Quarry server cloud disks

Quarry Server QCOW2 delivers Fedora and openSUSE bootc server editions. QCOW2 is reserved for server provisioning; desktop and gaming use the installer ISO. Each core is qualified independently. Download only artifacts listed on the Quarry project page. An absent download means that core is not published.

The initial platform is x86_64 KVM/PVE with UEFI, Secure Boot disabled and unencrypted ext4. The virtual disk starts at 20 GiB. Enlarge it before boot to expand its existing root partition and filesystem automatically; workload disks are left alone.

Download the matching SHA256SUMS.txt, SHA256SUMS.sig and signing key with the disk. Verify:

echo "f1503c9a201d4f514d28947ce70660711f54439cbd41e5aaaa32712c71bf2d96  oci.thepeoples.io.pub" | sha256sum --check
cosign verify-blob --key oci.thepeoples.io.pub --insecure-ignore-tlog \
  --signature SHA256SUMS.sig SHA256SUMS.txt
sha256sum --check --ignore-missing SHA256SUMS.txt
qemu-img check quarry-server-CORE-git-COMMIT-x86_64.qcow2

Replace CORE and COMMIT with the published filename. Confirm that the QCOW2 checksum reports OK. The detached signature does not assert transparency-log inclusion. Read the qualification receipt for source OCI identity and runtime test evidence.

Import the disk as a VM boot disk, assign a unique VM UUID and attach a separate NoCloud seed. On PVE, configure its cloud-init drive, username, SSH public key, user password and networking before starting. There are no shared credentials. SSH accepts keys only, root is locked, and sudo requires the invoking user's password. Without a seed, no administrator is created.

PVE's current generator uses a deprecated scalar user field. Cloud-init 26.1 completes with a recorded deprecation warning. A custom NoCloud seed using the current users list avoids it. Future cloud-init upgrades require requalification. Explicit seeds are ISO9660 volumes labelled CIDATA containing user-data, meta-data and network-config; give each VM a unique instance ID. Keep seeds and password hashes private.

For custom static networking, specify the default route as 0.0.0.0/0; openSUSE's native renderer rejects the default shorthand. Provisioning examples, including the static network configuration, are in the repository's docs/examples/nocloud/ directory. Verify that the active address is static after provisioning.

Provisioning covers identity, SSH keys, users, networking and timezone. Package installation, arbitrary scripts, runcmd, disk formatting and cloud-init mounts are outside the contract. Host dependencies are image-managed. Ordinary installer deployments remain outside cloud provisioning when a seed is attached.

Use quarry update, quarry status and quarry rollback for the image lifecycle. Accounts and application data persist; OS rollback does not roll back application data. The rootless container host is opt-in: sudo quarry feature enable container-host --user YOUR_USER. Query or reverse it with status and disable. Use an exclusive non-root workload account and preserve its IDs and subordinate-ID ranges.

The release SBOM inventories native RPMs. Scanner coverage is reported separately: Trivy 0.73 does not support Fedora OS vulnerability matching, and standalone binaries need separate inventory. A zero finding count without matching coverage is not evidence of a clean image. Read the release scan and qualification evidence before deployment.