Repository navigation
refactor(os): apply rootfs tmpfiles at build time only - #1331
Merged
Merged
Conversation
kvinwang
force-pushed
the
docs/os-tmpfiles-readonly-root
branch
from
September 24, 2026 03:32
3c90c94 to
f16fb73
Compare
kvinwang
changed the title
dstack-image.conf lived in /usr/lib/tmpfiles.d, so besides shaping the build root it was re-run on every boot against the read-only verity root, where it can only succeed as a no-op or fail. Move it out of the skeleton and apply it from mkosi.finalize, after mkosi's own tmpfiles pass, so the image no longer carries a boot-time step that needs explaining. Running last, it also overrides the package defaults for the /var directories itself (e.g. tpm2-tss's 2775 keystore), which makes the .dstack-keep skeleton markers and their RemoveFiles= cleanup redundant. dstack-firstboot.service did the same with mkdir -p on directories the build already creates; drop it and its preset entry.
kvinwang
force-pushed
the
docs/os-tmpfiles-readonly-root
branch
from
September 24, 2026 04:33
f16fb73 to
fc65011
Compare
This was referenced Sep 25, 2026
kvinwang
added a commit
that referenced
this pull request
Sep 26, 2026
#1415 reverts #1331, so the image again ships dstack-image.conf in tmpfiles.d and the first-boot unit. tc-gos-platform-005 keeps the outcome that matters, a root-owned 0755 TPM keystore at runtime, and the source catalogs follow the file back to its old path. Signed-off-by: Kevin Wang <wy721@qq.com>
source-c
pushed a commit
to silicon-foundation/dstack
that referenced
this pull request
Oct 4, 2026
This reverts Dstack-TEE#1331 (merge 81cb016). Applying rootfs.tmpfiles only at build time broke two things: - mkosi.finalize runs as the invoking user in a rootless build, so systemd-tmpfiles cannot chown the root-owned entries and every rootless `make os-image` fails with exit code 73. - /var/lib is a writable overlay at runtime, so the boot-time pass was not a no-op: it kept /var/lib/tpm2-tss/system/keystore at 0755 root:root. Without it, tpm2-tss-fapi.conf resets the keystore to 2775 tss:tss on every boot. The boot-time entries that land on the read-only root were harmless no-ops, so restoring them costs nothing. Signed-off-by: Kevin Wang <wy721@qq.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dstack-image.confsat in/usr/lib/tmpfiles.d, so it was re-run on every boot against the read-only verity root, where it can only be a no-op or fail. Move it out of the image (os/mkosi/rootfs.tmpfiles) and apply it frommkosi.finalize, after mkosi's own tmpfiles pass so it still overrides package defaults (e.g. tpm2-tss's2775keystore).That makes the
.dstack-keepskeleton markers, theirRemoveFiles=cleanup and the matching exclusion innormalize-skeleton-modes.shredundant, so they go too.dstack-firstboot.service, whichmkdir -p'd the same directories on the read-only root at every boot, is dropped as well.Tested: prod image built with
make os-image; its rootfs listing (mode, owner, size, path) is identical to the image built with the.dstack-keepmarkers still in place. Booted it under TDX withdstack-vmm run:systemd-tmpfiles-setupsucceeds, no failed units, the app container runs.