fix(pivot): serve SSH without an entrypoint, reboot when one exits

[ananthb]

What went wrong

A remote pivot with --ssh/--tailscale and no --command leaves the box reachable by ICMP and dead on every port — a running kernel with no userspace, recoverable only by physically power-cycling it.

Hit for real on an RPi 3A+: it pivoted, registered on the tailnet, and was never reachable again. ICMP kept answering the whole time, which is worth calling out — the kernel answers ping, and pivot_root never touches the kernel. "It pings" proves nothing about whether the new rootfs works.

Three defects, each sufficient alone

1. The default entrypoint cannot survive a remote pivot. It's /bin/sh, and a shell driven from a detached pivot has no terminal — stdin is /dev/null, it reads EOF, and it exits 0 before anyone can connect. Supervise returns and takes the SSH server (a goroutine) with it.

Passing sleep infinity works, but that makes the headline use case depend on a shell idiom and on the image shipping coreutils. So when services are enabled and the operator named neither --entrypoint nor --command, we now supervise nothing: ServeUntilSignal blocks until TERM/INT, reaping orphans. It needs nothing from the image.

The image's own default is deliberately ignored in this mode — minimal images default to a shell (alpine's Cmd is ["/bin/sh"]), and a shell is precisely what must not be supervised here.

2. RebootOnFailure treated the clean exit above as success. It only fired on non-zero. But post-pivot there is no init to fall back to — the supervisor is the only thing holding userspace up, so any exit is fatal. Renamed RebootOnExit, fired unconditionally. This alone would have made the incident self-recovering.

3. No /etc/resolv.conf. Minimal images ship none, and the host's can't just be copied: on systemd-resolved distros it names 127.0.0.53, a stub whose daemon is terminated during pivot prep — so the result looks configured and resolves nothing. EnsureResolvConf keeps a usable file, else inherits the host's routable nameservers, else falls back to public resolvers, and replaces a dangling stub symlink with a real file. Tailscale needs DNS to reach the coordination server, so this strands the box exactly when remote access is the only access left.

Result

The motivating command now works with no shell idioms:

xmorph pivot --force --image alpine:latest --tailscale.authkey ... --ssh.enable

The dry run also now states which lifecycle will run, instead of printing Execute /bin/sh for a shell that was never going to survive.

Testing

go build, go vet, and go test ./internal/postpivot/... pass; cross-built for linux/arm64. New tests cover resolv.conf parsing, loopback-stub filtering, the absent/usable/stub-only/dangling-symlink cases.

Not yet exercised on real hardware — the board this came from needs a power cycle first. The serveOnly and reboot-on-exit paths are the ones to watch on the next live run.

[ananthb]

Revised in 1aca6b2 after review — the implicit serve-mode switch is gone.

The original version entered serve mode whenever services were enabled and no command was named. That inference isn't sound: an image whose Cmd is a real long-running daemon — exactly what a purpose-built rescue image looks like — is indistinguishable at that point from alpine's ["/bin/sh"], so the guess would silently skip the very program the operator built the image around. It also makes behaviour depend on an unrelated flag.

With RebootOnExit in place, honouring the image is already safe: a shell that exits reboots the box back into the on-disk OS.

So serve mode is now an explicit --serve, and nothing is inferred. Safe isn't the same as useful though — a bare --image alpine --ssh.enable would pivot, exit, and reboot in a loop, with the cause buried in a log on a filesystem that just went away. checkEntrypointSurvivesDetach catches that before anything destructive happens, while the old root is intact and aborting is free:

entrypoint "/bin/sh" is a shell with no terminal attached: it will read EOF on stdin
and exit immediately after the pivot, rebooting the box back into the on-disk OS.
  --serve            stay up serving SSH (what a remote rescue pivot wants)
  --command ...      run a specific program instead
  --entrypoint ...   override the image's default explicitly

Only the no-TTY case is rejected — with a console attached a shell is a legitimate entrypoint, so stdin decides. --serve alongside --entrypoint/--command is rejected outright rather than resolved in either direction.

The other two fixes (reboot-on-any-exit, resolv.conf) are unchanged.