The iGPU on the Proxmox host (UHD 630, 8086:3e91) is bound to vfio-pci and
will be passed through to this VM, so the guest's i915 needs the GuC/HuC
blobs (intel-gpu-firmware) and iHD VA-API decode (libva-intel-media-driver).
Both are upstream common.yaml entries that the trim list was dropping; iris
(mesa-dri-drivers) and i915 (kernel-modules) are already present.
base-atomic ships mesa-dri-drivers (the virtio_gpu Gallium driver) but not
mesa-libEGL, and with recommends off nothing pulls it in. mutter/gnome-shell
only require libglvnd's EGL dispatcher, which then has no Mesa backend, so the
session falls back to llvmpipe software rendering. Add mesa-libEGL explicitly
so the host iGPU is used under Proxmox's VirGL/virtio-gpu display.
Per-user Flatpaks are only visible to the account that logged in first (and
consumed space per user). Install them into the system installation instead, so
every user including Kanidm accounts sees Firefox.
The minimal base (recommends off) was missing session infrastructure and one
maintained service actively broke the greeter, so RDP clients saw only a white
screen:
- add dbus-daemon: gdm-wayland-session runs it for the greeter session bus
- add systemd-pam: pam_systemd starts the per-user systemd manager
- nsswitch: shadow must include systemd so pam_unix can resolve GDM 50's
dynamic gdm-greeter user (Fedora 44 ships 'files systemd')
- mask uresourced: its resource tuning makes user@<uid>.service fail with
'Failed to spawn executor', leaving no systemd user bus for gnome-session
grdctl's interactive set-credentials reads from a controlling terminal, which a
systemd service does not have, so piping the username/password in set nothing
and GRD denied every client with 'Credentials are not set'. Pass them as
arguments instead.
grd-firstboot aborts before enabling RDP because it shells out to openssl to
generate the TLS certificate, and the minimal image did not include the openssl
CLI. Add it. Also enable sshd so the headless host is reachable without RDP.
- Move Kanidm/flatpak/finalize.d/sshd files to images/shared/{files,repos}
and have build.sh overlay them for every image.
- fedora-remote: aggressive hardware trim (no firmware, no kernel-modules-extra,
no non-QEMU guest agents), keep + enable qemu-guest-agent (Proxmox).
- Fixes the missing package-list (release step) for fedora-remote.
New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.
Misthios