Publish PVE-validated cloud-image (qcow2) VM artifacts to the generic registry #6

New issue

Open

opened 2026-06-17 22:07:36 +00:00 by hclaude · 1 comment

hclaude commented 2026-06-17 22:07:36 +00:00

Owner

Copy link

Goal

Promote the cloud-image (qcow2 VM) pipeline from stage-1 PoC to a published,
PVE-validated artifact in the Forgejo generic registry alongside the LXC
templates. Today only *.tar.zst LXC rootfs templates are published; the VM
images are built + boot-proven but not shippable.

Source of record: reports/cloudimg-stage1-report.md, docs/qemu-vm-plan.md.

Current state (stage 1, v0.1.0)

• Devuan 6 Excalibur + Debian 13 Trixie qcow2 built + boot to serial login
  (GRUB → kernel → init → login:), via libguestfs appliance (no loop/kvm).
• Builder build-cloud-image.sh lives in /scratch/Templates/cloudimg/ and is
  NOT committed.

Blockers to publish

1. cloud-init broken on Devuan/OpenRC (VM-R6). Shipped init.d shims declare
   need cloud-init but the service is cloud-init-main → cloud-config /
   cloud-final won't run. Fix in the build hook: rename the dependency to
   cloud-init-main or provide a cloud-init alias service; then validate
   all four stages apply hostname/SSH-keys/network from a NoCloud drive.
2. No PVE-host end-to-end validation. Build host is a nested LXC (no qm, no
   /dev/kvm, no loop devices). Import via the emitted .install.sh on a real
   PVE 9.1 host; verify cloud-init identity/network, qm agent ping,
   qm terminal serial login, chrony disciplined from /dev/ptp0
   (modprobe ptp_kvm on the host — VM-R2).
3. Builder not committed. Promote build-cloud-image.sh into src/
   (it currently only exists under /scratch).
4. Publisher doesn't handle qcow2. src/publish-to-forgejo.sh globs only
   *.tar.zst + *.manifest.txt. Add *.qcow2 (+ *.install.sh) collection,
   likely under a separate package name (e.g. vm-images) so versions/latest
   stay distinct from lxc-templates. Dateless registry naming already in place.

Deferred (track, not blocking first publish)

• OpenZFS 2.4 DKMS via backports (image is DKMS-ready: headers installed).
• UEFI/OVMF + Secure Boot (BIOS/SeaBIOS only today).
• swapfile + growpart-on-first-boot.
• Build on a host with loop + /dev/kvm to cut TCG build time (~8→~2 min/image).

Done =

A versioned + latest qcow2 (Devuan + Debian) in the registry, cloud-init
applying identity/network on a real PVE 9.1 VM, with the committed builder +
qcow2-aware publisher reproducing it.

## Goal Promote the cloud-image (qcow2 VM) pipeline from stage-1 PoC to a published, PVE-validated artifact in the Forgejo generic registry alongside the LXC templates. Today only `*.tar.zst` LXC rootfs templates are published; the VM images are built + boot-proven but **not shippable**. Source of record: `reports/cloudimg-stage1-report.md`, `docs/qemu-vm-plan.md`. ## Current state (stage 1, v0.1.0) - Devuan 6 Excalibur + Debian 13 Trixie qcow2 **built + boot to serial login** (GRUB → kernel → init → `login:`), via libguestfs appliance (no loop/kvm). - Builder `build-cloud-image.sh` lives in `/scratch/Templates/cloudimg/` and is **NOT committed**. ## Blockers to publish 1. **cloud-init broken on Devuan/OpenRC (VM-R6).** Shipped init.d shims declare `need cloud-init` but the service is `cloud-init-main` → `cloud-config` / `cloud-final` won't run. Fix in the build hook: rename the dependency to `cloud-init-main` **or** provide a `cloud-init` alias service; then validate all four stages apply hostname/SSH-keys/network from a NoCloud drive. 2. **No PVE-host end-to-end validation.** Build host is a nested LXC (no `qm`, no `/dev/kvm`, no loop devices). Import via the emitted `.install.sh` on a real PVE 9.1 host; verify cloud-init identity/network, `qm agent ping`, `qm terminal` serial login, chrony disciplined from `/dev/ptp0` (`modprobe ptp_kvm` on the host — VM-R2). 3. **Builder not committed.** Promote `build-cloud-image.sh` into `src/` (it currently only exists under `/scratch`). 4. **Publisher doesn't handle qcow2.** `src/publish-to-forgejo.sh` globs only `*.tar.zst` + `*.manifest.txt`. Add `*.qcow2` (+ `*.install.sh`) collection, likely under a separate package name (e.g. `vm-images`) so versions/`latest` stay distinct from `lxc-templates`. Dateless registry naming already in place. ## Deferred (track, not blocking first publish) - OpenZFS 2.4 DKMS via backports (image is DKMS-ready: headers installed). - UEFI/OVMF + Secure Boot (BIOS/SeaBIOS only today). - swapfile + growpart-on-first-boot. - Build on a host with loop + `/dev/kvm` to cut TCG build time (~8→~2 min/image). ## Done = A versioned + `latest` qcow2 (Devuan + Debian) in the registry, cloud-init applying identity/network on a real PVE 9.1 VM, with the committed builder + qcow2-aware publisher reproducing it.

hclaude referenced this issue 2026-06-17 22:26:16 +00:00

VM images Phase A: commit + harden the cloud-image builder (Devuan ECS01 + Debian-13) #7

hclaude referenced this issue 2026-06-17 22:26:16 +00:00

VM images Phase B: qcow2 support in publish-to-forgejo.sh (vm-images package) + import-only install.sh #8

hclaude referenced this issue 2026-06-17 22:26:16 +00:00

VM images Phase C: PVE validation of a single VM (no template until proven good) #9

hclaude commented 2026-06-17 22:26:46 +00:00

Author

Owner

Copy link

Implementation plan — "mostly working" VM images

Decisions locked (user, 2026-06-17):

• Scope: Devuan ECS01 + Debian-13 ECS01 (clean-lean Devuan deferred).
• Time sync: ship chrony/ptp_kvm config, boot does NOT gate on PHC; host modprobe ptp_kvm is a documented prereq.
• install.sh: import-only — leaves a stopped, NON-template VM.
• No PVE templating until a known-good image exists — validation runs against a single booted VM; template/clone only afterwards.
• VM-D5: serial console primacy = console=ttyS0 last (serial = live qm terminal console).

Definition of done ("mostly working")

Per image, on a real PVE 9.1 host: import-only install.sh → stopped VM → GUI sets Cloud-Init (user/keys/IP) on that VM → start → serial login + cloud-init applied hostname+keys+network + qm agent ping answers. One proven VM per image; templating is a later, separate step.

Phases (sub-issues)

• Phase A — builder → #7 (commit build-cloud-image.sh; wire cloud-init OpenRC shims 0004, /etc/hostname=localhost, serial console, guest-agent, chrony-no-gate, NoCloud+eni; rebuild both qcow2; local TCG smoke. Debian first.)
• Phase B — publisher → #8 (qcow2 + *.install.sh glob; new vm-images package, version 0.1.0, dateless; emit import-only install.sh.)
• Phase C — PVE validation → #9 (operator-driven; import-only → single VM → GUI Cloud-Init → start → validate; iterate; template only when good.)

Deferred (not gating)

OpenZFS 2.4 DKMS (image is headers-ready) · UEFI/OVMF + MOK signing · swapfile + growpart · clean-lean Devuan VM.

Reference: docs/qemu-vm-plan.md, reports/cloudimg-stage1-report.md.

# Implementation plan — "mostly working" VM images Decisions locked (user, 2026-06-17): - **Scope:** Devuan ECS01 + Debian-13 ECS01 (clean-lean Devuan deferred). - **Time sync:** ship chrony/ptp_kvm config, **boot does NOT gate** on PHC; host `modprobe ptp_kvm` is a documented prereq. - **install.sh:** **import-only** — leaves a stopped, NON-template VM. - **No PVE templating until a known-good image exists** — validation runs against a single booted VM; template/clone only afterwards. - **VM-D5:** serial console primacy = `console=ttyS0` **last** (serial = live `qm terminal` console). ## Definition of done ("mostly working") Per image, on a real PVE 9.1 host: import-only `install.sh` → stopped VM → GUI sets Cloud-Init (user/keys/IP) on that VM → start → **serial login** + cloud-init applied **hostname+keys+network** + `qm agent ping` answers. One proven VM per image; templating is a later, separate step. ## Phases (sub-issues) - **Phase A — builder** → #7 (commit `build-cloud-image.sh`; wire cloud-init OpenRC shims `0004`, `/etc/hostname=localhost`, serial console, guest-agent, chrony-no-gate, NoCloud+eni; rebuild both qcow2; local TCG smoke. Debian first.) - **Phase B — publisher** → #8 (qcow2 + `*.install.sh` glob; new `vm-images` package, version `0.1.0`, dateless; emit import-only install.sh.) - **Phase C — PVE validation** → #9 (operator-driven; import-only → single VM → GUI Cloud-Init → start → validate; iterate; template only when good.) ## Deferred (not gating) OpenZFS 2.4 DKMS (image is headers-ready) · UEFI/OVMF + MOK signing · swapfile + growpart · clean-lean Devuan VM. Reference: `docs/qemu-vm-plan.md`, `reports/cloudimg-stage1-report.md`.

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

master

fix/less-ifupdown-162

fix/ubuntu-backports-zfs-161

feat/ubuntu-2404

feat/vm-track-and-cloudinit-plans

fix/vm-keyring-020

VM_0.2.2

v1.6.2

VM_0.2.1

v1.6.1

VM_0.2.0

v1.6.0

v1.5.8

v1.5.7

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

ECS-Public-Infra/Create-Templates#6

No description provided.