Speed up guest cold boot

[bchalios]

What

Trims guest boot time so a filesystem-only (reboot) resume comes up fast. Applies to newly built templates only. Locally ~9.5 s → ~0.5 s on a 1-vCPU sandbox (warm cache).

• envd.service: start envd as early as possible — DefaultDependencies=no, ordered only after systemd-journald.socket + systemd-remount-fs (was After=multi-user.target); seed the /etc/ssl/certs tmpfs from a build-time tar (one sequential read instead of ~150 scattered ones); exec envd directly instead of via bash -l -c.
• provision.sh: mask chrony-wait (the ~8 s multi-user.target gate), systemd-binfmt (~1 s early-boot CPU + bimodal tail on 1 vCPU), and e2scrub_reap (LVM-only); pre-pack the CA certs into the tar consumed by envd.service; add makestep 1.0 3 to chrony.

Why

For fs-only snapshots, resume cold-boots a fresh VM from the rootfs, so guest boot time is the resume latency. The original boot was dominated by envd.service waiting on multi-user.target, which chrony-wait held for ~8 s on the first clock sync; systemd-binfmt and the scattered cert reads added more. Starting envd off the critical path and dropping
the boot-time clock gate removes most of it. Since chrony-wait no longer blocks boot, makestep 1.0 3 ensures the clock is still hard-corrected fast in the background (TLS validation depends on a correct clock) without jumping it backward under a running workload.

How

envd starts off multi-user.target and only orders after journald's socket + a writable rootfs (networking is configured by the kernel ip= before userspace); shutdown ordering is preserved explicitly (Conflicts/Before=shutdown.target). The cert tmpfs is seeded from /usr/local/share/e2b/ssl-certs.tar packed during provisioning, with fallbacks to copying
the cert dir and then regenerating the bundle. The masked units are inert in the sandbox. chrony still syncs in the background; makestep only steps (vs slews) when the offset exceeds 1 s, for the first 3 updates after each boot.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[cursor]

PR Summary

Medium Risk
Boot ordering, TLS trust-store, and time-sync behavior change for all new templates; mitigations rely on early envd plus /init CA install and chrony makestep, with a documented gap for TLS egress before /init.

Overview
Shortens filesystem-only cold boot by starting envd much earlier and avoiding slow boot gates and scattered cert I/O on newly built templates.

envd.service no longer waits on multi-user.target; it uses DefaultDependencies=no and starts after journald’s socket and a writable rootfs. ExecStartPre bind-mounts a tmpfs at /etc/ssl/certs and seeds it from /usr/local/share/e2b/ssl-certs.tar (with copy/regenerate fallbacks) so cold boot skips update-ca-certificates. ExecStart runs /usr/bin/envd directly instead of via login shell.

provision.sh masks chrony-wait, systemd-binfmt, and e2scrub_reap, and adds makestep 1.0 3 to chrony so the clock can jump quickly after boot without blocking on first sync.

Template finalize runs a new packCertBundle guest step after configure/start/ready: regenerate the trust store and write ssl-certs.tar. Finalize layer cache hashing now includes that command (and configure script content).

envd cacerts docs clarify that tar-seeded boot does not merge persisted egress-proxy CAs; POST /init reinstalls the current proxy CA before the sandbox is routable.

^{Reviewed by Cursor Bugbot for commit e5d0901. Bugbot is set up for automated code reviews on this repo. Configure here.}

[gemini-code-assist]

Code Review

In packages/orchestrator/pkg/template/build/phases/base/provision.sh, packing /etc/ssl/certs with tar without the -h flag preserves symlinks pointing to /usr/share/ca-certificates/. When extracted into the tmpfs, these symlinks will still point back to the lazily-fetched rootfs, triggering scattered reads and defeating the purpose of the tmpfs optimization. Using the -h flag ensures the actual certificate contents are packed, keeping all certificate reads entirely within the tmpfs.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 29 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...or/pkg/template/build/phases/finalize/configure.go	0.00%	20 Missing ⚠️
...ator/pkg/template/build/phases/finalize/builder.go	0.00%	9 Missing ⚠️

📢 Thoughts on this report? Let us know!

[kalyazin]

Claude is telling me that we generate the bundle too early (in base phase). If a user adds some certificates in later stages, they aren't going to be included as update-ca-certificates is skipped then.

[bchalios]

You're right. I've moved this to the finalize step, so that the tar includes all the certs from base and user installed)

[djeebus]

Looks great, nice finds!

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c0aa844. Configure here.}