refactor(os): apply rootfs tmpfiles at build time only

os/mkosi/README.md

@@ -157,7 +157,7 @@ would produce invalid or unparseable TDX measurement material.
 
 The distribution snapshot, build-only packages, guest packages, profiles,
 source mounts, source-date epoch, tools tree, package cleanup, file removal,
-systemd presets, tmpfiles, service masks and the build/postinstall/finalize/
+systemd presets, service masks and the build/postinstall/finalize/
 postoutput/clean lifecycle are mkosi-native. The native tar output is replaced
 in `mkosi.postoutput` by the identically named Yocto-compatible archive, so no
 unrelated mkosi rootfs artifact escapes the staging directory.
@@ -182,6 +182,8 @@ Only four project-specific mechanisms remain:
 
 The tiny postinstall hook is also retained because mkosi's native `MachineId=`
 supports a UUID, `random`, or `uninitialized`, while the Yocto contract requires
-an existing but empty `/etc/machine-id`. Rust and Go distributions are pinned by
+an existing but empty `/etc/machine-id`. `mkosi.finalize` applies
+`rootfs.tmpfiles` instead of shipping it in tmpfiles.d, where it would re-run
+on every boot against the read-only root. Rust and Go distributions are pinned by
 version and SHA-256 inside the mkosi build overlay because Debian trixie's Rust
 package is too old for this workspace; they never come from the host.

os/mkosi/mkosi.conf

@@ -84,12 +84,6 @@ Packages=
         # dstack-prepare treats as fatal.
         libxmlsec1t64-openssl
         libxmlsec1t64
-RemoveFiles=
-        /var/lib/containerd/.dstack-keep
-        /var/lib/docker/.dstack-keep
-        /var/lib/tpm2-tss/system/keystore/.dstack-keep
-        /var/mail/.dstack-keep
-        /var/volatile/.dstack-keep
 # No KernelCommandLine= here on purpose. mkosi only consumes it on bootable
 # paths (UKI build, bootloader entries, the vm/qemu verbs), all unreachable
 # with Bootable=no, so the value it used to carry was dead config that

os/mkosi/mkosi.finalize

@@ -13,6 +13,8 @@ ARTIFACTS="$WORK/artifacts"
 source "$SELF/versions.env"
 
 "$SELF/scripts/normalize-skeleton-modes.sh" "$TREE" "$FLAVOR"
+# After mkosi's own tmpfiles pass, so these override package defaults.
+systemd-tmpfiles --root="$TREE" --create "$SELF/rootfs.tmpfiles"
 "$SELF/scripts/write-os-release.sh" \
 	"$TREE" "$DSTACK_VERSION" "$DSTACK_CODENAME"
 mkdir -p "$KSTAGE/usr/lib" "$OUTPUTDIR/.image-tools"

os/mkosi/mkosi.skeleton/usr/lib/systemd/system-preset/80-dstack.preset

@@ -7,7 +7,6 @@ enable chrony.service
 enable docker.service
 enable var-volatile.mount
 enable dstack-volatile-binds.service
-enable dstack-firstboot.service
 enable dstack-prepare.service
 enable dstack-guest-agent.socket
 enable dstack-guest-agent.service

os/mkosi/scripts/normalize-skeleton-modes.sh

@@ -28,7 +28,7 @@ for skeleton in "${skeletons[@]}"; do
         else
             chmod 0644 "$destination"
         fi
-    done < <(find "$skeleton" -type f ! -name .dstack-keep -print0)
+    done < <(find "$skeleton" -type f -print0)
 
     # -mindepth 1 keeps the skeleton root itself out of the loop; without it
     # the empty relative path would chmod the rootfs root as a side effect.

os/mkosi/tests/acceptance.sh

@@ -191,10 +191,8 @@ grep -q 'objcopy --strip-debug' "$D/mkosi.build"
 grep -q 'depmod -b.*KERNEL_VERSION-dstack' "$D/mkosi.build"
 grep -q '^CleanPackageMetadata=yes$' "$D/mkosi.conf"
 grep -q '^WithDocs=no$' "$D/mkosi.conf"
-grep -q '/var/lib/docker/.dstack-keep' "$D/mkosi.conf"
-grep -q '! -name .dstack-keep' "$D/scripts/normalize-skeleton-modes.sh"
 grep -q '/var/lib/tpm2-tss/system/keystore 0755' \
-  "$D/mkosi.skeleton/usr/lib/tmpfiles.d/dstack-image.conf"
+  "$D/rootfs.tmpfiles"
 grep -q '/var/lib/dpkg' "$D/mkosi.profiles/prod/mkosi.conf"
 if grep -q '^[[:space:]]*ovmf$' "$D/mkosi.conf"; then
   echo 'distribution OVMF must not be installed in the guest rootfs' >&2