json":                                       mustJSON(t, BundleMetadata{FirecrackerBin: "firecracker", SSHKeyPath: "id_ed25519", NamegenPath: "namegen", CustomizeScript: "customize.sh", VSockAgentPath: "banger-vsock-agent", DefaultPackages: "packages.apt", DefaultRootfs: "rootfs-docker.ext4", DefaultKernel: "wtf/root/boot/vmlinux-6.8.0-94-generic", DefaultInitrd: "wtf/root/boot/initrd.img-6.8.0-94-generic", DefaultModulesDir: "wtf/root/lib/modules/6.8.0-94-generic"}),
-	})
-	archivePath := filepath.Join(manifestDir, "bundle.tar.gz")
-	if err := os.WriteFile(archivePath, bundleData, 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-
-	manifest := Manifest{
-		URL:           "./bundle.tar.gz",
-		SHA256:        sha256Hex(bundleData),
-		BundleRoot:    "runtime",
-		RequiredPaths: []string{"firecracker", "banger-vsock-agent", "customize.sh", "packages.apt", "rootfs-docker.ext4", "wtf/root/boot/vmlinux-6.8.0-94-generic", "wtf/root/lib/modules/6.8.0-94-generic"},
-	}
-	outDir := filepath.Join(t.TempDir(), "runtime")
-	if err := Bootstrap(context.Background(), manifest, filepath.Join(manifestDir, "runtime-bundle.toml"), outDir); err != nil {
-		t.Fatalf("Bootstrap: %v", err)
-	}
-	for _, rel := range manifest.RequiredPaths {
-		if _, err := os.Stat(filepath.Join(outDir, rel)); err != nil {
-			t.Fatalf("runtime missing %s: %v", rel, err)
-		}
-	}
-}
-
-func TestBootstrapRejectsChecksumMismatch(t *testing.T) {
-	manifestDir := t.TempDir()
-	archivePath := filepath.Join(manifestDir, "bundle.tar.gz")
-	if err := os.WriteFile(archivePath, []byte("not-a-tarball"), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	manifest := Manifest{
-		URL:           "./bundle.tar.gz",
-		SHA256:        strings.Repeat("0", 64),
-		BundleRoot:    "runtime",
-		RequiredPaths: []string{"firecracker"},
-	}
-	err := Bootstrap(context.Background(), manifest, filepath.Join(manifestDir, "runtime-bundle.toml"), filepath.Join(t.TempDir(), "runtime"))
-	if err == nil || !strings.Contains(err.Error(), "checksum mismatch") {
-		t.Fatalf("Bootstrap() error = %v, want checksum mismatch", err)
-	}
-}
-
-func TestBootstrapRejectsMissingURLWithLocalManifestGuidance(t *testing.T) {
-	manifest := Manifest{
-		SHA256:        strings.Repeat("0", 64),
-		BundleRoot:    "runtime",
-		RequiredPaths: []string{"firecracker"},
-	}
-	err := Bootstrap(context.Background(), manifest, filepath.Join(t.TempDir(), "runtime-bundle.toml"), filepath.Join(t.TempDir(), "runtime"))
-	if err == nil || !strings.Contains(err.Error(), "local manifest copy") {
-		t.Fatalf("Bootstrap() error = %v, want local manifest guidance", err)
-	}
-}
-
-func TestBootstrapRejectsMissingSHAWithArchiveGuidance(t *testing.T) {
-	manifest := Manifest{
-		URL:           "./bundle.tar.gz",
-		BundleRoot:    "runtime",
-		RequiredPaths: []string{"firecracker"},
-	}
-	err := Bootstrap(context.Background(), manifest, filepath.Join(t.TempDir(), "runtime-bundle.toml"), filepath.Join(t.TempDir(), "runtime"))
-	if err == nil || !strings.Contains(err.Error(), "staged or published runtime bundle archive") {
-		t.Fatalf("Bootstrap() error = %v, want archive guidance", err)
-	}
-}
-
-func TestPackageWritesArchive(t *testing.T) {
-	runtimeDir := t.TempDir()
-	for _, rel := range []string{
-		"firecracker",
-		"id_ed25519",
-		"namegen",
-		"banger-vsock-agent",
-		"customize.sh",
-		"packages.apt",
-		"rootfs-docker.ext4",
-		"wtf/root/boot/vmlinux-6.8.0-94-generic",
-		"wtf/root/boot/initrd.img-6.8.0-94-generic",
-		"wtf/root/lib/modules/6.8.0-94-generic",
-	} {
-		path := filepath.Join(runtimeDir, rel)
-		if rel == "wtf/root/lib/modules/6.8.0-94-generic" {
-			if err := os.MkdirAll(path, 0o755); err != nil {
-				t.Fatalf("MkdirAll: %v", err)
-			}
-			if err := os.WriteFile(filepath.Join(path, "modules.dep"), []byte(rel), 0o644); err != nil {
-				t.Fatalf("WriteFile: %v", err)
-			}
-			continue
-		}
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("MkdirAll: %v", err)
-		}
-		if err := os.WriteFile(path, []byte(rel), 0o644); err != nil {
-			t.Fatalf("WriteFile: %v", err)
-		}
-	}
-	manifest := Manifest{
-		BundleRoot: "runtime",
-		BundleMeta: BundleMetadata{
-			FirecrackerBin:    "firecracker",
-			SSHKeyPath:        "id_ed25519",
-			NamegenPath:       "namegen",
-			CustomizeScript:   "customize.sh",
-			VSockAgentPath:    "banger-vsock-agent",
-			DefaultPackages:   "packages.apt",
-			DefaultRootfs:     "rootfs-docker.ext4",
-			DefaultKernel:     "wtf/root/boot/vmlinux-6.8.0-94-generic",
-			DefaultInitrd:     "wtf/root/boot/initrd.img-6.8.0-94-generic",
-			DefaultModulesDir: "wtf/root/lib/modules/6.8.0-94-generic",
-		},
-		RequiredPaths: []string{
-			"firecracker",
-			"id_ed25519",
-			"namegen",
-			"banger-vsock-agent",
-			"customize.sh",
-			"packages.apt",
-			"rootfs-docker.ext4",
-			"wtf/root/boot/vmlinux-6.8.0-94-generic",
-			"wtf/root/boot/initrd.img-6.8.0-94-generic",
-			"wtf/root/lib/modules/6.8.0-94-generic",
-		},
-	}
-	outArchive := filepath.Join(t.TempDir(), "bundle.tar.gz")
-	sum, err := Package(runtimeDir, outArchive, manifest)
-	if err != nil {
-		t.Fatalf("Package: %v", err)
-	}
-	if sum == "" {
-		t.Fatalf("Package() returned empty checksum")
-	}
-	if _, err := os.Stat(outArchive); err != nil {
-		t.Fatalf("archive missing: %v", err)
-	}
-	runtimeOut := filepath.Join(t.TempDir(), "runtime")
-	if err := Bootstrap(context.Background(), Manifest{
-		URL:           outArchive,
-		SHA256:        sum,
-		BundleRoot:    "runtime",
-		RequiredPaths: manifest.RequiredPaths,
-	}, filepath.Join(t.TempDir(), "runtime-bundle.toml"), runtimeOut); err != nil {
-		t.Fatalf("Bootstrap packaged archive: %v", err)
-	}
-	if _, err := os.Stat(filepath.Join(runtimeOut, BundleMetadataFile)); err != nil {
-		t.Fatalf("bundle metadata missing after bootstrap: %v", err)
-	}
-	meta, err := LoadBundleMetadata(runtimeOut)
-	if err != nil {
-		t.Fatalf("LoadBundleMetadata: %v", err)
-	}
-	if meta.DefaultRootfs != manifest.BundleMeta.DefaultRootfs {
-		t.Fatalf("DefaultRootfs = %q, want %q", meta.DefaultRootfs, manifest.BundleMeta.DefaultRootfs)
-	}
-}
-
-func TestLoadBundleMetadataRejectsMissingRequiredPath(t *testing.T) {
-	runtimeDir := t.TempDir()
-	for _, rel := range []string{"firecracker", "id_ed25519", "namegen", "banger-vsock-agent", "customize.sh", "packages.apt", "rootfs-docker.ext4"} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("MkdirAll: %v", err)
-		}
-		if err := os.WriteFile(path, []byte(rel), 0o644); err != nil {
-			t.Fatalf("WriteFile: %v", err)
-		}
-	}
-	data := mustJSON(t, BundleMetadata{
-		FirecrackerBin:  "firecracker",
-		SSHKeyPath:      "id_ed25519",
-		NamegenPath:     "namegen",
-		CustomizeScript: "customize.sh",
-		VSockAgentPath:  "banger-vsock-agent",
-		DefaultPackages: "packages.apt",
-		DefaultRootfs:   "rootfs-docker.ext4",
-		DefaultKernel:   "missing-kernel",
-	})
-	if err := os.WriteFile(filepath.Join(runtimeDir, BundleMetadataFile), []byte(data), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	if _, err := LoadBundleMetadata(runtimeDir); err == nil || !strings.Contains(err.Error(), "default_kernel") {
-		t.Fatalf("LoadBundleMetadata() error = %v, want default_kernel failure", err)
-	}
-}
-
-func TestLoadBundleMetadataAcceptsLegacyVsockPingHelperPath(t *testing.T) {
-	runtimeDir := t.TempDir()
-	for _, rel := range []string{"firecracker", "id_ed25519", "namegen", "banger-vsock-pingd", "customize.sh", "packages.apt", "rootfs-docker.ext4", "wtf/root/boot/vmlinux-6.8.0-94-generic"} {
-		path := filepath.Join(runtimeDir, rel)
-		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
-			t.Fatalf("MkdirAll: %v", err)
-		}
-		if err := os.WriteFile(path, []byte(rel), 0o644); err != nil {
-			t.Fatalf("WriteFile: %v", err)
-		}
-	}
-	data := mustJSON(t, BundleMetadata{
-		FirecrackerBin:      "firecracker",
-		SSHKeyPath:          "id_ed25519",
-		NamegenPath:         "namegen",
-		CustomizeScript:     "customize.sh",
-		VSockPingHelperPath: "banger-vsock-pingd",
-		DefaultPackages:     "packages.apt",
-		DefaultRootfs:       "rootfs-docker.ext4",
-		DefaultKernel:       "wtf/root/boot/vmlinux-6.8.0-94-generic",
-	})
-	if err := os.WriteFile(filepath.Join(runtimeDir, BundleMetadataFile), []byte(data), 0o644); err != nil {
-		t.Fatalf("WriteFile: %v", err)
-	}
-	meta, err := LoadBundleMetadata(runtimeDir)
-	if err != nil {
-		t.Fatalf("LoadBundleMetadata: %v", err)
-	}
-	if meta.VSockAgentPath != "banger-vsock-pingd" {
-		t.Fatalf("VSockAgentPath = %q", meta.VSockAgentPath)
-	}
-}
-
-func buildArchive(t *testing.T, files map[string]string) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	gz := gzip.NewWriter(&buf)
-	tw := tar.NewWriter(gz)
-	for name, contents := range files {
-		header := &tar.Header{
-			Name: name,
-			Mode: 0o644,
-			Size: int64(len(contents)),
-		}
-		if err := tw.WriteHeader(header); err != nil {
-			t.Fatalf("WriteHeader(%s): %v", name, err)
-		}
-		if _, err := tw.Write([]byte(contents)); err != nil {
-			t.Fatalf("Write(%s): %v", name, err)
-		}
-	}
-	if err := tw.Close(); err != nil {
-		t.Fatalf("Close tar: %v", err)
-	}
-	if err := gz.Close(); err != nil {
-		t.Fatalf("Close gzip: %v", err)
-	}
-	return buf.Bytes()
-}
-
-func sha256Hex(data []byte) string {
-	sum := sha256.Sum256(data)
-	return hex.EncodeToString(sum[:])
-}
-
-func mustJSON(t *testing.T, value any) string {
-	t.Helper()
-	data, err := json.Marshal(value)
-	if err != nil {
-		t.Fatalf("Marshal: %v", err)
-	}
-	return string(data)
-}
diff --git a/internal/store/store.go b/internal/store/store.go
index f15ebfc..1ef1dca 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -120,8 +120,8 @@ func (s *Store) UpsertImage(ctx context.Context, image model.Image) error {
 	const query = `
 	INSERT INTO images (
 		id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path,
-		modules_dir, packages_path, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at
-	) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+		modules_dir, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at
+	) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	ON CONFLICT(id) DO UPDATE SET
 		name=excluded.name,
 		managed=excluded.managed,
@@ -131,7 +131,6 @@ func (s *Store) UpsertImage(ctx context.Context, image model.Image) error {
 		kernel_path=excluded.kernel_path,
 		initrd_path=excluded.initrd_path,
 		modules_dir=excluded.modules_dir,
-		packages_path=excluded.packages_path,
 		build_size=excluded.build_size,
 		seeded_ssh_public_key_fingerprint=excluded.seeded_ssh_public_key_fingerprint,
 		docker=excluded.docker,
@@ -146,7 +145,6 @@ func (s *Store) UpsertImage(ctx context.Context, image model.Image) error {
 		image.KernelPath,
 		image.InitrdPath,
 		image.ModulesDir,
-		image.PackagesPath,
 		image.BuildSize,
 		image.SeededSSHPublicKeyFingerprint,
 		boolToInt(image.Docker),
@@ -157,15 +155,15 @@ func (s *Store) UpsertImage(ctx context.Context, image model.Image) error {
 }
 
 func (s *Store) GetImageByName(ctx context.Context, name string) (model.Image, error) {
-	return s.getImage(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, packages_path, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images WHERE name = ?", name)
+	return s.getImage(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images WHERE name = ?", name)
 }
 
 func (s *Store) GetImageByID(ctx context.Context, id string) (model.Image, error) {
-	return s.getImage(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, packages_path, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images WHERE id = ?", id)
+	return s.getImage(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images WHERE id = ?", id)
 }
 
 func (s *Store) ListImages(ctx context.Context) ([]model.Image, error) {
-	rows, err := s.db.QueryContext(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, packages_path, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images ORDER BY created_at ASC")
+	rows, err := s.db.QueryContext(ctx, "SELECT id, name, managed, artifact_dir, rootfs_path, work_seed_path, kernel_path, initrd_path, modules_dir, build_size, seeded_ssh_public_key_fingerprint, docker, created_at, updated_at FROM images ORDER BY created_at ASC")
 	if err != nil {
 		return nil, err
 	}
@@ -355,7 +353,6 @@ func scanImageRow(row scanner) (model.Image, error) {
 		&image.KernelPath,
 		&image.InitrdPath,
 		&image.ModulesDir,
-		&image.PackagesPath,
 		&image.BuildSize,
 		&seededSSHPublicKeyFingerprint,
 		&docker,
diff --git a/internal/store/store_test.go b/internal/store/store_test.go
index 0e7ea2a..164ad4e 100644
--- a/internal/store/store_test.go
+++ b/internal/store/store_test.go
@@ -344,7 +344,6 @@ func sampleImage(name string) model.Image {
 		KernelPath:                    "/kernels/" + name,
 		InitrdPath:                    "/initrd/" + name,
 		ModulesDir:                    "/modules/" + name,
-		PackagesPath:                  "/packages/" + name + ".apt",
 		BuildSize:                     "8G",
 		SeededSSHPublicKeyFingerprint: "seeded-fingerprint",
 		Docker:                        true,
diff --git a/internal/system/system.go b/internal/system/system.go
index 753b532..fc81fd5 100644
--- a/internal/system/system.go
+++ b/internal/system/system.go
@@ -84,6 +84,10 @@ func RequireCommands(ctx context.Context, commands ...string) error {
 	return nil
 }
 
+func LookupExecutable(name string) (string, error) {
+	return exec.LookPath(name)
+}
+
 func WriteJSON(path string, value any) error {
 	data, err := json.MarshalIndent(value, "", "  ")
 	if err != nil {
diff --git a/internal/webui/server.go b/internal/webui/server.go
index d87dccb..0199b41 100644
--- a/internal/webui/server.go
+++ b/internal/webui/server.go
@@ -86,7 +86,7 @@ type vmSetForm struct {
 
 type imageBuildForm struct {
 	Name       string
-	BaseRootfs string
+	FromImage  string
 	Size       string
 	KernelPath string
 	InitrdPath string
@@ -101,7 +101,6 @@ type imageRegisterForm struct {
 	KernelPath   string
 	InitrdPath   string
 	ModulesDir   string
-	PackagesPath string
 	Docker       bool
 }
 
@@ -524,13 +523,7 @@ func (s *Server) handleImageList(w http.ResponseWriter, r *http.Request) error {
 }
 
 func (s *Server) handleImageBuildForm(w http.ResponseWriter, r *http.Request) error {
-	cfg := s.backend.Config()
-	return s.renderImageBuildPage(w, r, imageBuildForm{
-		BaseRootfs: cfg.DefaultBaseRootfs,
-		KernelPath: cfg.DefaultKernel,
-		InitrdPath: cfg.DefaultInitrd,
-		ModulesDir: cfg.DefaultModulesDir,
-	}, "")
+	return s.renderImageBuildPage(w, r, imageBuildForm{}, "")
 }
 
 func (s *Server) renderImageBuildPage(w http.ResponseWriter, r *http.Request, form imageBuildForm, formErr string) error {
@@ -566,12 +559,7 @@ func (s *Server) handleImageBuild(w http.ResponseWriter, r *http.Request) error
 }
 
 func (s *Server) handleImageRegisterForm(w http.ResponseWriter, r *http.Request) error {
-	cfg := s.backend.Config()
-	return s.renderImageRegisterPage(w, r, imageRegisterForm{
-		KernelPath: cfg.DefaultKernel,
-		InitrdPath: cfg.DefaultInitrd,
-		ModulesDir: cfg.DefaultModulesDir,
-	}, "")
+	return s.renderImageRegisterPage(w, r, imageRegisterForm{}, "")
 }
 
 func (s *Server) renderImageRegisterPage(w http.ResponseWriter, r *http.Request, form imageRegisterForm, formErr string) error {
@@ -808,9 +796,6 @@ func (s *Server) pickerRoots() []pickerRoot {
 	if layout.StateDir != "" {
 		roots = append(roots, pickerRoot{Label: "State", Path: layout.StateDir})
 	}
-	if runtimeDir := s.backend.Config().RuntimeDir; runtimeDir != "" {
-		roots = append(roots, pickerRoot{Label: "Runtime", Path: runtimeDir})
-	}
 	result := make([]pickerRoot, 0, len(roots))
 	for _, root := range roots {
 		root.Path = filepath.Clean(root.Path)
@@ -998,7 +983,7 @@ func (s *Server) parseImageBuildForm(r *http.Request) (imageBuildForm, api.Image
 	}
 	form := imageBuildForm{
 		Name:       strings.TrimSpace(r.FormValue("name")),
-		BaseRootfs: strings.TrimSpace(r.FormValue("base_rootfs")),
+		FromImage:  strings.TrimSpace(r.FormValue("from_image")),
 		Size:       strings.TrimSpace(r.FormValue("size")),
 		KernelPath: strings.TrimSpace(r.FormValue("kernel_path")),
 		InitrdPath: strings.TrimSpace(r.FormValue("initrd_path")),
@@ -1007,7 +992,7 @@ func (s *Server) parseImageBuildForm(r *http.Request) (imageBuildForm, api.Image
 	}
 	params := api.ImageBuildParams{
 		Name:       form.Name,
-		BaseRootfs: form.BaseRootfs,
+		FromImage:  form.FromImage,
 		Size:       form.Size,
 		KernelPath: form.KernelPath,
 		InitrdPath: form.InitrdPath,
@@ -1028,7 +1013,6 @@ func (s *Server) parseImageRegisterForm(r *http.Request) (imageRegisterForm, api
 		KernelPath:   strings.TrimSpace(r.FormValue("kernel_path")),
 		InitrdPath:   strings.TrimSpace(r.FormValue("initrd_path")),
 		ModulesDir:   strings.TrimSpace(r.FormValue("modules_dir")),
-		PackagesPath: strings.TrimSpace(r.FormValue("packages_path")),
 		Docker:       r.FormValue("docker") == "on",
 	}
 	params := api.ImageRegisterParams{
@@ -1038,7 +1022,6 @@ func (s *Server) parseImageRegisterForm(r *http.Request) (imageRegisterForm, api
 		KernelPath:   form.KernelPath,
 		InitrdPath:   form.InitrdPath,
 		ModulesDir:   form.ModulesDir,
-		PackagesPath: form.PackagesPath,
 		Docker:       form.Docker,
 	}
 	return form, params, nil
diff --git a/internal/webui/templates/images.html b/internal/webui/templates/images.html
index 0b4fe3b..f8e884b 100644
--- a/internal/webui/templates/images.html
+++ b/internal/webui/templates/images.html
@@ -33,20 +33,14 @@
 {{end}}
 
 {{define "image_build_content"}}
-<p class="muted">Build a managed image from a base rootfs, then redirect into the async build progress view.</p>
+<p class="muted">Build a managed image from an existing registered image, then redirect into the async build progress view.</p>
 {{if .ErrorMessage}}
 <div class="inline-error">{{.ErrorMessage}}</div>
 {{end}}
 <form method="post" action="/images/build" class="form-grid">
   {{template "csrf_field" .}}
   <label><span>Name</span><input type="text" name="name" value="{{.ImageBuildForm.Name}}" placeholder="generated when empty"></label>
-  <label class="picker-field">
-    <span>Base Rootfs</span>
-    <div class="picker-input">
-      <input type="text" name="base_rootfs" value="{{.ImageBuildForm.BaseRootfs}}" data-picker-input>
-      <button type="button" class="button secondary" data-picker-target="base_rootfs" data-picker-kind="file">Browse</button>
-    </div>
-  </label>
+  <label><span>From Image</span><input type="text" name="from_image" value="{{.ImageBuildForm.FromImage}}" placeholder="image id or name"></label>
   <label><span>Size Override</span><input type="text" name="size" value="{{.ImageBuildForm.Size}}" placeholder="optional"></label>
   <label class="picker-field">
     <span>Kernel Path</span>
@@ -123,13 +117,6 @@
       <button type="button" class="button secondary" data-picker-target="modules_dir" data-picker-kind="dir">Browse</button>
     </div>
   </label>
-  <label class="picker-field">
-    <span>Packages Manifest</span>
-    <div class="picker-input">
-      <input type="text" name="packages_path" value="{{.ImageRegisterForm.PackagesPath}}" data-picker-input>
-      <button type="button" class="button secondary" data-picker-target="packages_path" data-picker-kind="file">Browse</button>
-    </div>
-  </label>
   <label class="checkbox">
     <input type="checkbox" name="docker" {{if .ImageRegisterForm.Docker}}checked{{end}}>
     <span>Mark image as Docker-ready</span>
@@ -167,7 +154,6 @@
     <dl>
       <dt>Created</dt><dd>{{relativeTime .Image.CreatedAt}}</dd>
       <dt>Updated</dt><dd>{{relativeTime .Image.UpdatedAt}}</dd>
-      <dt>Packages</dt><dd>{{if .Image.PackagesPath}}<code>{{.Image.PackagesPath}}</code>{{else}}-{{end}}</dd>
       <dt>Artifact Dir</dt><dd>{{if .Image.ArtifactDir}}<code>{{.Image.ArtifactDir}}</code>{{else}}-{{end}}</dd>
     </dl>
   </article>
diff --git a/scripts/customize.sh b/scripts/customize.sh
index 52b90d6..608f06a 100755
--- a/scripts/customize.sh
+++ b/scripts/customize.sh
@@ -31,49 +31,10 @@ parse_size() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-if [[ ! -d "$RUNTIME_DIR" ]]; then
-  log "runtime bundle not found: $RUNTIME_DIR"
-  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
-  exit 1
-fi
-source "$SCRIPT_DIR/lib/packages.sh"
 STATE="${BANGER_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/banger/image-build}"
 VM_ROOT="$STATE/vms"
 mkdir -p "$VM_ROOT"
 
-BUNDLE_METADATA="$RUNTIME_DIR/bundle.json"
-
-bundle_path() {
-  local key="$1"
-  local fallback="$2"
-  local rel=""
-
-  if [[ -f "$BUNDLE_METADATA" ]] && command -v jq >/dev/null 2>&1; then
-    rel="$(jq -r --arg key "$key" '.[$key] // empty' "$BUNDLE_METADATA" 2>/dev/null || true)"
-  fi
-  if [[ -n "$rel" && "$rel" != "null" ]]; then
-    printf '%s\n' "$RUNTIME_DIR/$rel"
-    return
-  fi
-  printf '%s\n' "$fallback"
-}
-
-BASE_ROOTFS="$RUNTIME_DIR/rootfs.ext4"
-FC_BIN="$RUNTIME_DIR/firecracker"
-
-KERNEL="$(bundle_path default_kernel "$RUNTIME_DIR/wtf/root/boot/vmlinux-6.8.0-94-generic")"
-INITRD="$(bundle_path default_initrd "$RUNTIME_DIR/wtf/root/boot/initrd.img-6.8.0-94-generic")"
-SSH_KEY="$RUNTIME_DIR/id_ed25519"
-VSOCK_AGENT="$(bundle_path vsock_agent_path "$RUNTIME_DIR/banger-vsock-agent")"
-if [[ "$VSOCK_AGENT" == "$RUNTIME_DIR/banger-vsock-agent" && ! -x "$VSOCK_AGENT" ]]; then
-  VSOCK_AGENT="$(bundle_path vsock_ping_helper_path "$RUNTIME_DIR/banger-vsock-pingd")"
-fi
-
 BR_DEV="br-fc"
 BR_IP="172.16.0.1"
 CIDR="24"
@@ -102,16 +63,34 @@ resolve_banger_bin() {
 
 BANGER_BIN="$(resolve_banger_bin)"
 NAT_ACTIVE=0
+FC_BIN="$("$BANGER_BIN" internal firecracker-path)"
+SSH_KEY="$("$BANGER_BIN" internal ssh-key-path)"
+VSOCK_AGENT="$("$BANGER_BIN" internal vsock-agent-path)"
 
 banger_nat() {
   local action="$1"
   "$BANGER_BIN" internal nat "$action" --guest-ip "$GUEST_IP" --tap "$TAP_DEV"
 }
 
+load_package_preset() {
+  local preset="$1"
+  local -n out="$2"
+  mapfile -t out < <("$BANGER_BIN" internal packages "$preset")
+  (( ${#out[@]} > 0 ))
+}
+
+write_rootfs_manifest_metadata() {
+  local rootfs_path="$1"
+  local manifest_hash="$2"
+  printf '%s\n' "$manifest_hash" > "${rootfs_path}.packages.sha256"
+}
+
 BASE_ROOTFS=""
 OUT_ROOTFS=""
 SIZE_SPEC=""
 INSTALL_DOCKER=0
+KERNEL=""
+INITRD=""
 MISE_VERSION="v2025.12.0"
 MISE_INSTALL_PATH="/usr/local/bin/mise"
 MISE_ACTIVATE_LINE='eval "$(/usr/local/bin/mise activate bash)"'
@@ -122,8 +101,7 @@ TMUX_RESURRECT_REPO="https://github.com/tmux-plugins/tmux-resurrect"
 TMUX_CONTINUUM_REPO="https://github.com/tmux-plugins/tmux-continuum"
 TMUX_MANAGED_START="# >>> banger tmux plugins >>>"
 TMUX_MANAGED_END="# <<< banger tmux plugins <<<"
-MODULES_DIR="$(bundle_path default_modules_dir "$RUNTIME_DIR/wtf/root/lib/modules/6.8.0-94-generic")"
-PACKAGES_FILE="$(banger_packages_file)"
+MODULES_DIR=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --out)
@@ -187,6 +165,10 @@ if [[ "$OUT_ROOTFS" == *.ext4 ]]; then
 else
   WORK_SEED="${OUT_ROOTFS}.work-seed"
 fi
+if [[ -z "$KERNEL" ]]; then
+  log "kernel path is required; pass --kernel"
+  exit 1
+fi
 if [[ ! -f "$KERNEL" ]]; then
   log "kernel not found: $KERNEL"
   exit 1
@@ -214,26 +196,22 @@ if ! command -v jq >/dev/null 2>&1; then
   exit 1
 fi
 if ! command -v sha256sum >/dev/null 2>&1; then
-  log "sha256sum required to record package manifest metadata"
-  exit 1
-fi
-if [[ ! -f "$PACKAGES_FILE" ]]; then
-  log "package manifest not found: $PACKAGES_FILE"
+  log "sha256sum required to record package preset metadata"
   exit 1
 fi
 if [[ ! -x "$VSOCK_AGENT" ]]; then
   log "vsock agent not found or not executable: $VSOCK_AGENT"
-  log "run 'make build' or refresh the runtime bundle"
+  log "run 'make build'"
   exit 1
 fi
 
 APT_PACKAGES=()
-if ! banger_packages_read_array APT_PACKAGES "$PACKAGES_FILE"; then
-  log "package manifest is empty: $PACKAGES_FILE"
+if ! load_package_preset debian APT_PACKAGES; then
+  log "debian package preset is empty"
   exit 1
 fi
-if ! PACKAGES_HASH="$(printf '%s\n' "${APT_PACKAGES[@]}" | banger_packages_hash_stream)"; then
-  log "failed to hash package manifest: $PACKAGES_FILE"
+if ! PACKAGES_HASH="$(printf '%s\n' "${APT_PACKAGES[@]}" | sha256sum | awk '{print $1}')"; then
+  log "failed to hash package preset"
   exit 1
 fi
 printf -v APT_PACKAGES_ESCAPED '%q ' "${APT_PACKAGES[@]}"
@@ -587,7 +565,7 @@ for _ in $(seq 1 200); do
   fi
   sleep 0.05
 done
-banger_write_rootfs_manifest_metadata "$OUT_ROOTFS" "$PACKAGES_HASH"
+write_rootfs_manifest_metadata "$OUT_ROOTFS" "$PACKAGES_HASH"
 log "building work seed $WORK_SEED"
 "$BANGER_BIN" internal work-seed --rootfs "$OUT_ROOTFS" --out "$WORK_SEED"
 log "done"
diff --git a/scripts/interactive.sh b/scripts/interactive.sh
index bda0798..e579faf 100755
--- a/scripts/interactive.sh
+++ b/scripts/interactive.sh
@@ -7,7 +7,7 @@ log() {
 
 usage() {
   cat <<'EOF'
-Usage: ./scripts/interactive.sh <base-rootfs> [--out <path>] [--size <size>]
+Usage: ./scripts/interactive.sh <base-rootfs> --kernel <path> [--initrd <path>] [--size <size>]
 
 Creates a writable copy of the base rootfs and boots a VM so you can
 customize it manually over SSH. No automatic package/config changes
@@ -32,42 +32,10 @@ parse_size() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-if [[ ! -d "$RUNTIME_DIR" ]]; then
-  log "runtime bundle not found: $RUNTIME_DIR"
-  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
-  exit 1
-fi
 STATE="${BANGER_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/banger/interactive}"
 VM_ROOT="$STATE/vms"
 mkdir -p "$VM_ROOT"
 
-BUNDLE_METADATA="$RUNTIME_DIR/bundle.json"
-
-bundle_path() {
-  local key="$1"
-  local fallback="$2"
-  local rel=""
-
-  if [[ -f "$BUNDLE_METADATA" ]] && command -v jq >/dev/null 2>&1; then
-    rel="$(jq -r --arg key "$key" '.[$key] // empty' "$BUNDLE_METADATA" 2>/dev/null || true)"
-  fi
-  if [[ -n "$rel" && "$rel" != "null" ]]; then
-    printf '%s\n' "$RUNTIME_DIR/$rel"
-    return
-  fi
-  printf '%s\n' "$fallback"
-}
-
-FC_BIN="$RUNTIME_DIR/firecracker"
-KERNEL="$(bundle_path default_kernel "$RUNTIME_DIR/wtf/root/boot/vmlinux-6.8.0-94-generic")"
-INITRD="$(bundle_path default_initrd "$RUNTIME_DIR/wtf/root/boot/initrd.img-6.8.0-94-generic")"
-SSH_KEY="$RUNTIME_DIR/id_ed25519"
-
 BR_DEV="br-fc"
 BR_IP="172.16.0.1"
 CIDR="24"
@@ -96,6 +64,10 @@ resolve_banger_bin() {
 
 BANGER_BIN="$(resolve_banger_bin)"
 NAT_ACTIVE=0
+FC_BIN="$("$BANGER_BIN" internal firecracker-path)"
+SSH_KEY="$("$BANGER_BIN" internal ssh-key-path)"
+KERNEL=""
+INITRD=""
 
 banger_nat() {
   local action="$1"
@@ -115,6 +87,14 @@ while [[ $# -gt 0 ]]; do
       SIZE_SPEC="${2:-}"
       shift 2
       ;;
+    --kernel)
+      KERNEL="${2:-}"
+      shift 2
+      ;;
+    --initrd)
+      INITRD="${2:-}"
+      shift 2
+      ;;
     -h|--help)
       usage
       exit 0
@@ -140,11 +120,15 @@ if [[ ! -f "$BASE_ROOTFS" ]]; then
   log "base rootfs not found: $BASE_ROOTFS"
   exit 1
 fi
+if [[ -z "$KERNEL" ]]; then
+  log "kernel path is required; pass --kernel"
+  exit 1
+fi
 if [[ ! -f "$KERNEL" ]]; then
   log "kernel not found: $KERNEL"
   exit 1
 fi
-if [[ ! -f "$INITRD" ]]; then
+if [[ -n "$INITRD" && ! -f "$INITRD" ]]; then
   log "initrd not found: $INITRD"
   exit 1
 fi
diff --git a/scripts/lib/packages.sh b/scripts/lib/packages.sh
deleted file mode 100644
index 3a87295..0000000
--- a/scripts/lib/packages.sh
+++ /dev/null
@@ -1,116 +0,0 @@
-#!/usr/bin/env bash
-
-readonly BANGER_PACKAGES_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly BANGER_REPO_ROOT="$(cd "$BANGER_PACKAGES_DIR/../.." && pwd)"
-BANGER_APT_PACKAGES_FILE="${BANGER_APT_PACKAGES_FILE:-$BANGER_REPO_ROOT/config/packages.apt}"
-
-banger_packages_file() {
-  printf '%s' "$BANGER_APT_PACKAGES_FILE"
-}
-
-banger_packages_normalized_lines() {
-  local packages_file="${1:-$BANGER_APT_PACKAGES_FILE}"
-
-  [[ -f "$packages_file" ]] || return 1
-  awk '
-    {
-      sub(/\r$/, "")
-      sub(/[[:space:]]*#.*$/, "")
-      gsub(/^[[:space:]]+|[[:space:]]+$/, "")
-      if ($0 != "") print
-    }
-  ' "$packages_file"
-}
-
-banger_packages_read_array() {
-  local -n out="$1"
-  local packages_file="${2:-$BANGER_APT_PACKAGES_FILE}"
-
-  mapfile -t out < <(banger_packages_normalized_lines "$packages_file")
-  (( ${#out[@]} > 0 ))
-}
-
-banger_packages_hash_stream() {
-  command -v sha256sum >/dev/null 2>&1 || return 1
-  sha256sum | awk '{print $1}'
-}
-
-banger_packages_manifest_hash() {
-  local packages_file="${1:-$BANGER_APT_PACKAGES_FILE}"
-
-  [[ -f "$packages_file" ]] || return 1
-  banger_packages_normalized_lines "$packages_file" | banger_packages_hash_stream
-}
-
-banger_rootfs_manifest_metadata_path() {
-  local rootfs_path="$1"
-  printf '%s.packages.sha256' "$rootfs_path"
-}
-
-banger_rootfs_manifest_recorded_hash() {
-  local rootfs_path="$1"
-  local metadata_file recorded_hash
-
-  metadata_file="$(banger_rootfs_manifest_metadata_path "$rootfs_path")"
-  [[ -f "$metadata_file" ]] || return 1
-
-  recorded_hash="$(head -n 1 "$metadata_file" | tr -d '[:space:]')"
-  [[ -n "$recorded_hash" ]] || return 1
-  printf '%s' "$recorded_hash"
-}
-
-banger_write_rootfs_manifest_metadata() {
-  local rootfs_path="$1"
-  local manifest_hash="$2"
-  local metadata_file
-
-  metadata_file="$(banger_rootfs_manifest_metadata_path "$rootfs_path")"
-  printf '%s\n' "$manifest_hash" > "$metadata_file"
-}
-
-banger_rootfs_manifest_status() {
-  local rootfs_path="$1"
-  local current_hash recorded_hash
-
-  if [[ ! -f "$rootfs_path" ]]; then
-    printf '%s' "missing-rootfs"
-    return 0
-  fi
-
-  if ! current_hash="$(banger_packages_manifest_hash)"; then
-    printf '%s' "unknown"
-    return 0
-  fi
-
-  if ! recorded_hash="$(banger_rootfs_manifest_recorded_hash "$rootfs_path")"; then
-    printf '%s' "missing-metadata"
-    return 0
-  fi
-
-  if [[ "$recorded_hash" == "$current_hash" ]]; then
-    printf '%s' "fresh"
-  else
-    printf '%s' "stale"
-  fi
-}
-
-banger_rootfs_manifest_warning() {
-  local rootfs_path="$1"
-  local status
-
-  status="$(banger_rootfs_manifest_status "$rootfs_path")"
-  case "$status" in
-    stale)
-      printf '%s was built with an older package manifest; rebuild it explicitly to pick up package changes' "$rootfs_path"
-      ;;
-    missing-metadata)
-      printf '%s has no package manifest metadata; rebuild it explicitly to pick up package changes' "$rootfs_path"
-      ;;
-    unknown)
-      printf 'unable to compare %s against %s; install sha256sum and verify the package manifest manually' "$rootfs_path" "$BANGER_APT_PACKAGES_FILE"
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-}
diff --git a/scripts/make-rootfs-void.sh b/scripts/make-rootfs-void.sh
index 918be10..681b967 100755
--- a/scripts/make-rootfs-void.sh
+++ b/scripts/make-rootfs-void.sh
@@ -7,21 +7,19 @@ log() {
 
 usage() {
   cat <<'EOF'
-Usage: ./scripts/make-rootfs-void.sh [--out <path>] [--size <size>] [--mirror <url>] [--arch <arch>] [--packages <path>]
+Usage: ./scripts/make-rootfs-void.sh [--out <path>] [--size <size>] [--mirror <url>] [--arch <arch>]
 
 Build an experimental Void Linux rootfs image plus a matching /root work-seed.
 
 Defaults:
-  --out      ./build/runtime/rootfs-void.ext4
+  --out      ./build/manual/rootfs-void.ext4
   --size     2G
   --mirror   https://repo-default.voidlinux.org
   --arch     x86_64
-  --packages ./config/packages.void
 
-This path is experimental and local-only. If ./build/runtime/void-kernel exists
-it uses the staged Void kernel modules from that directory; otherwise it falls
-back to the current runtime bundle modules. It does not change the default
-Debian image flow.
+This path is experimental and local-only. If ./build/manual/void-kernel exists
+it uses the staged Void kernel modules from that directory. It does not change
+the default Debian image flow.
 EOF
 }
 
@@ -76,21 +74,6 @@ normalize_mirror() {
   printf '%s\n' "$mirror"
 }
 
-bundle_path() {
-  local key="$1"
-  local fallback="$2"
-  local rel=""
-
-  if [[ -f "$BUNDLE_METADATA" ]] && command -v jq >/dev/null 2>&1; then
-    rel="$(jq -r --arg key "$key" '.[$key] // empty' "$BUNDLE_METADATA" 2>/dev/null || true)"
-  fi
-  if [[ -n "$rel" && "$rel" != "null" ]]; then
-    printf '%s\n' "$RUNTIME_DIR/$rel"
-    return
-  fi
-  printf '%s\n' "$fallback"
-}
-
 find_latest_module_dir() {
   local root="$1"
   if [[ ! -d "$root" ]]; then
@@ -108,6 +91,19 @@ find_static_keys_dir() {
   find "$STATIC_DIR" -type d -path '*/var/db/xbps/keys' | sort | head -n 1
 }
 
+load_package_preset() {
+  local preset="$1"
+  local -n out="$2"
+  mapfile -t out < <("$BANGER_BIN" internal packages "$preset")
+  (( ${#out[@]} > 0 ))
+}
+
+write_rootfs_manifest_metadata() {
+  local rootfs_path="$1"
+  local manifest_hash="$2"
+  printf '%s\n' "$manifest_hash" > "${rootfs_path}.packages.sha256"
+}
+
 install_root_authorized_key() {
   local public_key
   public_key="$(ssh-keygen -y -f "$SSH_KEY")"
@@ -382,24 +378,10 @@ cleanup() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-PACKAGES_FILE="$REPO_ROOT/config/packages.void"
-export BANGER_APT_PACKAGES_FILE="$PACKAGES_FILE"
-source "$SCRIPT_DIR/lib/packages.sh"
-
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-if [[ ! -d "$RUNTIME_DIR" ]]; then
-  log "runtime bundle not found: $RUNTIME_DIR"
-  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
-  exit 1
-fi
-
-BUNDLE_METADATA="$RUNTIME_DIR/bundle.json"
-SSH_KEY="$(bundle_path ssh_key_path "$RUNTIME_DIR/id_ed25519")"
-OUT_ROOTFS="$RUNTIME_DIR/rootfs-void.ext4"
+MANUAL_DIR="${BANGER_MANUAL_DIR:-$REPO_ROOT/build/manual}"
+BANGER_BIN="$(resolve_banger_bin)"
+SSH_KEY="$("$BANGER_BIN" internal ssh-key-path)"
+OUT_ROOTFS="$MANUAL_DIR/rootfs-void.ext4"
 SIZE_SPEC="2G"
 MIRROR="https://repo-default.voidlinux.org"
 ARCH="x86_64"
@@ -408,12 +390,9 @@ MISE_INSTALL_PATH="/usr/local/bin/mise"
 OPENCODE_TOOL="github:anomalyco/opencode"
 GUESTNET_BOOTSTRAP_SCRIPT="$REPO_ROOT/internal/guestnet/assets/bootstrap.sh"
 GUESTNET_VOID_CORE_SERVICE="$REPO_ROOT/internal/guestnet/assets/void-core-service.sh"
-MODULES_DIR="$(bundle_path default_modules_dir "$RUNTIME_DIR/wtf/root/lib/modules/6.8.0-94-generic")"
-VOID_KERNEL_MODULES_DIR="$(find_latest_module_dir "$RUNTIME_DIR/void-kernel/lib/modules" || true)"
-VSOCK_AGENT="$(bundle_path vsock_agent_path "$RUNTIME_DIR/banger-vsock-agent")"
-if [[ "$VSOCK_AGENT" == "$RUNTIME_DIR/banger-vsock-agent" && ! -x "$VSOCK_AGENT" ]]; then
-  VSOCK_AGENT="$(bundle_path vsock_ping_helper_path "$RUNTIME_DIR/banger-vsock-pingd")"
-fi
+MODULES_DIR=""
+VOID_KERNEL_MODULES_DIR="$(find_latest_module_dir "$MANUAL_DIR/void-kernel/lib/modules" || true)"
+VSOCK_AGENT="$("$BANGER_BIN" internal vsock-agent-path)"
 if [[ -n "$VOID_KERNEL_MODULES_DIR" ]]; then
   MODULES_DIR="$VOID_KERNEL_MODULES_DIR"
 fi
@@ -436,11 +415,6 @@ while [[ $# -gt 0 ]]; do
       ARCH="${2:-}"
       shift 2
       ;;
-    --packages)
-      PACKAGES_FILE="${2:-}"
-      export BANGER_APT_PACKAGES_FILE="$PACKAGES_FILE"
-      shift 2
-      ;;
     -h|--help)
       usage
       exit 0
@@ -463,17 +437,13 @@ if [[ "$ARCH" != "x86_64" ]]; then
   exit 1
 fi
 
-if [[ ! -f "$PACKAGES_FILE" ]]; then
-  log "package manifest not found: $PACKAGES_FILE"
-  exit 1
-fi
-if [[ ! -d "$MODULES_DIR" ]]; then
-  log "modules dir not found: $MODULES_DIR"
+if [[ -z "$MODULES_DIR" || ! -d "$MODULES_DIR" ]]; then
+  log "modules dir not found; run 'make void-kernel' first"
   exit 1
 fi
 if [[ ! -x "$VSOCK_AGENT" ]]; then
   log "vsock agent not found or not executable: $VSOCK_AGENT"
-  log "run 'make build' or refresh the runtime bundle"
+  log "run 'make build'"
   exit 1
 fi
 if [[ ! -f "$GUESTNET_BOOTSTRAP_SCRIPT" ]]; then
@@ -505,12 +475,12 @@ require_command truncate
 require_command mountpoint
 
 VOID_PACKAGES=()
-if ! banger_packages_read_array VOID_PACKAGES "$PACKAGES_FILE"; then
-  log "package manifest is empty: $PACKAGES_FILE"
+if ! load_package_preset void VOID_PACKAGES; then
+  log "void package preset is empty"
   exit 1
 fi
-if ! PACKAGES_HASH="$(banger_packages_manifest_hash "$PACKAGES_FILE")"; then
-  log "failed to hash package manifest: $PACKAGES_FILE"
+if ! PACKAGES_HASH="$(printf '%s\n' "${VOID_PACKAGES[@]}" | sha256sum | awk '{print $1}')"; then
+  log "failed to hash package preset"
   exit 1
 fi
 if ! SIZE_BYTES="$(parse_size "$SIZE_SPEC")"; then
@@ -518,7 +488,6 @@ if ! SIZE_BYTES="$(parse_size "$SIZE_SPEC")"; then
   exit 1
 fi
 
-BANGER_BIN="$(resolve_banger_bin)"
 if [[ "$OUT_ROOTFS" == *.ext4 ]]; then
   WORK_SEED="${OUT_ROOTFS%.ext4}.work-seed.ext4"
 else
@@ -613,7 +582,7 @@ sudo rm -rf \
 
 sudo umount "$ROOT_MOUNT"
 
-banger_write_rootfs_manifest_metadata "$OUT_ROOTFS" "$PACKAGES_HASH"
+write_rootfs_manifest_metadata "$OUT_ROOTFS" "$PACKAGES_HASH"
 
 log "building work-seed $WORK_SEED"
 "$BANGER_BIN" internal work-seed --rootfs "$OUT_ROOTFS" --out "$WORK_SEED"
diff --git a/scripts/make-rootfs.sh b/scripts/make-rootfs.sh
index 4fd20b6..2c4c405 100755
--- a/scripts/make-rootfs.sh
+++ b/scripts/make-rootfs.sh
@@ -7,12 +7,11 @@ log() {
 
 usage() {
   cat <<'EOF'
-Usage: ./scripts/make-rootfs.sh [--size <size>] [--base-rootfs <path>]
+Usage: ./scripts/make-rootfs.sh --kernel <path> [--initrd <path>] [--modules <dir>] [--size <size>] [--base-rootfs <path>]
 
-Builds build/runtime/rootfs-docker.ext4 using scripts/customize.sh. If
+Builds build/manual/rootfs-docker.ext4 using scripts/customize.sh. If
 --base-rootfs is omitted, the first existing file is used:
-  ./build/runtime/rootfs.ext4
-  ./runtime/rootfs.ext4  (legacy fallback)
+  ./build/manual/rootfs-base.ext4
   ./ubuntu-noble-rootfs/rootfs.ext4
   ./ubuntu-lts/rootfs.ext4
 EOF
@@ -20,20 +19,13 @@ EOF
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-source "$SCRIPT_DIR/lib/packages.sh"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-if [[ ! -d "$RUNTIME_DIR" ]]; then
-  log "runtime bundle not found: $RUNTIME_DIR"
-  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
-  exit 1
-fi
-OUT_ROOTFS="$RUNTIME_DIR/rootfs-docker.ext4"
+MANUAL_DIR="${BANGER_MANUAL_DIR:-$REPO_ROOT/build/manual}"
+OUT_ROOTFS="$MANUAL_DIR/rootfs-docker.ext4"
 SIZE_SPEC="6G"
 BASE_ROOTFS=""
+KERNEL_PATH=""
+INITRD_PATH=""
+MODULES_DIR=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -45,6 +37,18 @@ while [[ $# -gt 0 ]]; do
       BASE_ROOTFS="${2:-}"
       shift 2
       ;;
+    --kernel)
+      KERNEL_PATH="${2:-}"
+      shift 2
+      ;;
+    --initrd)
+      INITRD_PATH="${2:-}"
+      shift 2
+      ;;
+    --modules)
+      MODULES_DIR="${2:-}"
+      shift 2
+      ;;
     -h|--help)
       usage
       exit 0
@@ -57,32 +61,39 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-if [[ -f "$OUT_ROOTFS" ]]; then
-  OUT_ROOTFS_WARNING="$(banger_rootfs_manifest_warning "$OUT_ROOTFS" || true)"
-  if [[ -n "$OUT_ROOTFS_WARNING" ]]; then
-    log "warning: $OUT_ROOTFS_WARNING"
-  fi
-  log "already exists: $OUT_ROOTFS"
-  exit 0
-fi
-
 if [[ -z "$BASE_ROOTFS" ]]; then
-  if [[ -f "$RUNTIME_DIR/rootfs.ext4" ]]; then
-    BASE_ROOTFS="$RUNTIME_DIR/rootfs.ext4"
+  if [[ -f "$MANUAL_DIR/rootfs-base.ext4" ]]; then
+    BASE_ROOTFS="$MANUAL_DIR/rootfs-base.ext4"
   elif [[ -f "$REPO_ROOT/ubuntu-noble-rootfs/rootfs.ext4" ]]; then
     BASE_ROOTFS="$REPO_ROOT/ubuntu-noble-rootfs/rootfs.ext4"
   elif [[ -f "$REPO_ROOT/ubuntu-lts/rootfs.ext4" ]]; then
     BASE_ROOTFS="$REPO_ROOT/ubuntu-lts/rootfs.ext4"
   else
-    log "no base rootfs found; run 'make runtime-bundle' or pass --base-rootfs"
+    log "no base rootfs found; pass --base-rootfs"
     exit 1
   fi
 fi
 
-mkdir -p "$RUNTIME_DIR"
+if [[ -z "$KERNEL_PATH" ]]; then
+  log "kernel path is required; pass --kernel"
+  exit 1
+fi
+
+mkdir -p "$MANUAL_DIR"
 
 log "building $OUT_ROOTFS from $BASE_ROOTFS"
-exec env BANGER_RUNTIME_DIR="$RUNTIME_DIR" "$SCRIPT_DIR/customize.sh" "$BASE_ROOTFS" \
-  --out "$OUT_ROOTFS" \
-  --size "$SIZE_SPEC" \
+args=(
+  "$SCRIPT_DIR/customize.sh"
+  "$BASE_ROOTFS"
+  --out "$OUT_ROOTFS"
+  --size "$SIZE_SPEC"
+  --kernel "$KERNEL_PATH"
   --docker
+)
+if [[ -n "$INITRD_PATH" ]]; then
+  args+=(--initrd "$INITRD_PATH")
+fi
+if [[ -n "$MODULES_DIR" ]]; then
+  args+=(--modules "$MODULES_DIR")
+fi
+exec "${args[@]}"
diff --git a/scripts/make-void-kernel.sh b/scripts/make-void-kernel.sh
index 13f92f8..372b456 100755
--- a/scripts/make-void-kernel.sh
+++ b/scripts/make-void-kernel.sh
@@ -9,12 +9,12 @@ usage() {
   cat <<'EOF'
 Usage: ./scripts/make-void-kernel.sh [--out-dir <path>] [--mirror <url>] [--arch <arch>] [--kernel-package <name>] [--print-register-flags]
 
-Download and stage a Void Linux kernel under ./build/runtime/void-kernel for
+Download and stage a Void Linux kernel under ./build/manual/void-kernel for
 the
 experimental Void guest flow.
 
 Defaults:
-  --out-dir         ./build/runtime/void-kernel
+  --out-dir         ./build/manual/void-kernel
   --mirror          https://repo-default.voidlinux.org
   --arch            x86_64
   --kernel-package  linux6.12
@@ -225,12 +225,8 @@ cleanup() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-OUT_DIR="$RUNTIME_DIR/void-kernel"
+MANUAL_DIR="${BANGER_MANUAL_DIR:-$REPO_ROOT/build/manual}"
+OUT_DIR="$MANUAL_DIR/void-kernel"
 MIRROR="https://repo-default.voidlinux.org"
 ARCH="x86_64"
 KERNEL_PACKAGE="linux6.12"
diff --git a/scripts/register-void-image.sh b/scripts/register-void-image.sh
index bc4ccfc..3ffb8a2 100755
--- a/scripts/register-void-image.sh
+++ b/scripts/register-void-image.sh
@@ -45,17 +45,11 @@ resolve_banger_bin() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
+RUNTIME_DIR="${BANGER_MANUAL_DIR:-$REPO_ROOT/build/manual}"
 IMAGE_NAME="${VOID_IMAGE_NAME:-void-exp}"
 BANGER_BIN="$(resolve_banger_bin)"
 ROOTFS="$RUNTIME_DIR/rootfs-void.ext4"
 WORK_SEED="$RUNTIME_DIR/rootfs-void.work-seed.ext4"
-PACKAGES="$REPO_ROOT/config/packages.void"
 
 if [[ ! -f "$ROOTFS" ]]; then
   log "missing Void rootfs: $ROOTFS"
@@ -71,7 +65,6 @@ args=(
   --name "$IMAGE_NAME"
   --rootfs "$ROOTFS"
   --work-seed "$WORK_SEED"
-  --packages "$PACKAGES"
 )
 
 if [[ ! -d "$RUNTIME_DIR/void-kernel" ]]; then
diff --git a/scripts/verify.sh b/scripts/verify.sh
index 3b963f7..8546ef6 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -7,33 +7,7 @@ log() {
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-DEFAULT_RUNTIME_DIR="$REPO_ROOT/build/runtime"
-if [[ ! -d "$DEFAULT_RUNTIME_DIR" && -d "$REPO_ROOT/runtime" ]]; then
-  DEFAULT_RUNTIME_DIR="$REPO_ROOT/runtime"
-fi
-RUNTIME_DIR="${BANGER_RUNTIME_DIR:-$DEFAULT_RUNTIME_DIR}"
-SSH_KEY="$RUNTIME_DIR/id_ed25519"
-if [[ ! -d "$RUNTIME_DIR" ]]; then
-  log "runtime bundle not found: $RUNTIME_DIR"
-  log "run 'make runtime-bundle' or set BANGER_RUNTIME_DIR"
-  exit 1
-fi
-if [[ ! -f "$SSH_KEY" ]]; then
-  log "ssh key not found: $SSH_KEY"
-  exit 1
-fi
 DAEMON_LOG="${XDG_STATE_HOME:-$HOME/.local/state}/banger/bangerd.log"
-SSH_COMMON_ARGS=(
-  -F /dev/null
-  -i "$SSH_KEY"
-  -o IdentitiesOnly=yes
-  -o BatchMode=yes
-  -o PreferredAuthentications=publickey
-  -o PasswordAuthentication=no
-  -o KbdInteractiveAuthentication=no
-  -o StrictHostKeyChecking=no
-  -o UserKnownHostsFile=/dev/null
-)
 OPENCODE_PORT=4096
 
 resolve_banger_bin() {
@@ -58,6 +32,22 @@ resolve_banger_bin() {
 }
 
 BANGER_BIN="$(resolve_banger_bin)"
+SSH_KEY="$("$BANGER_BIN" internal ssh-key-path)"
+if [[ ! -f "$SSH_KEY" ]]; then
+  log "ssh key not found: $SSH_KEY"
+  exit 1
+fi
+SSH_COMMON_ARGS=(
+  -F /dev/null
+  -i "$SSH_KEY"
+  -o IdentitiesOnly=yes
+  -o BatchMode=yes
+  -o PreferredAuthentications=publickey
+  -o PasswordAuthentication=no
+  -o KbdInteractiveAuthentication=no
+  -o StrictHostKeyChecking=no
+  -o UserKnownHostsFile=/dev/null
+)
 
 firecracker_running() {
   local pid="$1"