FIX(wsl2): resolve WSL2 boot failures, ordering cycle, and Windows bootstrap

Kabuki94 · claude · Kabuki94 · commit f271a4304f60 · 2026-05-01T15:00:06.000Z
Systemd fixes:
- journald: add ReadKMsg=no + ForwardToSyslog=no to prevent WSL2 kernel 6.6+ crash
- mios-role: remove Before=sysinit.target (cycled with After=network-online.target);
  move to After=sysinit.target, WantedBy=multi-user.target
- dbus-daemon-wsl: remove --syslog-only (203/EXEC when /dev/log absent); add StandardError=journal+console
- virtlxcd{,.service.d}: add ConditionVirtualization=!wsl to stop crash-loop (NOTCONFIGURED)
- virtlxcd-{admin,ro}.socket.d: add ConditionVirtualization=!wsl
- avahi-daemon.{service,socket}.d: add ConditionVirtualization=!wsl (no multicast in WSL2)
- ollama.service.d: add ConditionVirtualization=!wsl + ConditionPathExists guard

WSL2 runtime scripts:
- wsl-firstboot: replace stub with real impl — reads install.env, creates user via
  sysusers + imperative fallback, sets sha512crypt hash, sets up home, marks done;
  all logger calls wrapped with || true (journald may not be up at exec time)
- wsl-init: replace stub with runtime bridge — tmpfiles, WSLg X11 socket; same logger fix

Docs/infra:
- .gitignore: add *.socket.d/ whitelist alongside *.service.d/
- CLAUDE.md: fix stale lint claim; expand qcow2/vhdx/wsl2 into separate entries
- README.md: add missing just targets (raw, qcow2, vhdx, wsl2, all-bootstrap)

Co-Authored-By: Claude Sonnet 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/.gitignore b/.gitignore
@@ -243,6 +243,8 @@ usr/lib/systemd/system/*
 !/usr/lib/systemd/system/var-*.mount
 !/usr/lib/systemd/system/*.service.d/
 !/usr/lib/systemd/system/*.service.d/**
+!/usr/lib/systemd/system/*.socket.d/
+!/usr/lib/systemd/system/*.socket.d/**
 # Exclude system-owned service.d dirs that MiOS doesn't manage
 usr/lib/systemd/system/systemd-udev-trigger.service.d/
 usr/lib/systemd/system/user@.service.d/
diff --git a/CLAUDE.md b/CLAUDE.md
@@ -39,16 +39,18 @@ just build-logged     # Build with tee'd log under logs/
 just rechunk          # bootc-base-imagectl rechunk for small Day-2 deltas
 just raw              # 80 GiB RAW disk image via bootc-image-builder (BIB)
 just iso              # Anaconda installer ISO via BIB
-just qcow2 / vhdx / wsl2   # Other disk formats (need MIOS_USER_PASSWORD_HASH)
+just qcow2            # QEMU qcow2 disk image (needs MIOS_USER_PASSWORD_HASH)
+just vhdx             # Hyper-V VHDX disk image (needs MIOS_USER_PASSWORD_HASH)
+just wsl2             # WSL2 tar.gz for wsl --import
 just sbom             # CycloneDX SBOM via syft
 just artifact         # Refresh AI manifests, knowledge, wiki (automation/ai-bootstrap.sh)
 just init-user-space  # Lay down ~/.config/mios/{env,images,build}.toml
 just show-env         # Print loaded MIOS_* vars
 ```
 
-`just lint` is referenced in CONTRIBUTING.md but the `lint` target is not
-defined in the current Justfile — `bootc container lint` runs as the final
-`RUN` of `Containerfile`, so a successful `just build` is the lint gate.
+`just lint` re-runs `bootc container lint` against the locally built image on
+demand. `bootc container lint` also runs as the final `RUN` of `Containerfile`,
+so a successful `just build` is itself a lint gate.
 
 There is no test suite. Validation gates: `automation/99-postcheck.sh` (run
 inside the image build), `bootc container lint` (last Containerfile RUN), and
diff --git a/README.md b/README.md
@@ -42,8 +42,13 @@ just preflight      # System prereq check
 just build          # OCI image
 just lint           # bootc container lint (re-run on built image)
 just rechunk        # Optimized Day-2 deltas
+just raw            # 80 GiB RAW disk image
 just iso            # Anaconda installer ISO
+just qcow2          # QEMU qcow2 disk image (needs MIOS_USER_PASSWORD_HASH)
+just vhdx           # Hyper-V VHDX disk image (needs MIOS_USER_PASSWORD_HASH)
+just wsl2           # WSL2 tar.gz for wsl --import
 just sbom           # CycloneDX SBOM
+just all-bootstrap  # build + rechunk + log artifacts to bootstrap repo
 ```
 
 Windows: `.\preflight.ps1 ; .\mios-build-local.ps1`. See `SELF-BUILD.md`.
diff --git a/usr/lib/systemd/journald.conf.d/10-mios-noaudit.conf b/usr/lib/systemd/journald.conf.d/10-mios-noaudit.conf
@@ -1,7 +1,7 @@
 [Journal]
-# Disable kernel audit forwarding to the journal.
-# systemd 259+ on WSL2 (which lacks the audit netlink socket) crashes
-# journald at start when Audit=yes (the default). Setting Audit=no here
-# prevents the crash on WSL2 while having no meaningful effect on bare
-# metal (auditd owns the audit socket there anyway).
+# Audit=yes crashes journald on WSL2 (no audit netlink socket).
 Audit=no
+# ReadKMsg=yes crashes journald on WSL2 kernel 6.6+ (EPERM on /dev/kmsg).
+ReadKMsg=no
+# Avoid syslog socket dependency that races with journald startup in WSL2.
+ForwardToSyslog=no
diff --git a/usr/lib/systemd/system/avahi-daemon.service.d/10-mios-wsl2.conf b/usr/lib/systemd/system/avahi-daemon.service.d/10-mios-wsl2.conf
@@ -0,0 +1,2 @@
+[Unit]
+ConditionVirtualization=!wsl
diff --git a/usr/lib/systemd/system/avahi-daemon.socket.d/10-mios-wsl2.conf b/usr/lib/systemd/system/avahi-daemon.socket.d/10-mios-wsl2.conf
@@ -0,0 +1,2 @@
+[Unit]
+ConditionVirtualization=!wsl
diff --git a/usr/lib/systemd/system/dbus-daemon-wsl.service b/usr/lib/systemd/system/dbus-daemon-wsl.service
@@ -7,9 +7,10 @@ After=dbus.socket
 DefaultDependencies=no
 
 [Service]
-ExecStart=/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
+ExecStart=/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
 ExecReload=/usr/bin/dbus-send --print-reply --system --type=method_call --dest=org.freedesktop.DBus / org.freedesktop.DBus.ReloadConfig
 OOMScoreAdjust=-900
+StandardError=journal+console
 
 [Install]
 WantedBy=multi-user.target
diff --git a/usr/lib/systemd/system/mios-role.service b/usr/lib/systemd/system/mios-role.service
@@ -2,14 +2,13 @@
 Description=MiOS System Init & Role Engine
 ConditionVirtualization=!container
 Wants=network-online.target
-After=network-online.target local-fs.target
+After=network-online.target local-fs.target sysinit.target
 DefaultDependencies=no
-Before=sysinit.target
 
 [Service]
 Type=oneshot
 ExecStart=/usr/libexec/mios/role-apply
 RemainAfterExit=yes
 
 [Install]
-WantedBy=sysinit.target
+WantedBy=multi-user.target
diff --git a/usr/lib/systemd/system/ollama.service.d/10-mios-wsl2.conf b/usr/lib/systemd/system/ollama.service.d/10-mios-wsl2.conf
@@ -0,0 +1,4 @@
+[Unit]
+# Skip ollama on WSL2: binary may not be present and CUDA is unavailable.
+ConditionVirtualization=!wsl
+ConditionPathExists=/usr/local/bin/ollama
diff --git a/usr/lib/systemd/system/virtlxcd-admin.socket.d/10-mios-wsl2.conf b/usr/lib/systemd/system/virtlxcd-admin.socket.d/10-mios-wsl2.conf
@@ -0,0 +1,2 @@
+[Unit]
+ConditionVirtualization=!wsl
diff --git a/usr/lib/systemd/system/virtlxcd-ro.socket.d/10-mios-wsl2.conf b/usr/lib/systemd/system/virtlxcd-ro.socket.d/10-mios-wsl2.conf
@@ -0,0 +1,2 @@
+[Unit]
+ConditionVirtualization=!wsl
diff --git a/usr/lib/systemd/system/virtlxcd.service.d/10-mios-wsl2.conf b/usr/lib/systemd/system/virtlxcd.service.d/10-mios-wsl2.conf
@@ -0,0 +1,2 @@
+[Unit]
+ConditionVirtualization=!wsl
diff --git a/usr/libexec/mios/wsl-firstboot b/usr/libexec/mios/wsl-firstboot
@@ -1,8 +1,80 @@
 #!/usr/bin/env bash
-# MiOS v0.2.0 — stub: wsl-firstboot
-# Implementation expected from bootstrap overlay or future automation script.
-# Override by dropping a real executable at: /usr/libexec/mios/wsl-firstboot
+# MiOS — wsl-firstboot: WSL2 first-boot user and runtime initialization.
+# Runs once (guarded by ConditionPathExists=!/var/lib/mios/.wsl-firstboot-done).
+# Safe to re-run: all operations are idempotent.
 set -euo pipefail
-logger -t mios "[wsl-firstboot] stub executed — replace with real implementation"
-echo "[mios/wsl-firstboot] stub: no-op" >&2
-exit 0
+
+MARKER=/var/lib/mios/.wsl-firstboot-done
+
+# logger may fail if journald isn't up yet — never fatal
+_log() { logger -t mios-wsl-firstboot "$*" 2>/dev/null || true; echo "[wsl-firstboot] $*" >&2; }
+
+_log "Starting WSL2 first-boot initialization"
+
+# ── Load identity from install.env (written at bootstrap time) ──
+MIOS_USER="${MIOS_USER:-mios}"
+MIOS_USER_HASH="${MIOS_USER_PASSWORD_HASH:-}"
+MIOS_HOSTNAME="${MIOS_HOSTNAME:-mios}"
+
+if [[ -f /etc/mios/install.env ]]; then
+    # shellcheck disable=SC1091
+    source /etc/mios/install.env 2>/dev/null || true
+    MIOS_USER="${MIOS_USER:-mios}"
+    MIOS_USER_HASH="${MIOS_USER_PASSWORD_HASH:-$MIOS_USER_HASH}"
+    MIOS_HOSTNAME="${MIOS_HOSTNAME:-mios}"
+fi
+
+# ── Hostname ──
+if [[ -n "$MIOS_HOSTNAME" ]] && command -v hostnamectl &>/dev/null; then
+    hostnamectl set-hostname "$MIOS_HOSTNAME" 2>/dev/null || true
+    _log "Hostname set to $MIOS_HOSTNAME"
+fi
+
+# ── User creation ──
+if ! id "$MIOS_USER" &>/dev/null; then
+    _log "Creating user $MIOS_USER"
+    # Apply sysusers to get declarative user definitions
+    systemd-sysusers 2>/dev/null || true
+
+    if ! id "$MIOS_USER" &>/dev/null; then
+        # Fallback imperative creation if sysusers didn't create the user
+        useradd -m -s /bin/bash -G wheel "$MIOS_USER" 2>/dev/null || true
+    fi
+fi
+
+# ── Home directory ──
+if id "$MIOS_USER" &>/dev/null; then
+    _home=$(getent passwd "$MIOS_USER" | cut -d: -f6)
+    if [[ -n "$_home" && ! -d "$_home" ]]; then
+        mkdir -p "$_home"
+        cp -a /etc/skel/. "$_home/" 2>/dev/null || true
+    fi
+    if [[ -n "$_home" && -d "$_home" ]]; then
+        _uid=$(id -u "$MIOS_USER"); _gid=$(id -g "$MIOS_USER")
+        chown -R "${_uid}:${_gid}" "$_home" 2>/dev/null || true
+    fi
+    # Unlock account
+    passwd -u "$MIOS_USER" 2>/dev/null || true
+fi
+
+# ── Password hash ──
+if [[ -n "$MIOS_USER_HASH" ]] && id "$MIOS_USER" &>/dev/null; then
+    if [[ "$MIOS_USER_HASH" =~ ^\$6\$ ]]; then
+        _log "Setting password hash for $MIOS_USER"
+        echo "${MIOS_USER}:${MIOS_USER_HASH}" | chpasswd -e 2>/dev/null || true
+    else
+        _log "WARN: MIOS_USER_PASSWORD_HASH is not a valid sha512crypt hash (must start with \$6\$)"
+    fi
+else
+    _log "WARN: No password hash found — $MIOS_USER will require password reset"
+fi
+
+# ── Tmpfiles for /var/lib/mios ──
+if [[ -f /usr/lib/tmpfiles.d/mios.conf ]]; then
+    systemd-tmpfiles --create /usr/lib/tmpfiles.d/mios.conf 2>/dev/null || true
+fi
+
+# ── Mark done ──
+mkdir -p "$(dirname "$MARKER")"
+touch "$MARKER"
+_log "WSL2 first-boot initialization complete"
diff --git a/usr/libexec/mios/wsl-init b/usr/libexec/mios/wsl-init
@@ -1,8 +1,19 @@
 #!/usr/bin/env bash
-# MiOS v0.2.0 — stub: wsl-init
-# Implementation expected from bootstrap overlay or future automation script.
-# Override by dropping a real executable at: /usr/libexec/mios/wsl-init
+# MiOS — wsl-init: WSL2 runtime bridge (runs every boot).
 set -euo pipefail
-logger -t mios "[wsl-init] stub executed — replace with real implementation"
-echo "[mios/wsl-init] stub: no-op" >&2
-exit 0
+
+_log() { logger -t mios-wsl-init "$*" 2>/dev/null || true; echo "[wsl-init] $*" >&2; }
+
+_log "WSL2 runtime bridge starting"
+
+# Ensure /var/lib/mios runtime dirs exist
+if [[ -f /usr/lib/tmpfiles.d/mios.conf ]]; then
+    systemd-tmpfiles --create /usr/lib/tmpfiles.d/mios.conf 2>/dev/null || true
+fi
+
+# Expose /mnt/wslg socket for GUI apps if WSLg is present
+if [[ -d /mnt/wslg && ! -e /tmp/.X11-unix ]]; then
+    ln -sf /mnt/wslg/.X11-unix /tmp/.X11-unix 2>/dev/null || true
+fi
+
+_log "WSL2 runtime bridge complete"

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+[Unit]`
	`2`	`+ConditionVirtualization=!wsl`