heavy-duty/box
7
0
Fork 1
Code Issues 9 Pull requests Projects Releases 4 Packages Wiki Activity Actions

release: box 0.5.0 — codex+grok templates, migrate-host, box expose #56

Merged
dan-claude-bot merged 23 commits from integration/0.5.0 into main 2026-07-15 00:04:54 +00:00
Conversation 10 Commits 23 Files changed 18 +10 -2
2 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 912e0621ca - Show all commits

9
bin/box
View file

@ -630,7 +630,14 @@ cmd_new() {
load_template "$t" load_template "$t"
m="$(pick_mode)" m="$(pick_mode)"
# shellcheck disable=SC2054 # "root,size=..." is a single incus argument # shellcheck disable=SC2054 # "root,size=..." is a single incus argument
if [ "$m" = vm ]; then extra+=(--vm --device "root,size=$T_DISK"); else extra+=(--config security.nesting=true); fi # security.secureboot=false: Incus defaults VMs to secureboot ON, and a
# Debian cloud image whose shim is signed with a key the host's OVMF does
# not trust dies with "bad shim signature / prohibited by secure boot
# policy" and drops to the GRUB menu forever — the kernel never loads. It
# is not part of a throwaway box's threat model (the VM boundary is), and
# turning it off boots reliably across image rebuilds. Container mode has
# no firmware, so it does not apply there.
if [ "$m" = vm ]; then extra+=(--vm --device "root,size=$T_DISK" --config security.secureboot=false); else extra+=(--config security.nesting=true); fi
# The template's identity is stamped ONTO the instance: which template, # The template's identity is stamped ONTO the instance: which template,
# which user. 'incus copy' preserves user.* keys (audit B2), so a clone # which user. 'incus copy' preserves user.* keys (audit B2), so a clone
# knows what it is without ever consulting the template again. # knows what it is without ever consulting the template again.

3
drill/drill.sh
View file

@ -779,7 +779,8 @@ else
# old stack, wearing the old tag. This is what migrate has to move. # old stack, wearing the old tag. This is what migrate has to move.
printf '\n minting a faithful legacy box on the old stack…\n' printf '\n minting a faithful legacy box on the old stack…\n'
if mint_legacy=$(incus launch images:debian/13/cloud legacybox --profile claude-dev \ if mint_legacy=$(incus launch images:debian/13/cloud legacybox --profile claude-dev \
--config user.claudebox=1 --vm --device root,size=20GiB 2>&1); then --config user.claudebox=1 --vm --device root,size=20GiB \
--config security.secureboot=false 2>&1); then
wait_box legacybox && ok "legacy box up on the old stack (claudenet, user.claudebox=1)" \ wait_box legacybox && ok "legacy box up on the old stack (claudenet, user.claudebox=1)" \
|| no "legacy box never came up — cannot drill migration" || no "legacy box never came up — cannot drill migration"
box list 2>/dev/null | grep -q '^legacybox' \ box list 2>/dev/null | grep -q '^legacybox' \