Module steps 

Each set-up step of a VM (Step) written once: as a root shell script for Linux, and as PowerShell where Windows has the step. A VM backend only picks how the scripts reach the machine (a Vagrant provisioner, cloud-init, remote-exec, WinRM), so every target sets a machine up the same way.

Constants

CLOUD_INIT_WAIT

Waits for cloud-init to be done (its packages in, apt free): the first command of a set-up run over SSH on a VM cloud-init boots. Its failure doesn’t stop the set-up.

COMPOSE_VERSION

The Compose plugin a Docker host gets, exactly (on hosts with apt: Debian and Ubuntu).

DOCKER_APT_KEY_SHA256

Docker’s apt signing key, pinned by SHA-256 (the same armored key for Debian and Ubuntu, download.docker.com/linux/<id>/gpg); verified against download.docker.com on 2026-10-16.

DOCKER_VERSION

The Docker Engine a Docker host gets (docker-vm, cloud-docker, hybrid), exactly: the version Isoloom’s Compose files are proven with, so two runs of one lab get the same engine.

INPUTS_FILE

The inputs, uploaded before the steps run (KEY=value lines).

INSTALL_DOCKER

Installs Docker, unless it is there, as a root script. On the apt family (Debian, Ubuntu) it adds Docker’s own repository with the signing key pinned by SHA-256 (DOCKER_APT_KEY_SHA256, no curl | sh), then installs the engine at DOCKER_VERSION (the exact package resolved from the repository, so its epoch and build suffix are the repo’s) and the Compose plugin at COMPOSE_VERSION. The RPM family (Rocky, AlmaLinux, CentOS, Fedora) still uses Docker’s own install script, pinned to DOCKER_VERSION. TODO(4.7): inline the dnf/RPM path too, its key pinned by SHA-256 (e6c650e0…), proven on a Rocky/Fedora guest. The apt branch fails closed (a set -e subshell, the key verified before use).

KEPT_INPUTS_FILE

Where the inputs are kept when a reboot comes (/tmp is emptied at boot).

PROJECT_ARCHIVE

The project’s archive, uploaded before the steps run.

PROJECT_DIR

Where the project is unpacked on a VM.

PUBLISHED_FROM_OUTSIDE

On a Docker host VM, published ports reach containers whatever their routes: what arrives from outside the VM (a forward to this computer, a client of the server’s address) is DNAT’ed by Docker with its source kept, and a container of an internet: false network, its default route removed, can’t answer it. Masquerading that traffic into the lab’s bridges makes it come from the bridge’s own address, which every container reaches. A unit keeps the rule across reboots, after Docker’s own. Run as root; running it again changes nothing.

Functions

linux

step of machine as a root shell script for a Linux VM; None when it has nothing to do there.

reboot_check

After a reboot step: fails when the machine didn’t actually restart.

record_boot

Records this boot’s id, for reboot_check: a transport that restarts the machine itself (Terraform’s remote-exec) runs it before restarting.

windows

step of machine as PowerShell for a Windows VM; None when Windows has no such step (or nothing to do for it).