ci-runner: bake the UFW package into the ephemeral image #18

Merged

jfraeys merged 1 commit from ci/bake-ufw-package into main 2026-10-04 22:00:16 -04:00

Conversation 0 Commits 1 Files changed 2 +12 -1

jfraeys commented 2026-10-04 22:00:10 -04:00

Owner

Copy link

The Install UFW task was tagged base only, so every ephemeral VM installed the package from the network.
Tagging it image_bake too moves that into the image. The UFW rules and enable stay per-VM: Packer's ansible
provisioner connects through a local proxy port, so baked rules would allow the wrong port and a baked
enable would deny SSH on 22 at boot.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

The Install UFW task was tagged base only, so every ephemeral VM installed the package from the network. Tagging it image_bake too moves that into the image. The UFW rules and enable stay per-VM: Packer's ansible provisioner connects through a local proxy port, so baked rules would allow the wrong port and a baked enable would deny SSH on 22 at boot. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys added 1 commit 2026-10-04 22:00:10 -04:00

ci-runner: bake the UFW package into the ephemeral image ... 70b5f7aad3

The Install UFW task was tagged base only, so every ephemeral VM installed the package from the network.
Tagging it image_bake too moves that into the image. The UFW rules and enable stay per-VM: Packer's ansible
provisioner connects through a local proxy port, so baked rules would allow the wrong port and a baked
enable would deny SSH on 22 at boot.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys merged commit c6ccd853a1 into main 2026-10-04 22:00:16 -04:00

jfraeys referenced this pull request from a commit 2026-10-04 22:00:18 -04:00

Merge pull request 'ci-runner: bake the UFW package into the ephemeral image' (#18) from ci/bake-ufw-package into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

jfraeys/infra!18

No description provided.