thaloco/banger
1
Fork 0
Code Pull requests Releases Packages Activity Actions

Phase B-3: first-boot sshd install

Browse source 
New internal/imagepull/assets/first-boot.sh: POSIX-sh oneshot that
detects the guest distro from /etc/os-release (ID + ID_LIKE
fallback), installs openssh-server via the native package manager,
and enables/starts sshd. Covers debian/ubuntu/kali/raspbian/pop,
alpine, fedora/rhel/centos/rocky/almalinux, arch/manjaro, and
opensuse/suse. Unknown distros fail clearly with a pointer at
editing the script to add a branch.

Marker-driven: the service has ConditionPathExists=
/var/lib/banger/first-boot-pending, and the script removes the
marker on success. Subsequent boots no-op.

Testability seams in the script: RUN_PLAN=1 skips the
sshd-already-present short-circuit and makes the dispatch echo the
planned command instead of executing it. OS_RELEASE_FILE and
BANGER_FIRST_BOOT_MARKER env vars override paths so the Go tests
exercise the real dispatch logic in a tempdir without touching
/etc or /var/lib on the host.

Embedding: internal/imagepull/firstboot.go go:embeds both the
script and the systemd unit; exposes FirstBootScript() and
FirstBootUnit() plus the FirstBootScriptPath /
FirstBootMarkerPath / FirstBootUnitName constants.

Injection: InjectGuestAgents now drops /usr/local/libexec/
banger-first-boot (0755), /etc/systemd/system/banger-first-boot.
service (0644), the empty /var/lib/banger/first-boot-pending
marker (0644), and the multi-user.target.wants enable symlink.
All uid=0, gid=0.

Tests: eight-case dispatch-by-distro (debian, ubuntu, alpine,
fedora, arch, opensuse, plus ID_LIKE fallbacks for weird
derivatives). Script syntax check via `sh -n`. Unit-contains-
expected-fields check. Existing inject round-trip test extended
to assert the first-boot bits land in the ext4.

Deferred: per-image FirstBootPending flag + extended SSH wait
timeout at VM start. Will add if live verification (B-4) shows
the naive retry UX is unacceptable.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Thales Maciel 2026-04-16 18:20:33 -03:00
parent 491c8e1ebb
commit c3fb4ccc3e
No known key found for this signature in database
GPG key ID: 33112E6833C34679
6 changed files with 304 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
internal/imagepull/assets/first-boot.service Normal file
View file

@ -0,0 +1,17 @@
[Unit]
Description=Banger first-boot provisioning
After=network-online.target banger-network.service
Wants=network-online.target
Before=sshd.service ssh.service
ConditionPathExists=/var/lib/banger/first-boot-pending
[Service]
Type=oneshot
ExecStart=/usr/local/libexec/banger-first-boot
RemainAfterExit=yes
StandardOutput=journal
StandardError=journal
TimeoutStartSec=300s
[Install]
WantedBy=multi-user.target

101
internal/imagepull/assets/first-boot.sh Normal file
View file

@ -0,0 +1,101 @@
#!/bin/sh
# banger-first-boot — runs once at the first boot of a pulled OCI image.
# Installs openssh-server via the guest's native package manager, enables
# and starts the ssh daemon, and removes its own trigger file so the
# service is a no-op on subsequent boots.
#
# Distro dispatch is driven by /etc/os-release's ID / ID_LIKE values.
# RUN_PLAN=1 in the environment makes this script echo the commands it
# would run instead of executing them — used by tests.
set -eu
log() { printf '[banger-first-boot] %s\n' "$*" >&2; }
MARKER="${BANGER_FIRST_BOOT_MARKER:-/var/lib/banger/first-boot-pending}"
if [ ! -f "$MARKER" ]; then
log "marker absent; nothing to do"
exit 0
fi
# If sshd is already present, just enable + start and finish.
# The RUN_PLAN env skips this short-circuit so tests can exercise the
# dispatch logic on hosts that happen to have sshd installed.
if [ "${RUN_PLAN:-0}" != "1" ] && command -v sshd >/dev/null 2>&1; then
log "sshd already installed; enabling and starting"
systemctl enable --now ssh.service 2>/dev/null || \
systemctl enable --now sshd.service 2>/dev/null || true
rm -f "$MARKER"
exit 0
fi
DIST=""
FAMILY=""
OS_RELEASE_FILE="${OS_RELEASE_FILE:-/etc/os-release}"
if [ -r "$OS_RELEASE_FILE" ]; then
# shellcheck source=/dev/null
. "$OS_RELEASE_FILE"
DIST="${ID:-}"
FAMILY="${ID_LIKE:-}"
fi
log "detected distro: ID=$DIST ID_LIKE=$FAMILY"
# Dispatch. Each branch sets CMD to the single install command.
CMD=""
case "$DIST" in
debian|ubuntu|kali|raspbian|linuxmint|pop)
CMD="env DEBIAN_FRONTEND=noninteractive apt-get update && env DEBIAN_FRONTEND=noninteractive apt-get install -y openssh-server"
;;
alpine)
CMD="apk add --no-cache openssh"
;;
fedora|rhel|centos|rocky|almalinux)
CMD="dnf install -y openssh-server"
;;
arch|archlinux|manjaro)
CMD="pacman -Sy --noconfirm openssh"
;;
opensuse*|suse)
CMD="zypper --non-interactive install -y openssh"
;;
*)
# Fall back to ID_LIKE.
case " $FAMILY " in
*" debian "*)
CMD="env DEBIAN_FRONTEND=noninteractive apt-get update && env DEBIAN_FRONTEND=noninteractive apt-get install -y openssh-server"
;;
*" rhel "* | *" fedora "*)
CMD="dnf install -y openssh-server"
;;
*" arch "*)
CMD="pacman -Sy --noconfirm openssh"
;;
*" suse "*)
CMD="zypper --non-interactive install -y openssh"
;;
esac
;;
esac
if [ -z "$CMD" ]; then
log "no known install command for distro '$DIST' (ID_LIKE='$FAMILY')"
log "edit /usr/local/libexec/banger-first-boot to add a branch, then restart banger-first-boot.service"
exit 1
fi
if [ "${RUN_PLAN:-0}" = "1" ]; then
printf '%s\n' "$CMD"
exit 0
fi
log "installing openssh-server: $CMD"
sh -c "$CMD"
log "enabling sshd"
systemctl enable --now ssh.service 2>/dev/null || \
systemctl enable --now sshd.service 2>/dev/null || \
{ log "could not enable sshd service"; exit 1; }
rm -f "$MARKER"
log "first-boot provisioning complete"