[cdalar]

Summary

Follow-up to #1204, from testing the ac provider end to end on macOS 26.6.2 with container 0.1.0. The lifecycle (create/ls/ssh/pause/resume/destroy, non-root ac.vm.username) works as that PR describes; two things did not.

• onctl create -a <script> failed on every image. The apply step (tools.applyCommand) runs scripts through sudo -E and tails their log with GNU tail --pid -s 0.1. Stock ubuntu:24.04 has no sudo (exit 127) and alpine's busybox tail rejects -s 0.1. The shipped action scripts (docker.sh, ...) call sudo themselves too. The bootstrap now installs sudo next to sshd on every package-manager branch (apk/apt-get/dnf), plus bash and coreutils on alpine, and adds the container's hostname to /etc/hosts so sudo doesn't print "unable to resolve host" on every call. Images that already ship sshd but not sudo get sudo too.
• Stale error hint. When the init process exited, Deploy said "see container logs <name>" and then removed the container, so the hint pointed at nothing. The error now carries the last 20 lines of the container's output instead.

Nothing here contradicts #1204: it promised any OCI image gets sshd on first boot and did not test -a.

Testing

• go test ./..., go vet, golangci-lint run: clean. Tests updated: the bootstrap-exit test now checks the error carries the container's output (plus a no-output variant), and the bootstrap test pins the sudo/bash/coreutils installs.
• Bootstrap run by hand on ubuntu:24.04 and alpine:3.20: sshd listening, sudo -n true succeeds quietly, bash present, tail --version is GNU coreutils on both.
• Via onctl create with a busybox image (no package manager): fails in ~11s, the error includes the bootstrap's own message, and no container is left behind.
• Not re-verified in this session: onctl create -a through ssh with the new binary. After the rebuild, every ssh dial from the freshly built unsigned binary failed with connect: no route to host while ssh/nc from the same shell reached the guest; the system log shows macOS Local Network authorization requests (tccd) for the new binary at those times, and a binary built from unchanged main fails the same way in this terminal session. That is a host permission for the rebuilt binary, not provider behaviour; before the rebuild, the same -a flow reached the guest and failed only on the missing sudo.

Not changed

• onctl resume returns as soon as the container has an address, before sshd listens; an immediate onctl ssh can time out. fc behaves the same, so left as is.
• create prints a green check after an apply script exits non-zero (generic to all providers).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NUW51KkwXcguxMVi6t2Wwf

[codecov]

Codecov Report

❌ Patch coverage is 81.81818% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 41.25%. Comparing base (8203d6e) to head (e076932).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/cloud/ac.go	81.81%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1205      +/-   ##
==========================================
+ Coverage   39.94%   41.25%   +1.31%     
==========================================
  Files          67       69       +2     
  Lines        7333     7560     +227     
==========================================
+ Hits         2929     3119     +190     
- Misses       4404     4441      +37     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.