sshd

Version	2026.144.1443
Repo	superproject

SSH server with key-based login and passwordless sudo for the uid-1000 account Installs the OpenSSH server (openssh-server / openssh on Arch) plus a sshd-wrapper launcher, publishes the SSH port, and drops a NOPASSWD sudoers rule for the build’s uid-1000 account. Every artifact is directly observable in the built image: the daemon binary, the wrapper script, the installed package, and the effective sudo grant.

Packages

Installed on every distro:

• sudo

Services

• sshd
• sshd

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	copy=sshd-wrapper
run	command=account=$(getent passwd 1000 | cut -d: -f1) if [ -z “$account” ]; then echo “sshd layer: no uid-1000 account found — refusing to write sudoers” >&2 exit 1 fi printf ‘%s ALL=(ALL) NOPASSWD: ALL\n’ “$account” > /etc/sudoers.d/charly-user chmod 0440 /etc/sudoers.d/charly-user
check	the OpenSSH sshd daemon binary is installed at /usr/sbin/sshd
check	the OpenSSH server package is installed (openssh on Arch)
check	the sshd-wrapper launcher is present and world-executable
check	the uid-1000 account can run sudo with no password (NOPASSWD rule in effect)
agent-check	a client presenting a key from SSH_AUTHORIZED_KEYS can open an interactive session on the published SSH port
check	file=/usr/sbin/sshd
check	file=/usr/local/bin/sshd-wrapper
check	package=openssh-server
check	service=sshd
check	addr=127.0.0.1:${HOST_PORT:2222}