alpine-fleet 0.1.0__tar.gz

alpine_fleet-0.1.0/.gitignore

@@ -0,0 +1,29 @@
+*.pem
+*.key
+id_rsa*
+id_ed25519*
+!*.pub
+.env
+*.log
+
+# personal, tenancy-specific reference material — never commit these
+scratch/*
+!scratch/README.md
+
+state/
+cache/
+__pycache__/
+
+# packaging
+dist/
+build/
+*.egg-info/
+__pycache__/
+
+# gitship internal state (auto-added by gitship)
+.gitship/
+
+# gitship diff exports (auto-added by gitship)
+gitship_exports/
+
+# Auto-generated license files

alpine_fleet-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Patrick Ryan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

alpine_fleet-0.1.0/PKG-INFO

@@ -0,0 +1,153 @@
+Metadata-Version: 2.5
+Name: alpine-fleet
+Version: 0.1.0
+Summary: Declaratively and repeatably turn a disposable OCI E2.1.Micro VM into a lightweight, hardened Alpine Linux machine via kexec.
+Project-URL: Homepage, https://github.patrickryankenneth.com/patrickryankenneth/alpine-fleet
+Project-URL: Issues, https://github.com/patrickryankenneth/alpine-fleet/issues
+Author-email: Patrick Ryan <patrickryankenneth@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+License-File: THIRD_PARTY_NOTICES.txt
+License-File: licenses/oci-cli.txt
+License-File: licenses/pexpect.txt
+License-File: licenses/ptyprocess.txt
+Keywords: alpine,free-tier,kexec,oci,oracle-cloud,provisioning
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Installation/Setup
+Requires-Python: >=3.9
+Requires-Dist: pexpect>=4.8
+Provides-Extra: oci
+Requires-Dist: oci-cli; extra == 'oci'
+Description-Content-Type: text/markdown
+
+# 🏔️ alpine-fleet
+
+> Give me a disposable OCI micro VM, and I will deterministically and declaratively turn it into a lightweight, hardened Alpine machine.
+
+`alpine-fleet` converts an Oracle Cloud (OCI) **VM.Standard.E2.1.Micro** instance from the stock Oracle Linux image into a minimal **Alpine Linux** install with **key-only root SSH** (no password). Once your OCI CLI is configured, a run is hands-off: it launches the instance, jumps it into Alpine with `kexec`, installs Alpine to the boot disk over the serial console, locks down SSH, and verifies the result. Proven on the E2.1.Micro across 50+ end-to-end runs.
+
+> ⚠️ **Destructive operation**
+> This project installs Alpine onto `/dev/sda` and **replaces the existing operating system**. The orchestrator confirms the installer's "erase disk" prompt automatically. Use it only on disposable or recoverable instances.
+
+```bash
+pipx install 'alpine-fleet[oci]'
+alpine-fleet doctor          # checks your host, prints the install command for anything missing
+alpine-fleet up              # launch (if needed), convert, harden, verify
+```
+
+## 📊 Why do this? (The RAM Vampire)
+
+The E2.1.Micro free-tier instance has 1 GB of RAM, so what the OS itself uses matters. Measured on OCI PHX over five runs:
+
+| Metric | Stock Oracle Linux 7.9 | Alpine Linux 3.24 |
+| :--- | :--- | :--- |
+| **RAM available to workloads** | 288–316 MB | **778–792 MB** |
+| **In use (total − available)** | 351–379 MB | **167–181 MB** |
+| **Total the kernel reports** | 668 MB | 960 MB |
+
+That is **+472 to +500 MB (2.5–2.7×)** more usable RAM.
+
+The stock boot reports `crashkernel=auto` and exposes noticeably less memory to the running system than Alpine's kernel does (this project did not measure exactly how much of that difference is the crash-kernel reservation). The rest of the improvement comes from Alpine's much smaller userspace. A full automated run takes about **315–337 seconds**.
+
+## 🛠️ Install and requirements
+
+```bash
+pipx install 'alpine-fleet[oci]'     # or: pip install 'alpine-fleet[oci]'
+alpine-fleet doctor                  # add --fix to be offered the install command
+```
+
+pip cannot install system packages, so `doctor` checks them for you (Python 3.9+; Linux, macOS or WSL; native Windows is not supported).
+
+| Tool | Needed for | How to get it |
+| :--- | :--- | :--- |
+| **OCI CLI** | Launch, teardown, capacity discovery | Installed by the `[oci]` extra, then run `oci setup config` |
+| **`jq`** | JSON handling in the shell scripts | `pacman -S jq`, `apt install jq`, `dnf install jq`, `brew install jq` |
+| **OpenSSH** (`ssh`, `scp`, `ssh-keygen`) | Remote staging and serial tunneling | System package (`openssh-client` on Debian/Ubuntu) |
+| **bash 4+** | The shell scripts | macOS ships 3.2: `brew install bash` |
+| **`podman`** or **`docker`** *(optional)* | `alpine-fleet cache` (faster runs) | System package manager |
+
+You also need free E2.1.Micro capacity in your OCI region, a VCN with a public subnet, and an SSH keypair (default public key: `~/.ssh/id_ed25519.pub`, and its private key must be your default SSH identity).
+
+The OCI serial console proxy requires an **RSA** key (Ed25519 is rejected), by default `~/.ssh/oci-console-rsa`. If you don't have one:
+
+```bash
+ssh-keygen -t rsa -b 4096 -f ~/.ssh/oci-console-rsa -N ''
+```
+
+Working from a checkout instead: `pip install -e '.[oci]'`.
+
+## 🚀 Usage
+
+| Command | What it does |
+| :--- | :--- |
+| `alpine-fleet doctor [--fix]` | Check host requirements; print the install command for anything missing. |
+| `alpine-fleet discover` | Show E2.1.Micro and A1.Flex headroom per availability domain, discovered dynamically. |
+| `alpine-fleet up [--yes] [--debug] [--no-launch]` | Launch an instance if none is running (retries until capacity appears), then convert, harden and verify. Prints phase timings and a RAM comparison, and ends with the `ssh root@<ip>` command. |
+| `alpine-fleet convert USER@IP INSTANCE_OCID` | Convert an existing instance. You must type its address to confirm (or pass `--yes`). |
+| `alpine-fleet down [--yes]` | Terminate the instance recorded in the state file. |
+| `alpine-fleet cache [--force]` | Build the Oracle Linux 7 `kexec` binary cache in a container (skips installing `kexec-tools` on the target). |
+
+`up` and `convert` also accept `--alpine-version` (default `v3.24`), `--ssh-pubkey`, `--console-key` and `--answerfile`.
+
+Every run detects where the box is (stock OS, Alpine in RAM, or installed) and resumes from there, so an interrupted run can simply be repeated.
+
+**Where things live.** Instance state and serial transcripts (instance IDs and IPs) are in `~/.local/state/alpine-fleet/`; the kexec cache is in `~/.cache/alpine-fleet/kexec/`. Nothing is written to the install directory.
+
+**Environment overrides.**
+
+| Variable | Effect |
+| :--- | :--- |
+| `SUBNET_ID`, `IMAGE_ID`, `COMPARTMENT_ID` | Override auto-discovery (default: first subnet found, newest compatible Oracle Linux image, tenancy root compartment). |
+| `DISPLAY_NAME`, `SSH_KEY_FILE` | Instance name and the public key given to the stock image's `opc` user. |
+| `OCI_BIN`, `OCI_CONFIG_FILE` | Use a specific `oci` binary or config file. |
+| `ALPINE_FLEET_STATE_DIR`, `KEXEC_CACHE` | Relocate state and cache. |
+| `NO_KEXEC_CACHE=1` | Ignore the cache and install `kexec-tools` on the target. |
+
+## ⚠️ Before you run it
+
+**This project is intentionally destructive.** The answerfile installs to `/dev/sda` and replaces the existing operating system. Do not run it against a VM that holds data you need. The orchestrator waits for the installer's erase prompt and confirms it, but it does *not* check which disk the prompt names.
+
+The `kexec` transition is also disruptive: **SSH to the stock OS disappears the moment the new kernel takes over.** That is expected. The orchestrator treats the lost connection as a state transition and continues through the serial console.
+
+## ⚙️ How it works
+
+1. **Launch:** Provisions an E2.1.Micro in an availability domain with headroom and opens a serial console connection.
+2. **Stage:** Connects over SSH. Copies the cached `kexec` (or installs `kexec-tools` on the target if there is no cache), downloads the Alpine netboot kernel and initramfs in parallel, and loads them with `kexec -l`.
+3. **Jump:** Triggers `kexec -e`. Alpine boots into RAM and downloads its ~290 MB module image from the Alpine mirror; that download's speed varies from run to run.
+4. **Install:** Over the serial console: logs in, pushes your public key, starts `sshd`, pushes the answerfile (chunked base64) to `/root/answers`, and runs `setup-alpine -e -f /root/answers`. The root password prompt is bypassed with `-e`.
+5. **Reboot:** Reboots off the physical block volume onto the installed disk.
+6. **Harden and verify:** Root's password field is set to `*`, `PermitRootLogin prohibit-password` and `PasswordAuthentication no` are written to `sshd_config`, and a fresh key-only login is tested (retried while `sshd` settles). If that login is refused, the hardening changes (`sshd_config` and root's shadow entry) are **rolled back** through a session held open across the change, and `sshd`'s log is printed.
+
+### 🚨 The `*` versus `!` gotcha
+
+BusyBox `passwd -l` writes a `!`-prefixed hash. Alpine's `sshd` is built without PAM, and without PAM, OpenSSH treats a `!` hash as a locked account and refuses **public-key** logins too. Setting the field to `*` blocks password logins but still allows SSH keys. *Use `*`.*
+
+## 🚧 Known limits
+
+- **Provider support: OCI only, tested on VM.Standard.E2.1.Micro only.** The bundled answerfile assumes `/dev/sda` and performs a destructive disk install. Other clouds, images and shapes need their own disk and device handling.
+- The free tier allows two E2.1.Micro instances; `up` stops if two are already running.
+- The `kexec` cache applies to the stock **Oracle Linux 7** image. Any other image misses the cache and falls back to installing `kexec-tools` on the target, which is much slower.
+- Root ends key-only with no password. If your private key is lost, you must rebuild the instance.
+- Boot time depends on the mirror; the orchestrator waits up to 10 minutes for the Alpine login prompt.
+- macOS hosts need bash 4+ (see above) and have not been tested.
+
+## 📂 Repository layout
+
+```text
+src/alpine_fleet/
+  cli.py, doctor.py, paths.py   the `alpine-fleet` command
+  scripts/                      orchestrate.py, bootstrap.sh, launch/teardown/discover/console helpers, lib/
+  answerfiles/                  setup-alpine answerfile for the OCI micro
+licenses/, THIRD_PARTY_NOTICES.txt
+```
+
+`scripts/e2e-test.sh` (a destructive full-cycle test) lives in the repo only and is not shipped in the wheel.
+
+## 📄 License
+
+MIT. Third-party notices are in `THIRD_PARTY_NOTICES.txt` and `licenses/`. The `kexec` binary in the cache is built locally from Oracle's own package and is never distributed with this project.

alpine_fleet-0.1.0/README.md

@@ -0,0 +1,126 @@
+# 🏔️ alpine-fleet
+
+> Give me a disposable OCI micro VM, and I will deterministically and declaratively turn it into a lightweight, hardened Alpine machine.
+
+`alpine-fleet` converts an Oracle Cloud (OCI) **VM.Standard.E2.1.Micro** instance from the stock Oracle Linux image into a minimal **Alpine Linux** install with **key-only root SSH** (no password). Once your OCI CLI is configured, a run is hands-off: it launches the instance, jumps it into Alpine with `kexec`, installs Alpine to the boot disk over the serial console, locks down SSH, and verifies the result. Proven on the E2.1.Micro across 50+ end-to-end runs.
+
+> ⚠️ **Destructive operation**
+> This project installs Alpine onto `/dev/sda` and **replaces the existing operating system**. The orchestrator confirms the installer's "erase disk" prompt automatically. Use it only on disposable or recoverable instances.
+
+```bash
+pipx install 'alpine-fleet[oci]'
+alpine-fleet doctor          # checks your host, prints the install command for anything missing
+alpine-fleet up              # launch (if needed), convert, harden, verify
+```
+
+## 📊 Why do this? (The RAM Vampire)
+
+The E2.1.Micro free-tier instance has 1 GB of RAM, so what the OS itself uses matters. Measured on OCI PHX over five runs:
+
+| Metric | Stock Oracle Linux 7.9 | Alpine Linux 3.24 |
+| :--- | :--- | :--- |
+| **RAM available to workloads** | 288–316 MB | **778–792 MB** |
+| **In use (total − available)** | 351–379 MB | **167–181 MB** |
+| **Total the kernel reports** | 668 MB | 960 MB |
+
+That is **+472 to +500 MB (2.5–2.7×)** more usable RAM.
+
+The stock boot reports `crashkernel=auto` and exposes noticeably less memory to the running system than Alpine's kernel does (this project did not measure exactly how much of that difference is the crash-kernel reservation). The rest of the improvement comes from Alpine's much smaller userspace. A full automated run takes about **315–337 seconds**.
+
+## 🛠️ Install and requirements
+
+```bash
+pipx install 'alpine-fleet[oci]'     # or: pip install 'alpine-fleet[oci]'
+alpine-fleet doctor                  # add --fix to be offered the install command
+```
+
+pip cannot install system packages, so `doctor` checks them for you (Python 3.9+; Linux, macOS or WSL; native Windows is not supported).
+
+| Tool | Needed for | How to get it |
+| :--- | :--- | :--- |
+| **OCI CLI** | Launch, teardown, capacity discovery | Installed by the `[oci]` extra, then run `oci setup config` |
+| **`jq`** | JSON handling in the shell scripts | `pacman -S jq`, `apt install jq`, `dnf install jq`, `brew install jq` |
+| **OpenSSH** (`ssh`, `scp`, `ssh-keygen`) | Remote staging and serial tunneling | System package (`openssh-client` on Debian/Ubuntu) |
+| **bash 4+** | The shell scripts | macOS ships 3.2: `brew install bash` |
+| **`podman`** or **`docker`** *(optional)* | `alpine-fleet cache` (faster runs) | System package manager |
+
+You also need free E2.1.Micro capacity in your OCI region, a VCN with a public subnet, and an SSH keypair (default public key: `~/.ssh/id_ed25519.pub`, and its private key must be your default SSH identity).
+
+The OCI serial console proxy requires an **RSA** key (Ed25519 is rejected), by default `~/.ssh/oci-console-rsa`. If you don't have one:
+
+```bash
+ssh-keygen -t rsa -b 4096 -f ~/.ssh/oci-console-rsa -N ''
+```
+
+Working from a checkout instead: `pip install -e '.[oci]'`.
+
+## 🚀 Usage
+
+| Command | What it does |
+| :--- | :--- |
+| `alpine-fleet doctor [--fix]` | Check host requirements; print the install command for anything missing. |
+| `alpine-fleet discover` | Show E2.1.Micro and A1.Flex headroom per availability domain, discovered dynamically. |
+| `alpine-fleet up [--yes] [--debug] [--no-launch]` | Launch an instance if none is running (retries until capacity appears), then convert, harden and verify. Prints phase timings and a RAM comparison, and ends with the `ssh root@<ip>` command. |
+| `alpine-fleet convert USER@IP INSTANCE_OCID` | Convert an existing instance. You must type its address to confirm (or pass `--yes`). |
+| `alpine-fleet down [--yes]` | Terminate the instance recorded in the state file. |
+| `alpine-fleet cache [--force]` | Build the Oracle Linux 7 `kexec` binary cache in a container (skips installing `kexec-tools` on the target). |
+
+`up` and `convert` also accept `--alpine-version` (default `v3.24`), `--ssh-pubkey`, `--console-key` and `--answerfile`.
+
+Every run detects where the box is (stock OS, Alpine in RAM, or installed) and resumes from there, so an interrupted run can simply be repeated.
+
+**Where things live.** Instance state and serial transcripts (instance IDs and IPs) are in `~/.local/state/alpine-fleet/`; the kexec cache is in `~/.cache/alpine-fleet/kexec/`. Nothing is written to the install directory.
+
+**Environment overrides.**
+
+| Variable | Effect |
+| :--- | :--- |
+| `SUBNET_ID`, `IMAGE_ID`, `COMPARTMENT_ID` | Override auto-discovery (default: first subnet found, newest compatible Oracle Linux image, tenancy root compartment). |
+| `DISPLAY_NAME`, `SSH_KEY_FILE` | Instance name and the public key given to the stock image's `opc` user. |
+| `OCI_BIN`, `OCI_CONFIG_FILE` | Use a specific `oci` binary or config file. |
+| `ALPINE_FLEET_STATE_DIR`, `KEXEC_CACHE` | Relocate state and cache. |
+| `NO_KEXEC_CACHE=1` | Ignore the cache and install `kexec-tools` on the target. |
+
+## ⚠️ Before you run it
+
+**This project is intentionally destructive.** The answerfile installs to `/dev/sda` and replaces the existing operating system. Do not run it against a VM that holds data you need. The orchestrator waits for the installer's erase prompt and confirms it, but it does *not* check which disk the prompt names.
+
+The `kexec` transition is also disruptive: **SSH to the stock OS disappears the moment the new kernel takes over.** That is expected. The orchestrator treats the lost connection as a state transition and continues through the serial console.
+
+## ⚙️ How it works
+
+1. **Launch:** Provisions an E2.1.Micro in an availability domain with headroom and opens a serial console connection.
+2. **Stage:** Connects over SSH. Copies the cached `kexec` (or installs `kexec-tools` on the target if there is no cache), downloads the Alpine netboot kernel and initramfs in parallel, and loads them with `kexec -l`.
+3. **Jump:** Triggers `kexec -e`. Alpine boots into RAM and downloads its ~290 MB module image from the Alpine mirror; that download's speed varies from run to run.
+4. **Install:** Over the serial console: logs in, pushes your public key, starts `sshd`, pushes the answerfile (chunked base64) to `/root/answers`, and runs `setup-alpine -e -f /root/answers`. The root password prompt is bypassed with `-e`.
+5. **Reboot:** Reboots off the physical block volume onto the installed disk.
+6. **Harden and verify:** Root's password field is set to `*`, `PermitRootLogin prohibit-password` and `PasswordAuthentication no` are written to `sshd_config`, and a fresh key-only login is tested (retried while `sshd` settles). If that login is refused, the hardening changes (`sshd_config` and root's shadow entry) are **rolled back** through a session held open across the change, and `sshd`'s log is printed.
+
+### 🚨 The `*` versus `!` gotcha
+
+BusyBox `passwd -l` writes a `!`-prefixed hash. Alpine's `sshd` is built without PAM, and without PAM, OpenSSH treats a `!` hash as a locked account and refuses **public-key** logins too. Setting the field to `*` blocks password logins but still allows SSH keys. *Use `*`.*
+
+## 🚧 Known limits
+
+- **Provider support: OCI only, tested on VM.Standard.E2.1.Micro only.** The bundled answerfile assumes `/dev/sda` and performs a destructive disk install. Other clouds, images and shapes need their own disk and device handling.
+- The free tier allows two E2.1.Micro instances; `up` stops if two are already running.
+- The `kexec` cache applies to the stock **Oracle Linux 7** image. Any other image misses the cache and falls back to installing `kexec-tools` on the target, which is much slower.
+- Root ends key-only with no password. If your private key is lost, you must rebuild the instance.
+- Boot time depends on the mirror; the orchestrator waits up to 10 minutes for the Alpine login prompt.
+- macOS hosts need bash 4+ (see above) and have not been tested.
+
+## 📂 Repository layout
+
+```text
+src/alpine_fleet/
+  cli.py, doctor.py, paths.py   the `alpine-fleet` command
+  scripts/                      orchestrate.py, bootstrap.sh, launch/teardown/discover/console helpers, lib/
+  answerfiles/                  setup-alpine answerfile for the OCI micro
+licenses/, THIRD_PARTY_NOTICES.txt
+```
+
+`scripts/e2e-test.sh` (a destructive full-cycle test) lives in the repo only and is not shipped in the wheel.
+
+## 📄 License
+
+MIT. Third-party notices are in `THIRD_PARTY_NOTICES.txt` and `licenses/`. The `kexec` binary in the cache is built locally from Oracle's own package and is never distributed with this project.

alpine_fleet-0.1.0/THIRD_PARTY_NOTICES.txt

@@ -0,0 +1,15 @@
+alpine-fleet includes the following third-party software:
+================================================================================
+
+oci-cli (v3.90.2)
+License: Universal Permissive License 1.0 or Apache License 2.0
+See licenses/oci-cli.txt for full license text
+
+pexpect (v4.9.0)
+License: ISC license
+See licenses/pexpect.txt for full license text
+
+ptyprocess (v0.7.0)
+License: ISC
+See licenses/ptyprocess.txt for full license text
+

alpine_fleet-0.1.0/licenses/oci-cli.txt

@@ -0,0 +1,82 @@
+Copyright (c) 2016, 2026, Oracle and/or its affiliates.  All rights reserved.
+This software is dual-licensed to you under the Universal Permissive License (UPL) 1.0 as shown at https://oss.oracle.com/licenses/upl or Apache License 2.0 as shown at http://www.apache.org/licenses/LICENSE-2.0. You may choose either license.
+
+ ____________________________
+The Universal Permissive License (UPL), Version 1.0
+Copyright (c) 2016, 2026, Oracle and/or its affiliates.  All rights reserved.
+
+Subject to the condition set forth below, permission is hereby granted to any person obtaining a copy of this software, associated documentation and/or data (collectively the "Software"), free of charge and under any and all copyright rights in the Software, and any and all patent rights owned or freely licensable by each licensor hereunder covering either (i) the unmodified Software as contributed to or provided by such licensor, or (ii) the Larger Works (as defined below), to deal in both
+
+(a) the Software, and
+(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if one is included with the Software (each a "Larger Work" to which the Software is contributed by such licensors),
+
+without restriction, including without limitation the rights to copy, create derivative works of, display, perform, and distribute the Software and make, use, sell, offer for sale, import, export, have made, and have sold the Software and the Larger Work(s), and to sublicense the foregoing rights on either these or other terms.
+
+This license is subject to the following condition:
+
+The above copyright notice and either this complete permission notice or at a minimum a reference to the UPL must be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+The Apache Software License, Version 2.0
+Copyright (c) 2016, 2026, Oracle and/or its affiliates.  All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License"); You may not use this product except in compliance with the License.  You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.  A copy of the license is also reproduced below.  Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and  limitations under the License.
+
+Apache License
+
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+1. Definitions.
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+You must give any other recipients of the Work or Derivative Works a copy of this License; and
+You must cause any modified files to carry prominent notices stating that You changed the files; and
+You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

alpine_fleet-0.1.0/licenses/pexpect.txt

@@ -0,0 +1,20 @@
+ISC LICENSE
+
+    This license is approved by the OSI and FSF as GPL-compatible.
+        http://opensource.org/licenses/isc-license.txt
+
+    Copyright (c) 2013-2014, Pexpect development team
+    Copyright (c) 2012, Noah Spurrier <noah@noah.org>
+
+    Permission to use, copy, modify, and/or distribute this software for any
+    purpose with or without fee is hereby granted, provided that the above
+    copyright notice and this permission notice appear in all copies.
+    
+    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+

alpine_fleet-0.1.0/licenses/ptyprocess.txt

@@ -0,0 +1,16 @@
+Ptyprocess is under the ISC license, as code derived from Pexpect.
+    http://opensource.org/licenses/ISC
+
+Copyright (c) 2013-2014, Pexpect development team
+Copyright (c) 2012, Noah Spurrier <noah@noah.org>
+
+PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY PURPOSE
+WITH OR WITHOUT FEE IS HEREBY GRANTED, PROVIDED THAT THE ABOVE COPYRIGHT NOTICE
+AND THIS PERMISSION NOTICE APPEAR IN ALL COPIES. THE SOFTWARE IS PROVIDED
+"AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE
+INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT
+SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
+OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+

alpine_fleet-0.1.0/pyproject.toml

@@ -0,0 +1,44 @@
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "alpine-fleet"
+dynamic = ["version"]
+description = "Declaratively and repeatably turn a disposable OCI E2.1.Micro VM into a lightweight, hardened Alpine Linux machine via kexec."
+readme = "README.md"
+requires-python = ">=3.9"
+authors = [{ name = "Patrick Ryan", email = "patrickryankenneth@gmail.com" }]
+license = "MIT"                                
+license-files = ["LICENSE", "licenses/*", "THIRD_PARTY_NOTICES.txt"]
+keywords = ["alpine", "oci", "oracle-cloud", "kexec", "free-tier", "provisioning"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Intended Audience :: System Administrators",
+  "Operating System :: POSIX :: Linux",
+  "Programming Language :: Python :: 3",
+  "Topic :: System :: Installation/Setup",
+]
+dependencies = ["pexpect>=4.8"]
+
+[project.optional-dependencies]
+oci = ["oci-cli"]
+
+[project.scripts]
+alpine-fleet = "alpine_fleet.cli:main"
+
+[tool.hatch.version]
+path = "src/alpine_fleet/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/alpine_fleet"]
+exclude = ["src/alpine_fleet/scripts/e2e-test.sh"]   # destructive dev test, stays in the repo only
+
+[tool.hatch.build.targets.sdist]
+include = ["src/alpine_fleet", "README.md", "LICENSE", "THIRD_PARTY_NOTICES.txt", "licenses", "pyproject.toml"]
+
+[project.urls]
+Homepage = "https://github.patrickryankenneth.com/patrickryankenneth/alpine-fleet"
+Issues = "https://github.com/patrickryankenneth/alpine-fleet/issues"

alpine_fleet-0.1.0/scratch/README.md

@@ -0,0 +1,23 @@
+# scratch/
+
+This folder is gitignored on purpose. It holds your personal, tenancy-specific
+scripts (real OCIDs, subnet IDs, image IDs) that you don't want committed, but
+that you're using as reference/source material while building out the
+public, parameterized versions of the same ideas under `scripts/`.
+
+Put your actual `oci_e2_retry.sh`, `oci_a1_retry.sh`, `oci_e2_launch_all.sh`,
+`oci_a1_launch_all.sh`, and their systemd units here if you want them
+version-controlled *locally* (e.g. via a private git remote, or just as
+backup) without them ever landing in the public alpine-fleet history.
+
+Ideas worth lifting from these into the public scripts:
+- Parallel per-AD retry with exponential backoff + jitter, so you don't
+  hammer a single AD and don't get rate-limited across ADs simultaneously.
+- A shared flag file (e.g. /tmp/<goal>_met) that lets sibling retry loops
+  notice a win and stop themselves — cheap coordination without a lock
+  service.
+- `wait "${PIDS[@]}"` in the launcher so the whole thing blocks cleanly
+  under `Type=simple` in systemd, exiting 0 only on real success.
+- Checking the *current* count against a goal before each attempt, not
+  just once at start — lets independent processes converge correctly
+  even if they're racing each other.

alpine_fleet-0.1.0/src/alpine_fleet/__init__.py

@@ -0,0 +1,3 @@
+"""alpine-fleet: declaratively turn a disposable OCI micro VM into a hardened Alpine machine."""
+
+__version__ = "0.1.0"

alpine_fleet-0.1.0/src/alpine_fleet/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

alpine_fleet-0.1.0/src/alpine_fleet/answerfiles/oci-e2-micro.answerfile

@@ -0,0 +1,38 @@
+# Non-interactive answerfile for `setup-alpine -f <this-file>`
+# Tuned for OCI VM.Standard.E2.1.Micro (and similar small free-tier shapes).
+#
+# Usage (from the live Alpine environment after kexec):
+#   setup-alpine -f oci-e2-micro.answerfile
+#
+# NOTE: this uses DHCP rather than a static IP + manual netmask, since
+# OCI's VCN subnets hand out DHCP correctly and it sidesteps having to
+# guess/know the subnet's real netmask (setup-alpine's default guess
+# based on IP class is very often wrong for cloud VCNs).
+
+KEYMAPOPTS="us us"
+HOSTNAMEOPTS="-n alpine-worker"
+
+INTERFACESOPTS="auto lo
+iface lo inet loopback
+
+auto eth0
+iface eth0 inet dhcp
+"
+
+# 169.254.169.254 is OCI's metadata service, which proxies DNS correctly
+# inside the VCN. Adjust for other providers.
+DNSOPTS="-d '' 169.254.169.254"
+
+TIMEZONEOPTS="-z UTC"
+PROXYOPTS="none"
+APKREPOSOPTS="-1"
+SSHDOPTS="-c openssh"
+NTPOPTS="-c chrony"
+
+# sda is OCI's boot volume device name for these shapes. Verify with
+# `lsblk` in the live environment before trusting this blindly on a
+# different provider/shape.
+DISKOPTS="-m sys /dev/sda"
+
+LBUOPTS="none"
+APKCACHEOPTS="none"