Add network overrides and build a qemu image #15599

binujp · 2026-01-28T07:03:59Z

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

Summary

What does the PR accomplish, why was it needed?

We have to make sure systemd-networkd is managing all interfaces. Add a package to deliver the override.

Brought in logic to build a vm-image with the current package selection. This is based on Nan Liu's changes which accomplished the same.

Change Log

Change
Change
Change

Does this affect the toolchain?

YES/NO

Associated issues

#xxxx

Links to CVEs

https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

Pipeline build id: xxxx

Copilot

Pull request overview

This PR adds systemd-networkd configuration for managing all network interfaces and introduces VM image build capability using QEMU. The changes enable building both container and VM images from the Azure Linux base packages.

Changes:

Added azurelinux-overrides package to deliver systemd-networkd configuration files
Extended demo-build.sh script to support VM image building with QEMU
Updated vm-base.kiwi configuration to include the new override package and user setup

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
base/comps/azurelinux-overrides/azurelinux-overrides.spec	New RPM spec file for systemd network override package
base/comps/azurelinux-overrides/azurelinux-overrides.comp.toml	Component definition for the azurelinux-overrides package
base/comps/azurelinux-overrides/50-default.network	Systemd-networkd configuration to manage all interfaces with DHCP
scripts/demo-build.sh	Extended build script with VM image support, SELinux checks, and QEMU launch capability
base/images/vm-base/vm-base.kiwi	Updated VM image configuration with azurelinux-overrides package, user accounts, and adjusted disk size

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-28T07:08:56Z

base/comps/azurelinux-overrides/50-default.network

@@ -0,0 +1,6 @@
+# We want sytemd to manage all interfaces


Typo in comment: 'sytemd' should be 'systemd'.

Suggested change

# We want sytemd to manage all interfaces

# We want systemd to manage all interfaces

Copilot · 2026-01-28T07:08:56Z

scripts/demo-build.sh

    fi
 done

+if [ $(getenforce) != "Permissive" ] ; then


The command substitution is not quoted, which could cause issues if getenforce returns unexpected output or is not found. This should be quoted to handle whitespace and prevent word splitting. Consider using: if [ "$(getenforce)" != "Permissive" ]

Suggested change

if [ $(getenforce) != "Permissive" ] ; then

if [ "$(getenforce)" != "Permissive" ] ; then

Copilot · 2026-01-28T07:08:56Z

scripts/demo-build.sh

    fi
 done

+if [ $(getenforce) != "Permissive" ] ; then


The getenforce command is used but is not checked as a prerequisite. If SELinux tools are not installed, this will fail with an unclear error. Consider adding 'getenforce' to the prerequisite check list at lines 16-21, or handling its absence gracefully.

Copilot · 2026-01-28T07:08:57Z

base/images/vm-base/vm-base.kiwi

    <users>
-        <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
+          <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
+	  <user name="azureuser" password="$6$LTUZg7I3kpIkQhkr$4P2pvOdWEocGfUZP17AVtKpKDPIKsvmYoRSBFwaf5rfoS2/QEVj5HMvU0vPvNJ/5GfvBDpVibT5I8s4OBS8j3/" home="/home/azureuser" groups="root,wheel" />


Hardcoded password hash for the 'azureuser' account poses a security risk. Anyone with access to this code can use this password to login. Consider using a placeholder like 'INSERT-PASSWORD-HERE' (as used for root), or generating a unique password during image build, or relying on cloud-init to set up user credentials.

Suggested change

<user name="azureuser" password="$6$LTUZg7I3kpIkQhkr$4P2pvOdWEocGfUZP17AVtKpKDPIKsvmYoRSBFwaf5rfoS2/QEVj5HMvU0vPvNJ/5GfvBDpVibT5I8s4OBS8j3/" home="/home/azureuser" groups="root,wheel" />

<user name="azureuser" password="INSERT-PASSWORD-HERE" home="/home/azureuser" groups="root,wheel" />

Copilot · 2026-01-28T07:08:57Z

base/images/vm-base/vm-base.kiwi

        <package name="systemd-resolved" />
        <package name="systemd-resolved" />
        <package name="systemd" />
+	<package name="azurelinux-overrides" />


Inconsistent indentation: this line uses tabs while surrounding lines use spaces. This creates inconsistent formatting in the XML file.

Copilot · 2026-01-28T07:08:57Z

scripts/demo-build.sh

+	 --kiwi-file vm-base.kiwi \
+	 system build  \
+	 --description ./base/images/vm-base \
+	 --target-dir "$TARGET_DIR" \
+	 --add-repo="file:///$PWD/base/out,rpm-md,azl,1"
+
+    # boot QEMU VM, C-a x to quit. VM port 22 is forwarded to host:2222
+    echo "Launching azl4 VM, type 'C-a x' to quit."
+    echo "To login as azureuser: ssh -p 2222 azureuser@localhost"
+    sudo qemu-system-x86_64 -enable-kvm -m 2048 -cpu host \
+	 -bios /usr/share/edk2/ovmf/OVMF.stateless.fd \
+	 -drive file="$TARGET_DIR/azl4-vm-base.x86_64-0.1.vhdx",format=vhdx \
+	 -netdev user,id=net0,hostfwd=tcp::2222-:22 -device virtio-net-pci,netdev=net0 \
+	 -nographic -serial mon:stdio


Inconsistent indentation: these lines use tabs while surrounding lines use spaces. This creates inconsistent formatting in the shell script.

Copilot · 2026-01-28T07:08:58Z

base/images/vm-base/vm-base.kiwi

@@ -89,6 +89,7 @@
        <package name="systemd-resolved" />
        <package name="systemd-resolved" />


The package 'systemd-resolved' is listed twice (lines 89 and 90). This is redundant and should be removed.

Suggested change

<package name="systemd-resolved" />

Copilot · 2026-01-28T07:08:58Z

base/images/vm-base/vm-base.kiwi

-    <!--
    <users>
-        <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
+          <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />


The root password is set to the placeholder 'INSERT-PASSWORD-HERE', which means the root account will not be accessible with a password. Ensure this is intentional and that there is an alternative method for root access (e.g., via sudo or cloud-init SSH keys).

Suggested change

<user name="root" password="INSERT-PASSWORD-HERE" groups="root" />

<user name="root" password="!" groups="root" />

Copilot · 2026-01-28T07:08:58Z

scripts/demo-build.sh

+azldev comp build azurelinux-rpm-config; createrepo_c ./base/out
+
 # Build azurelinux-release and azurelinux-repos to provide repo files and release info.
 # They require the rpm-config package to be built first.
-azldev comp build azurelinux-release --local-repo ./base/out && createrepo_c ./base/out
-azldev comp build azurelinux-repos --local-repo ./base/out && createrepo_c ./base/out
+azldev comp build azurelinux-release --local-repo ./base/out; createrepo_c ./base/out
+azldev comp build azurelinux-repos --local-repo ./base/out; createrepo_c ./base/out
+azldev comp build azurelinux-overrides --local-repo ./base/out; createrepo_c ./base/out
+
 # Build rpm to ensure the azl-specific vendor tag is configured.
-azldev comp build rpm --local-repo ./base/out && createrepo_c ./base/out
-# Build a base container image using these private RPMs and upstream Fedora packages.
-sudo kiwi --loglevel 10 \
-    --kiwi-file container-base.kiwi \
-    system build \
-    --description ./base/images/container-base \
-    --target-dir ./base/out/images \
-    --add-repo="file:///$PWD/base/out,rpm-md,azl,1"
-
-# Run a command in the container to verify.
-xzcat ./base/out/images/azl4-container-base.x86_64-0.1.docker.tar.xz | docker load
-docker run -it --rm microsoft/azurelinux/base/core:4.0 cat /etc/os-release
+azldev comp build rpm --local-repo ./base/out; createrepo_c ./base/out


Changed from '&&' to ';' operator between commands. With the script's 'set -e' at line 2, this change means that if 'azldev comp build' fails, the script will still exit (due to -e), but the behavior is less explicit than using '&&'. If the intent is to run createrepo_c regardless of build failure, this conflicts with 'set -e'. Consider using '&&' for explicit error propagation or handling failures explicitly.

Copilot · 2026-01-28T07:08:58Z

scripts/demo-build.sh

+    # Build the VM image using KIWI
+    sudo kiwi --loglevel 10 \
+	 --kiwi-file vm-base.kiwi \
+	 system build  \


Extra space in 'system build ' (double space between 'build' and the line continuation). This is a minor formatting inconsistency.

Suggested change

system build \

system build \

reubeno · 2026-01-28T15:33:36Z

base/comps/azurelinux-overrides/azurelinux-overrides.spec

@@ -0,0 +1,28 @@
+Summary:        Azure Linux systemd network overrides


If this is really specific to network config, can we please change the name to match? Something like azurelinux-config-network or some variant thereof?

You could do something like:

/base/comps/azurelinux-config/ * azurelinux-config-network.spec * azurelinux-config-somethingelse.spec

Alternatively, if you want to have them in one spec, we could at least start with multiple sub-packages.

The main thinking here is that general overrides packages can quickly become dumping grounds.

reubeno · 2026-01-28T15:33:46Z

base/comps/azurelinux-overrides/azurelinux-overrides.spec

+Summary:        Azure Linux systemd network overrides
+Name:           azurelinux-overrides
+Version:        4.0
+Release:        0.1


Should include the dist tag; and might as well start at 1 like most specs.

reubeno · 2026-01-28T15:34:41Z

base/comps/azurelinux-overrides/azurelinux-overrides.spec

+%config(noreplace) /etc/systemd/network/50-default.network
+
+%changelog
+* Wed Jan 21 2026 Binu Philip <bphilip@microsoft.com> - 4.0-0.1


Reminder for us to talk about auto-changelog and auto-release later.

reubeno · 2026-01-28T15:37:32Z

base/images/vm-base/vm-base.kiwi

-    <!--
    <users>
-        <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
+          <user name="root" password="INSERT-PASSWORD-HERE" groups="root" />


Absolutely no checked in passwords.

reubeno · 2026-01-28T15:39:07Z

scripts/demo-build.sh

+
 # Build azurelinux-rpm-config to generate system macros, etc.
-azldev comp build azurelinux-rpm-config && createrepo_c ./base/out
+azldev comp build azurelinux-rpm-config; createrepo_c ./base/out


The && was there intentionally; why remove it? Ditto for below.

reubeno · 2026-01-28T15:40:16Z

scripts/demo-build.sh

+    # boot QEMU VM, C-a x to quit. VM port 22 is forwarded to host:2222
+    echo "Launching azl4 VM, type 'C-a x' to quit."
+    echo "To login as azureuser: ssh -p 2222 azureuser@localhost"
+    sudo qemu-system-x86_64 -enable-kvm -m 2048 -cpu host \


Booting sounds like it should be a separate script or at least an option. Ultimately a script's not awesome, but you're right -- it gets things to move forward.

Add network overrides and build a qemu image

4ceabf9

binujp requested review from Copilot and reubeno and removed request for Copilot January 28, 2026 07:04

Copilot started reviewing on behalf of binujp January 28, 2026 07:04 View session

Copilot AI reviewed Jan 28, 2026

View reviewed changes

reubeno requested changes Jan 28, 2026

View reviewed changes

	# We want sytemd to manage all interfaces
	# We want systemd to manage all interfaces

	if [ $(getenforce) != "Permissive" ] ; then
	if [ "$(getenforce)" != "Permissive" ] ; then

	<user name="azureuser" password="$6$LTUZg7I3kpIkQhkr$4P2pvOdWEocGfUZP17AVtKpKDPIKsvmYoRSBFwaf5rfoS2/QEVj5HMvU0vPvNJ/5GfvBDpVibT5I8s4OBS8j3/" home="/home/azureuser" groups="root,wheel" />
	<user name="azureuser" password="INSERT-PASSWORD-HERE" home="/home/azureuser" groups="root,wheel" />

		@@ -89,6 +89,7 @@
		<package name="systemd-resolved" />
		<package name="systemd-resolved" />

	<user name="root" password="INSERT-PASSWORD-HERE" groups="root" />
	<user name="root" password="!" groups="root" />

		@@ -0,0 +1,28 @@
		Summary: Azure Linux systemd network overrides

Add network overrides and build a qemu image #15599

Are you sure you want to change the base?

Add network overrides and build a qemu image #15599

Conversation

binujp commented Jan 28, 2026

Merge Checklist

Summary

Change Log

Does this affect the toolchain?

Associated issues

Links to CVEs

Test Methodology

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

reubeno Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants