From 61689af67b854e56e669e29f42b81949a8d4a101 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Wed, 29 Jul 2026 00:08:19 +0000 Subject: [PATCH 1/2] fix(os): generate SSH host keys per guest --- os/mkosi/mkosi.postinst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/os/mkosi/mkosi.postinst b/os/mkosi/mkosi.postinst index a23f4003a..2b767debd 100755 --- a/os/mkosi/mkosi.postinst +++ b/os/mkosi/mkosi.postinst @@ -11,3 +11,7 @@ rm -f "$B/etc/machine-id" "$B/var/lib/dbus/machine-id" # measured image to keep clean builds reproducible. rm -f "$B/var/log/alternatives.log" "$B/var/log/dpkg.log" rm -rf "$B/var/log/apt" + +# Host keys must be unique per booted development VM, never shared by all +# guests built from one image. OpenSSH generates them on first boot. +rm -f "$B"/etc/ssh/ssh_host_*_key "$B"/etc/ssh/ssh_host_*_key.pub From 30e998e4ed3f8196aa8d1d9e80e540e0c1291160 Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Tue, 4 Aug 2026 04:03:33 -0700 Subject: [PATCH 2/2] fix(mkosi): order SSH after guest preparation --- .../system/ssh.service.d/10-dstack-prepare.conf | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf diff --git a/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf b/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf new file mode 100644 index 000000000..e7adff045 --- /dev/null +++ b/os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf @@ -0,0 +1,12 @@ +# SPDX-License-Identifier: Apache-2.0 +[Unit] +Requires=dstack-prepare.service +After=dstack-prepare.service + +[Service] +# Debian validates host keys before starting sshd. Generate the development +# VM's volatile keys only after dstack-prepare has mounted the writable /etc +# overlay, then run the package's original validation step. +ExecStartPre= +ExecStartPre=/usr/bin/ssh-keygen -A +ExecStartPre=/usr/sbin/sshd -t