Skip to content

fix(mkosi): generate volatile SSH host keys after preparation #903

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 2 commits into from
Aug 4, 2026
+16 −0
Merged

fix(mkosi): generate volatile SSH host keys after preparation #903

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
61689af
fix(os): generate SSH host keys per guest
kvinwang Jul 29, 2026
30e998e
fix(mkosi): order SSH after guest preparation
kvinwang Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions os/mkosi/mkosi.postinst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,7 @@ rm -f "$B/etc/machine-id" "$B/var/lib/dbus/machine-id"
# measured image to keep clean builds reproducible.
rm -f "$B/var/log/alternatives.log" "$B/var/log/dpkg.log"
rm -rf "$B/var/log/apt"

# Host keys must be unique per booted development VM, never shared by all
# guests built from one image. OpenSSH generates them on first boot.
rm -f "$B"/etc/ssh/ssh_host_*_key "$B"/etc/ssh/ssh_host_*_key.pub
12 changes: 12 additions & 0 deletions os/mkosi/mkosi.skeleton/usr/lib/systemd/system/ssh.service.d/10-dstack-prepare.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# SPDX-License-Identifier: Apache-2.0
[Unit]
Requires=dstack-prepare.service
After=dstack-prepare.service

[Service]
# Debian validates host keys before starting sshd. Generate the development
# VM's volatile keys only after dstack-prepare has mounted the writable /etc
# overlay, then run the package's original validation step.
ExecStartPre=
ExecStartPre=/usr/bin/ssh-keygen -A
ExecStartPre=/usr/sbin/sshd -t
Loading