Repository navigation
Add support for read-only /root #331
Description
Currently, ssh key injection assumes /root is writable, which might not always be the case.
I've worked around this for ephemeral runs by injecting a systemd mount unit for mounting tmpfs to /root/.ssh via --systemd-units. This leaves /root read-only, which keeps it close to the original image:
Unfortunately bcvk to-disk doesn't support --systemd-units, so it just gets stuck at Reached target sshd-keygen.target.
Maybe it might be useful to inject this unit by default, keeping .ssh in tmpfs? The unit itself is really simple:
[Unit]
Description=Transient BCVK Writable Root SSH Directory
DefaultDependencies=no
Conflicts=umount.target
Before=local-fs.target
[Mount]
What=tmpfs
Where=/root/.ssh
Type=tmpfs
Options=mode=0700,noatime,nodev,nosuid,noexec
[Install]
WantedBy=local-fs.target
Activity
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh
ephemeral: Add writable tmpfs overlay over /root/.ssh