Skip to content

fix(orchestrator): harden provision.sh with chattr fallback and APT time fix #2227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tomassrnka wants to merge 1 commit into from
Closed

fix(orchestrator): harden provision.sh with chattr fallback and APT time fix #2227

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions packages/orchestrator/pkg/template/build/phases/base/provision.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,14 @@ RESULT_PATH="{{ .ResultPath }}"
echo "Starting provisioning script"

echo "Making configuration immutable"
$BUSYBOX chattr +i /etc/resolv.conf
if $BUSYBOX chattr +i /etc/resolv.conf 2>/dev/null; then
CHATTR_AVAILABLE=1
elif command -v chattr >/dev/null 2>&1 && chattr +i /etc/resolv.conf 2>/dev/null; then
CHATTR_AVAILABLE=1
Comment on lines +12 to +13
Copy link
Copy Markdown
Contributor

@arkamar arkamar Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this fallback really necessary? What I mean is that busybox should be always available, right? Therefore if $BUSYBOX chattr +i fail the chattr +i will fail as well. Or am I missing something?

else
echo "Warning: chattr not available, skipping immutable flag on resolv.conf"
CHATTR_AVAILABLE=0
fi

# Helper function to check if a package is installed
is_package_installed() {
Expand All @@ -28,8 +35,11 @@ done

if [ -n "$MISSING" ]; then
echo "Missing packages detected, installing:$MISSING"
apt-get -q update
DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes apt-get -qq -o=Dpkg::Use-Pty=0 install -y --no-install-recommends $MISSING
# Firecracker VM clock starts at epoch (no PTP/chrony yet), so APT rejects
# release files as "not valid yet". Disable all date validation.
APT_DATE_OPTS='-o Acquire::Check-Valid-Until=false -o Acquire::Check-Date=false'
apt-get -q $APT_DATE_OPTS update
DEBIAN_FRONTEND=noninteractive DEBCONF_NOWARNINGS=yes apt-get -qq -o=Dpkg::Use-Pty=0 $APT_DATE_OPTS install -y --no-install-recommends $MISSING
else
echo "All required packages are already installed."
fi
Expand Down Expand Up @@ -85,7 +95,9 @@ echo "Linking systemd to init"
ln -sf /lib/systemd/systemd /usr/sbin/init

echo "Unlocking immutable configuration"
$BUSYBOX chattr -i /etc/resolv.conf
if [ "${CHATTR_AVAILABLE:-0}" = "1" ]; then
$BUSYBOX chattr -i /etc/resolv.conf 2>/dev/null || chattr -i /etc/resolv.conf 2>/dev/null || true
fi

echo "Finished provisioning script"

Expand Down
Loading