# naros-vm headless tier — bootable base + systemd (NAROS.md §7.4, milestone N4).
#
# The VM boots the naros base userspace with **systemd as PID 1** (§5: the VM flavor keeps
# systemd). This list is deliberately just the bootable minimum: the base utility set plus
# systemd/udev. Everything Nucleic-specific beyond the base layer — the vsock agent, the
# `agent` sudoers, and (N5) the GNOME 50 desktop stack — arrives at FIRSTBOOT via
# `apt install naros-tier-vm` (§7.4), NOT baked here.
#
# No linux-image: the VM boots an externally-sourced kernel + initrd whose matching modules
# ride the two-phase payload (LINUX_VM.md; the kernel/initrd flow is a narOS non-goal to
# change). A Debian kernel here would drag a whole second linux-image.
ca-certificates
curl
git
openssh-client
iproute2
# systemd as PID 1 + the networking/udev a bootable guest needs to reach the hosted apt
# repo at firstboot. dbus/sudo are pulled in by naros-tier-vm, not baked.
systemd
systemd-sysv
systemd-resolved
udev
# kmod (depmod/modprobe) is required even though no linux-image is. --variant=apt installs only
# essential+apt, so priority:important packages like kmod are absent, and udev pulls libkmod2 (the
# library) but not the binaries. The external kernel's modules ride in on the two-phase payload with
# no modules.dep, so nucleic-modsetup runs `depmod` + `modprobe vmw_vsock_virtio_transport` on every
# boot to make them loadable — and modern Ubuntu kernels ship vsock as a MODULE. Without kmod that
# unit is silently inert (every command "not found", swallowed by its `|| true`), vsock never loads,
# and the guest agent cannot bind AF_VSOCK: the guest boots to a login prompt and the host times out
# waiting for a ping.
kmod
