Dev note ·
Installs that survive customized Ubuntu baselines
Preflight, configure, and verify now meet hardened Ubuntu 24.04 postures, without lowering the Marketplace AMI regression bar.
Sprint 126 teaches the installer the baselines that sit beside Canonical’s AWS Marketplace image
- DEPLOYMENT
- UBUNTU
This sprint
BacklogZero already ships on Ubuntu 24.04 and RHEL 10. Our Ubuntu GA bar stays the Canonical Marketplace AMI: fresh image, fresh kit, green build.
However, enterprise hosts often don't stop there. Custom baselines bring UFW leftovers, thinner packages, and DNS that behaves differently inside a Podman bridge. Sprint 126 extends preflight → configure → verify so those postures get product-owned fixes, without asking anyone to soften their standards, and without Level Up Labs planning as if every golden OS image will be identical.
What moved
| Before | After |
|---|---|
Preflight: RAM/CPU/disk/ip_forward | Same floors plus firewall/DNS baseline vs stock Ubuntu 24.04 |
| Lean host package lists | rsync and ping tools with the host role |
podman build on the container network | Default --network=host for frozen API, Caddy, and frontend builds |
UFW: FORWARD ACCEPT + static 10.89.0.0/24 | Discover Podman bridge CIDRs; allow-from-bridge; richer diagnose |
Verify: host loopback /api/ready | Also bridge gateway, api:8000 DNS, and a safe egress probe |
Marketplace regression stays the bar. Hardened Ubuntu gets clearer expected-vs-actual signals when something still differs.
Still open
On purpose, this slice does not:
- Bake container IPs into
BACKEND_UPSTREAMas the default fix - Hard-fail verify against live Controller/ITSM URLs
- Redesign north-south ACLs, AD join, or CIS/STIG remediation
Prefer firewall-compatible Netavark DNS over hardcoding upstream IPs. Live Controller checks stay opt-in so offline labs stay clean.
For customers
- Stock Marketplace AMI: same happy path; new defaults should stay invisible.
- Hardened Ubuntu 24.04: preflight names the delta; configure layers Podman-compatible rules on top of your firewall; verify proves the container path, not only host loopback.
- Airgap / labs: retarget or disable the egress probe the same way you already skip resource floors.
First install path: Operator quickstart. Day-2 kit upgrades still skip preflight: Upgrade.
Available to customers
Will be available in the forthcoming v2026.9.0 bundle.