Merge pull request #1321 from Dstack-TEE/fix/guest-preset-policy

fix(os): drop foreign systemd presets so dstack's policy is terminal

Author: kvinwang

os/mkosi/mkosi.postinst

@@ -19,3 +19,9 @@ rm -f "$B"/etc/ssh/ssh_host_*_key "$B"/etc/ssh/ssh_host_*_key.pub
 # Build outputs are merged after package installation, so refresh the final
 # rootfs cache after manually staged NVIDIA and container-runtime libraries.
 ldconfig -r "$B"
+
+# systemd applies the first matching rule across all preset files sorted by
+# name, so a distro preset such as Debian's 90-systemd.preset would shadow the
+# `disable *` in 99-dstack-default.preset. Keep dstack's policy the only one.
+find "$B"/usr/lib/systemd/system-preset "$B"/etc/systemd/system-preset \
+  -maxdepth 1 -name '*.preset' ! -name '*dstack*' -print -delete 2>/dev/null || true

os/mkosi/mkosi.skeleton/usr/lib/systemd/system-preset/80-dstack.preset

@@ -1,5 +1,7 @@
 # SPDX-License-Identifier: Apache-2.0
 enable systemd-networkd.service
+# The only unit WantedBy=network-online.target, which dstack-prepare waits on.
+enable systemd-networkd-wait-online.service
 enable systemd-resolved.service
 enable chrony.service
 enable docker.service

os/mkosi/tests/acceptance.sh

@@ -124,6 +124,11 @@ test ! -e "$D/../common/rootfs/wg-checker.service"
 # only meaningful with a terminal disable. Without it, every package pulled in
 # by Packages= would start at boot with no diff to 80-dstack.preset.
 grep -q '^disable \*$' "$D/mkosi.skeleton/usr/lib/systemd/system-preset/99-dstack-default.preset"
+# ...and it is only terminal if no foreign preset sorts before it.
+grep -q "! -name '\*dstack\*'" "$D/mkosi.postinst" || {
+  echo 'mkosi.postinst must drop foreign preset files' >&2; exit 1; }
+grep -qx 'enable systemd-networkd-wait-online.service' \
+  "$D/mkosi.skeleton/usr/lib/systemd/system-preset/80-dstack.preset"
 # The TEE simulator serves synthetic quotes; its preset must not ship in prod.
 if grep -rq 'dstack-tee-simulator' "$D/mkosi.skeleton/"; then
   echo 'simulator preset must live in the dev profile skeleton' >&2