heavy-duty/box
7
0
Fork 1
Code Issues 9 Pull requests Projects Releases 4 Packages Wiki Activity Actions

fix: name the boot failure — a corrupt image, Secure Boot, or a GRUB hang

Browse source 
Wall 2 is solved: 'EFI stub: Failed to decompress kernel' was a CORRUPT
IMAGE — the --purge-storage re-download produced a bad blob. Deleting
the cached image and re-pulling booted the box immediately. The storage
pool was innocent (1.29GiB used of 30GiB).

Both walls cost hours to diagnose by hand. The next box to hit them
should be told the answer, not the symptom — so wait_agent now reads
the console log and names the failure:

  · 'Failed to decompress kernel' -> the cached image is corrupt; here
    is the incus image delete command to re-pull it
  · 'bad shim signature' -> Secure Boot rejected the kernel (shouldn't
    happen now; box mints with security.secureboot=false)
  · GRUB/firmware menu -> never booted; re-pull or pin BOX_IMAGE
This commit is contained in:
claude-hdb 2026-07-14 19:31:41 +00:00
parent e09e4b62ee
commit c31fbc63f7
1 changed files with 16 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
bin/box
View file

@ -557,11 +557,22 @@ wait_agent() {
echo "box: instance agent never came up after 5 minutes." >&2 echo "box: instance agent never came up after 5 minutes." >&2
echo "box: sanitized console log → $clog (last non-blank lines:)" >&2 echo "box: sanitized console log → $clog (last non-blank lines:)" >&2
grep -v '^[[:space:]]*$' "$clog" 2>/dev/null | tail -6 | sed 's/^/ /' >&2 grep -v '^[[:space:]]*$' "$clog" 2>/dev/null | tail -6 | sed 's/^/ /' >&2
# A box sitting at the GRUB/firmware menu is not slow — it never booted. # A box that never boots is NOT a slow box, and the console says which
if grep -qiE 'GNU GRUB|Press enter to boot|UEFI Firmware Settings' "$clog" 2>/dev/null; then # failure it is. Each of these cost hours to diagnose by hand once; the
echo "box: the VM is stuck at the GRUB/firmware menu — it is not booting." >&2 # box that hits them next should be told the answer, not the symptom.
echo "box: this is the IMAGE, not box. Try re-pulling it (incus image delete …)" >&2 if grep -qiE 'Failed to decompress kernel|efi_stub_entry\(\) failed' "$clog" 2>/dev/null; then
echo "box: or pin a known-good build/alias in the template's BOX_IMAGE." >&2 echo "box: THE KERNEL WOULD NOT DECOMPRESS — the cached image is corrupt." >&2
echo "box: (a truncated/bad image download does exactly this). Re-pull it:" >&2
echo "box: incus image list # find the fingerprint" >&2
echo "box: incus image delete <fingerprint> # the next mint re-downloads" >&2
elif grep -qiE 'bad shim signature|prohibited by secure boot' "$clog" 2>/dev/null; then
echo "box: SECURE BOOT rejected the kernel — but box mints VMs with" >&2
echo "box: security.secureboot=false, so this box predates that fix or was" >&2
echo "box: created by hand. Re-mint it with a current box." >&2
elif grep -qiE 'GNU GRUB|Press enter to boot|UEFI Firmware Settings' "$clog" 2>/dev/null; then
echo "box: the VM is stuck at the GRUB/firmware menu — it never booted." >&2
echo "box: this is the IMAGE, not box. Re-pull it (incus image delete …)," >&2
echo "box: or pin a known-good build in the template's BOX_IMAGE." >&2
fi fi
die "agent unreachable (inspect live: incus console $n)" die "agent unreachable (inspect live: incus console $n)"
fi fi