build multi-arch s9pks (#2601)

* build multi-arch s9pks * remove images incrementally * wip * prevent rebuild * fix sdk makefile * fix hanging on uninstall * fix build * fix build * fix build * fix build (for real this time) * fix git hash computation
2026-03-26 02:11:53 +00:00 · 2024-04-22 11:40:10 -06:00
parent 9eff920989
commit 003d110948
176 changed files with 1176 additions and 1799 deletions
--- a/.github/workflows/startos-iso.yaml
+++ b/.github/workflows/startos-iso.yaml
@@ -175,8 +175,10 @@ jobs:

      - name: Prevent rebuild of compiled artifacts
        run: |
+          mkdir -p web/node_modules
          mkdir -p web/dist/raw
          touch core/startos/bindings
+          touch sdk/lib/osBindings
          mkdir -p container-runtime/dist
          PLATFORM=${{ matrix.platform }} make -t compiled-${{ env.ARCH }}.tar

--- a/47
+++ b/47
@@ -9,15 +9,15 @@ IMAGE_TYPE=$(shell if [ "$(PLATFORM)" = raspberrypi ]; then echo img; else echo
 BINS := core/target/$(ARCH)-unknown-linux-musl/release/startbox core/target/$(ARCH)-unknown-linux-musl/release/containerbox
 WEB_UIS := web/dist/raw/ui web/dist/raw/setup-wizard web/dist/raw/diagnostic-ui web/dist/raw/install-wizard
 FIRMWARE_ROMS := ./firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
-BUILD_SRC := $(shell git ls-files build) build/lib/depends build/lib/conflicts container-runtime/rootfs.$(ARCH).squashfs $(FIRMWARE_ROMS)
+BUILD_SRC := $(shell git ls-files build) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
 DEBIAN_SRC := $(shell git ls-files debian/)
 IMAGE_RECIPE_SRC := $(shell git ls-files image-recipe/)
 STARTD_SRC := core/startos/startd.service $(BUILD_SRC)
 COMPAT_SRC := $(shell git ls-files system-images/compat/)
 UTILS_SRC := $(shell git ls-files system-images/utils/)
 BINFMT_SRC := $(shell git ls-files system-images/binfmt/)
-CORE_SRC := $(shell git ls-files -- core ':!:core/startos/bindings/*') $(shell git ls-files --recurse-submodules patch-db) web/dist/static web/patchdb-ui-seed.json $(GIT_HASH_FILE)
-WEB_SHARED_SRC := $(shell git ls-files web/projects/shared) $(shell ls -p web/ | grep -v / | sed 's/^/web\//g') web/node_modules web/config.json patch-db/client/dist web/patchdb-ui-seed.json
+CORE_SRC := $(shell git ls-files core) $(shell git ls-files --recurse-submodules patch-db) web/dist/static web/patchdb-ui-seed.json $(GIT_HASH_FILE)
+WEB_SHARED_SRC := $(shell git ls-files web/projects/shared) $(shell ls -p web/ | grep -v / | sed 's/^/web\//g') web/node_modules/.package-lock.json web/config.json patch-db/client/dist web/patchdb-ui-seed.json
 WEB_UI_SRC := $(shell git ls-files web/projects/ui)
 WEB_SETUP_WIZARD_SRC := $(shell git ls-files web/projects/setup-wizard)
 WEB_DIAGNOSTIC_UI_SRC := $(shell git ls-files web/projects/diagnostic-ui)
@@ -49,7 +49,7 @@ endif

 .DELETE_ON_ERROR:

-.PHONY: all metadata install clean format cli uis ui reflash deb $(IMAGE_TYPE) squashfs sudo wormhole test
+.PHONY: all metadata install clean format cli uis ui reflash deb $(IMAGE_TYPE) squashfs sudo wormhole wormhole-deb test

 all: $(ALL_TARGETS)

@@ -65,6 +65,7 @@ clean:
 	rm -f system-images/**/*.tar
 	rm -rf system-images/compat/target
 	rm -rf core/target
+	rm -rf core/startos/bindings
 	rm -rf web/.angular
 	rm -f web/config.json
 	rm -rf web/node_modules
@@ -80,8 +81,8 @@ clean:
 	rm -rf container-runtime/dist
 	rm -rf container-runtime/node_modules
 	rm -f container-runtime/*.squashfs
-	rm -rf sdk/dist
-	rm -rf sdk/node_modules
+	rm -rf container-runtime/tmp
+	(cd sdk && make clean)
 	rm -f ENVIRONMENT.txt
 	rm -f PLATFORM.txt
 	rm -f GIT_HASH.txt
@@ -92,7 +93,6 @@ format:

 test: $(CORE_SRC) $(ENVIRONMENT_FILE) 
 	(cd core && cargo build && cargo test)
-	npm --prefix sdk exec -- prettier -w ./core/startos/bindings/*.ts
 	(cd sdk && make test)

 cli:
@@ -158,6 +158,10 @@ wormhole: core/target/$(ARCH)-unknown-linux-musl/release/startbox
 	@echo "Paste the following command into the shell of your start-os server:"
 	@wormhole send core/target/$(ARCH)-unknown-linux-musl/release/startbox 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo /usr/lib/startos/scripts/chroot-and-upgrade \"cd /usr/bin && rm startbox && wormhole receive --accept-file %s && chmod +x startbox\"\n", $$3 }'

+wormhole-deb: results/$(BASENAME).deb
+	@echo "Paste the following command into the shell of your start-os server:"
+	@wormhole send results/$(BASENAME).deb 2>&1 | awk -Winteractive '/wormhole receive/ { printf "sudo /usr/lib/startos/scripts/chroot-and-upgrade '"'"'cd $$(mktemp -d) && wormhole receive --accept-file %s && apt-get install -y --reinstall ./$(BASENAME).deb'"'"'\n", $$3 }'
+
 update: $(ALL_TARGETS)
 	@if [ -z "$(REMOTE)" ]; then >&2 echo "Must specify REMOTE" && false; fi
 	$(call ssh,"sudo rsync -a --delete --force --info=progress2 /media/embassy/embassyfs/current/ /media/embassy/next/")
@@ -180,13 +184,19 @@ container-runtime/node_modules: container-runtime/package.json container-runtime
 	npm --prefix container-runtime ci
 	touch container-runtime/node_modules

-core/startos/bindings: $(shell git ls-files -- core ':!:core/startos/bindings/*') $(ENVIRONMENT_FILE)
-	rm -rf core/startos/bindings
-	(cd core/ && cargo test --features=test)
+sdk/lib/osBindings: core/startos/bindings
+	mkdir -p sdk/lib/osBindings
 	ls core/startos/bindings/*.ts | sed 's/core\/startos\/bindings\/\([^.]*\)\.ts/export { \1 } from ".\/\1";/g' > core/startos/bindings/index.ts
-	npm --prefix sdk exec -- prettier -w ./core/startos/bindings/*.ts
+	npm --prefix sdk exec -- prettier --config ./sdk/package.json -w ./core/startos/bindings/*.ts
+	rsync -ac --delete core/startos/bindings/ sdk/lib/osBindings/
+	touch sdk/lib/osBindings

-sdk/dist: $(shell git ls-files sdk) core/startos/bindings
+core/startos/bindings: $(shell git ls-files core) $(ENVIRONMENT_FILE)
+	rm -rf core/startos/bindings
+	(cd core/ && cargo test --features=test '::export_bindings_')
+	touch core/startos/bindings
+
+sdk/dist: $(shell git ls-files sdk) sdk/lib/osBindings
 	(cd sdk && make bundle)

 # TODO: make container-runtime its own makefile?
@@ -219,21 +229,25 @@ $(BINS): $(CORE_SRC) $(ENVIRONMENT_FILE)
 	cd core && ARCH=$(ARCH) ./build-prod.sh
 	touch $(BINS)

-web/node_modules: web/package.json sdk/dist
-	(cd sdk && make bundle)
+web/node_modules/.package-lock.json: web/package.json sdk/dist
 	npm --prefix web ci
+	touch web/node_modules/.package-lock.json

 web/dist/raw/ui: $(WEB_UI_SRC) $(WEB_SHARED_SRC)
 	npm --prefix web run build:ui
+	touch web/dist/raw/ui

 web/dist/raw/setup-wizard: $(WEB_SETUP_WIZARD_SRC) $(WEB_SHARED_SRC)
 	npm --prefix web run build:setup
+	touch web/dist/raw/setup-wizard

 web/dist/raw/diagnostic-ui: $(WEB_DIAGNOSTIC_UI_SRC) $(WEB_SHARED_SRC)
 	npm --prefix web run build:dui
+	touch web/dist/raw/diagnostic-ui

 web/dist/raw/install-wizard: $(WEB_INSTALL_WIZARD_SRC) $(WEB_SHARED_SRC)
 	npm --prefix web run build:install-wiz
+	touch web/dist/raw/install-wizard

 web/dist/static: $(WEB_UIS) $(ENVIRONMENT_FILE)
 	./compress-uis.sh
@@ -247,10 +261,11 @@ web/patchdb-ui-seed.json: web/package.json

 patch-db/client/node_modules: patch-db/client/package.json
 	npm --prefix patch-db/client ci
+	touch patch-db/client/node_modules

 patch-db/client/dist: $(PATCH_DB_CLIENT_SRC) patch-db/client/node_modules
-	! test -d patch-db/client/dist || rm -rf patch-db/client/dist
-	npm --prefix web run build:deps
+	rm -rf patch-db/client/dist
+	npm --prefix patch-db/client run build

 # used by github actions
 compiled-$(ARCH).tar: $(COMPILED_TARGETS) $(ENVIRONMENT_FILE) $(GIT_HASH_FILE) $(VERSION_FILE)
--- a/build/lib/scripts/chroot-and-upgrade
+++ b/build/lib/scripts/chroot-and-upgrade
@@ -16,6 +16,7 @@ mkdir -p /media/embassy/next/sys
 mkdir -p /media/embassy/next/proc
 mkdir -p /media/embassy/next/boot
 mount --bind /run /media/embassy/next/run
+mount --bind /tmp /media/embassy/next/tmp
 mount --bind /dev /media/embassy/next/dev
 mount --bind /sys /media/embassy/next/sys
 mount --bind /proc /media/embassy/next/proc
@@ -30,6 +31,7 @@ else
 fi

 umount /media/embassy/next/run
+umount /media/embassy/next/tmp
 umount /media/embassy/next/dev
 umount /media/embassy/next/sys
 umount /media/embassy/next/proc
--- a/check-git-hash.sh
+++ b/check-git-hash.sh
@@ -1,7 +1,7 @@
 #!/bin/bash

 if [ "$GIT_BRANCH_AS_HASH" != 1 ]; then
-    GIT_HASH="$(git describe --always --abbrev=40 --dirty=-modified)"
+    GIT_HASH="$(git rev-parse HEAD)$(if ! git diff-index --quiet HEAD --; then echo '-modified'; fi)"
 else
    GIT_HASH="@$(git rev-parse --abbrev-ref HEAD)"
 fi
--- a/container-runtime/package-lock.json
+++ b/container-runtime/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "start-init",
+  "name": "container-runtime",
  "version": "0.0.0",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
-      "name": "start-init",
+      "name": "container-runtime",
      "version": "0.0.0",
      "dependencies": {
        "@iarna/toml": "^2.2.5",
@@ -23,396 +23,28 @@
        "@swc/cli": "^0.1.62",
        "@swc/core": "^1.3.65",
        "@types/node": "^20.11.13",
-        "esbuild": "^0.20.0",
        "prettier": "^3.2.5",
        "typescript": ">5.2"
      }
    },
    "../sdk/dist": {
      "name": "@start9labs/start-sdk",
-      "version": "0.4.0-rev0.lib0.rc8.beta7",
+      "version": "0.4.0-rev0.lib0.rc8.beta10",
      "license": "MIT",
      "dependencies": {
-        "@iarna/toml": "^2.2.5",
        "isomorphic-fetch": "^3.0.0",
-        "ts-matches": "^5.4.1",
-        "yaml": "^2.2.2"
+        "ts-matches": "^5.4.1"
      },
      "devDependencies": {
+        "@iarna/toml": "^2.2.5",
        "@types/jest": "^29.4.0",
        "jest": "^29.4.3",
+        "prettier": "^3.2.5",
        "ts-jest": "^29.0.5",
        "ts-node": "^10.9.1",
        "tsx": "^4.7.1",
-        "typescript": "^5.0.4"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.20.0.tgz",
-      "integrity": "sha512-fGFDEctNh0CcSwsiRPxiaqX0P5rq+AqE0SRhYGZ4PX46Lg1FNR6oCxJghf8YgY0WQEgQuh3lErUFE4KxLeRmmw==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.20.0.tgz",
-      "integrity": "sha512-3bMAfInvByLHfJwYPJRlpTeaQA75n8C/QKpEaiS4HrFWFiJlNI0vzq/zCjBrhAYcPyVPG7Eo9dMrcQXuqmNk5g==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.20.0.tgz",
-      "integrity": "sha512-aVpnM4lURNkp0D3qPoAzSG92VXStYmoVPOgXveAUoQBWRSuQzt51yvSju29J6AHPmwY1BjH49uR29oyfH1ra8Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.20.0.tgz",
-      "integrity": "sha512-uK7wAnlRvjkCPzh8jJ+QejFyrP8ObKuR5cBIsQZ+qbMunwR8sbd8krmMbxTLSrDhiPZaJYKQAU5Y3iMDcZPhyQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.20.0.tgz",
-      "integrity": "sha512-AjEcivGAlPs3UAcJedMa9qYg9eSfU6FnGHJjT8s346HSKkrcWlYezGE8VaO2xKfvvlZkgAhyvl06OJOxiMgOYQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.20.0.tgz",
-      "integrity": "sha512-bsgTPoyYDnPv8ER0HqnJggXK6RyFy4PH4rtsId0V7Efa90u2+EifxytE9pZnsDgExgkARy24WUQGv9irVbTvIw==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.20.0.tgz",
-      "integrity": "sha512-kQ7jYdlKS335mpGbMW5tEe3IrQFIok9r84EM3PXB8qBFJPSc6dpWfrtsC/y1pyrz82xfUIn5ZrnSHQQsd6jebQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.20.0.tgz",
-      "integrity": "sha512-uG8B0WSepMRsBNVXAQcHf9+Ko/Tr+XqmK7Ptel9HVmnykupXdS4J7ovSQUIi0tQGIndhbqWLaIL/qO/cWhXKyQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.20.0.tgz",
-      "integrity": "sha512-2ezuhdiZw8vuHf1HKSf4TIk80naTbP9At7sOqZmdVwvvMyuoDiZB49YZKLsLOfKIr77+I40dWpHVeY5JHpIEIg==",
-      "cpu": [
-        "arm"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.20.0.tgz",
-      "integrity": "sha512-uTtyYAP5veqi2z9b6Gr0NUoNv9F/rOzI8tOD5jKcCvRUn7T60Bb+42NDBCWNhMjkQzI0qqwXkQGo1SY41G52nw==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.20.0.tgz",
-      "integrity": "sha512-c88wwtfs8tTffPaoJ+SQn3y+lKtgTzyjkD8NgsyCtCmtoIC8RDL7PrJU05an/e9VuAke6eJqGkoMhJK1RY6z4w==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.20.0.tgz",
-      "integrity": "sha512-lR2rr/128/6svngnVta6JN4gxSXle/yZEZL3o4XZ6esOqhyR4wsKyfu6qXAL04S4S5CgGfG+GYZnjFd4YiG3Aw==",
-      "cpu": [
-        "loong64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.20.0.tgz",
-      "integrity": "sha512-9Sycc+1uUsDnJCelDf6ZNqgZQoK1mJvFtqf2MUz4ujTxGhvCWw+4chYfDLPepMEvVL9PDwn6HrXad5yOrNzIsQ==",
-      "cpu": [
-        "mips64el"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.20.0.tgz",
-      "integrity": "sha512-CoWSaaAXOZd+CjbUTdXIJE/t7Oz+4g90A3VBCHLbfuc5yUQU/nFDLOzQsN0cdxgXd97lYW/psIIBdjzQIwTBGw==",
-      "cpu": [
-        "ppc64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.20.0.tgz",
-      "integrity": "sha512-mlb1hg/eYRJUpv8h/x+4ShgoNLL8wgZ64SUr26KwglTYnwAWjkhR2GpoKftDbPOCnodA9t4Y/b68H4J9XmmPzA==",
-      "cpu": [
-        "riscv64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.20.0.tgz",
-      "integrity": "sha512-fgf9ubb53xSnOBqyvWEY6ukBNRl1mVX1srPNu06B6mNsNK20JfH6xV6jECzrQ69/VMiTLvHMicQR/PgTOgqJUQ==",
-      "cpu": [
-        "s390x"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.20.0.tgz",
-      "integrity": "sha512-H9Eu6MGse++204XZcYsse1yFHmRXEWgadk2N58O/xd50P9EvFMLJTQLg+lB4E1cF2xhLZU5luSWtGTb0l9UeSg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.20.0.tgz",
-      "integrity": "sha512-lCT675rTN1v8Fo+RGrE5KjSnfY0x9Og4RN7t7lVrN3vMSjy34/+3na0q7RIfWDAj0e0rCh0OL+P88lu3Rt21MQ==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.20.0.tgz",
-      "integrity": "sha512-HKoUGXz/TOVXKQ+67NhxyHv+aDSZf44QpWLa3I1lLvAwGq8x1k0T+e2HHSRvxWhfJrFxaaqre1+YyzQ99KixoA==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.20.0.tgz",
-      "integrity": "sha512-GDwAqgHQm1mVoPppGsoq4WJwT3vhnz/2N62CzhvApFD1eJyTroob30FPpOZabN+FgCjhG+AgcZyOPIkR8dfD7g==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.20.0.tgz",
-      "integrity": "sha512-0vYsP8aC4TvMlOQYozoksiaxjlvUcQrac+muDqj1Fxy6jh9l9CZJzj7zmh8JGfiV49cYLTorFLxg7593pGldwQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.20.0.tgz",
-      "integrity": "sha512-p98u4rIgfh4gdpV00IqknBD5pC84LCub+4a3MO+zjqvU5MVXOc3hqR2UgT2jI2nh3h8s9EQxmOsVI3tyzv1iFg==",
-      "cpu": [
-        "ia32"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.20.0.tgz",
-      "integrity": "sha512-NgJnesu1RtWihtTtXGFMU5YSE6JyyHPMxCwBZK7a6/8d31GuSo9l0Ss7w1Jw5QnKUawG6UEehs883kcXf5fYwg==",
-      "cpu": [
-        "x64"
-      ],
-      "dev": true,
-      "optional": true,
-      "os": [
-        "win32"
-      ],
-      "engines": {
-        "node": ">=12"
+        "typescript": "^5.0.4",
+        "yaml": "^2.2.2"
      }
    },
    "node_modules/@iarna/toml": {
@@ -1304,44 +936,6 @@
        "node": ">= 0.4"
      }
    },
-    "node_modules/esbuild": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.20.0.tgz",
-      "integrity": "sha512-6iwE3Y2RVYCME1jLpBqq7LQWK3MW6vjV2bZy6gt/WrqkY+WE74Spyc0ThAOYpMtITvnjX09CrC6ym7A/m9mebA==",
-      "dev": true,
-      "hasInstallScript": true,
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.20.0",
-        "@esbuild/android-arm": "0.20.0",
-        "@esbuild/android-arm64": "0.20.0",
-        "@esbuild/android-x64": "0.20.0",
-        "@esbuild/darwin-arm64": "0.20.0",
-        "@esbuild/darwin-x64": "0.20.0",
-        "@esbuild/freebsd-arm64": "0.20.0",
-        "@esbuild/freebsd-x64": "0.20.0",
-        "@esbuild/linux-arm": "0.20.0",
-        "@esbuild/linux-arm64": "0.20.0",
-        "@esbuild/linux-ia32": "0.20.0",
-        "@esbuild/linux-loong64": "0.20.0",
-        "@esbuild/linux-mips64el": "0.20.0",
-        "@esbuild/linux-ppc64": "0.20.0",
-        "@esbuild/linux-riscv64": "0.20.0",
-        "@esbuild/linux-s390x": "0.20.0",
-        "@esbuild/linux-x64": "0.20.0",
-        "@esbuild/netbsd-x64": "0.20.0",
-        "@esbuild/openbsd-x64": "0.20.0",
-        "@esbuild/sunos-x64": "0.20.0",
-        "@esbuild/win32-arm64": "0.20.0",
-        "@esbuild/win32-ia32": "0.20.0",
-        "@esbuild/win32-x64": "0.20.0"
-      }
-    },
    "node_modules/esbuild-plugin-resolve": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/esbuild-plugin-resolve/-/esbuild-plugin-resolve-2.0.0.tgz",
@@ -2965,167 +2559,6 @@
    }
  },
  "dependencies": {
-    "@esbuild/aix-ppc64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.20.0.tgz",
-      "integrity": "sha512-fGFDEctNh0CcSwsiRPxiaqX0P5rq+AqE0SRhYGZ4PX46Lg1FNR6oCxJghf8YgY0WQEgQuh3lErUFE4KxLeRmmw==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/android-arm": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.20.0.tgz",
-      "integrity": "sha512-3bMAfInvByLHfJwYPJRlpTeaQA75n8C/QKpEaiS4HrFWFiJlNI0vzq/zCjBrhAYcPyVPG7Eo9dMrcQXuqmNk5g==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/android-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.20.0.tgz",
-      "integrity": "sha512-aVpnM4lURNkp0D3qPoAzSG92VXStYmoVPOgXveAUoQBWRSuQzt51yvSju29J6AHPmwY1BjH49uR29oyfH1ra8Q==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/android-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.20.0.tgz",
-      "integrity": "sha512-uK7wAnlRvjkCPzh8jJ+QejFyrP8ObKuR5cBIsQZ+qbMunwR8sbd8krmMbxTLSrDhiPZaJYKQAU5Y3iMDcZPhyQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/darwin-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.20.0.tgz",
-      "integrity": "sha512-AjEcivGAlPs3UAcJedMa9qYg9eSfU6FnGHJjT8s346HSKkrcWlYezGE8VaO2xKfvvlZkgAhyvl06OJOxiMgOYQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/darwin-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.20.0.tgz",
-      "integrity": "sha512-bsgTPoyYDnPv8ER0HqnJggXK6RyFy4PH4rtsId0V7Efa90u2+EifxytE9pZnsDgExgkARy24WUQGv9irVbTvIw==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/freebsd-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.20.0.tgz",
-      "integrity": "sha512-kQ7jYdlKS335mpGbMW5tEe3IrQFIok9r84EM3PXB8qBFJPSc6dpWfrtsC/y1pyrz82xfUIn5ZrnSHQQsd6jebQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/freebsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.20.0.tgz",
-      "integrity": "sha512-uG8B0WSepMRsBNVXAQcHf9+Ko/Tr+XqmK7Ptel9HVmnykupXdS4J7ovSQUIi0tQGIndhbqWLaIL/qO/cWhXKyQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-arm": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.20.0.tgz",
-      "integrity": "sha512-2ezuhdiZw8vuHf1HKSf4TIk80naTbP9At7sOqZmdVwvvMyuoDiZB49YZKLsLOfKIr77+I40dWpHVeY5JHpIEIg==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.20.0.tgz",
-      "integrity": "sha512-uTtyYAP5veqi2z9b6Gr0NUoNv9F/rOzI8tOD5jKcCvRUn7T60Bb+42NDBCWNhMjkQzI0qqwXkQGo1SY41G52nw==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-ia32": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.20.0.tgz",
-      "integrity": "sha512-c88wwtfs8tTffPaoJ+SQn3y+lKtgTzyjkD8NgsyCtCmtoIC8RDL7PrJU05an/e9VuAke6eJqGkoMhJK1RY6z4w==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-loong64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.20.0.tgz",
-      "integrity": "sha512-lR2rr/128/6svngnVta6JN4gxSXle/yZEZL3o4XZ6esOqhyR4wsKyfu6qXAL04S4S5CgGfG+GYZnjFd4YiG3Aw==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-mips64el": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.20.0.tgz",
-      "integrity": "sha512-9Sycc+1uUsDnJCelDf6ZNqgZQoK1mJvFtqf2MUz4ujTxGhvCWw+4chYfDLPepMEvVL9PDwn6HrXad5yOrNzIsQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-ppc64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.20.0.tgz",
-      "integrity": "sha512-CoWSaaAXOZd+CjbUTdXIJE/t7Oz+4g90A3VBCHLbfuc5yUQU/nFDLOzQsN0cdxgXd97lYW/psIIBdjzQIwTBGw==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-riscv64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.20.0.tgz",
-      "integrity": "sha512-mlb1hg/eYRJUpv8h/x+4ShgoNLL8wgZ64SUr26KwglTYnwAWjkhR2GpoKftDbPOCnodA9t4Y/b68H4J9XmmPzA==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-s390x": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.20.0.tgz",
-      "integrity": "sha512-fgf9ubb53xSnOBqyvWEY6ukBNRl1mVX1srPNu06B6mNsNK20JfH6xV6jECzrQ69/VMiTLvHMicQR/PgTOgqJUQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/linux-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.20.0.tgz",
-      "integrity": "sha512-H9Eu6MGse++204XZcYsse1yFHmRXEWgadk2N58O/xd50P9EvFMLJTQLg+lB4E1cF2xhLZU5luSWtGTb0l9UeSg==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/netbsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.20.0.tgz",
-      "integrity": "sha512-lCT675rTN1v8Fo+RGrE5KjSnfY0x9Og4RN7t7lVrN3vMSjy34/+3na0q7RIfWDAj0e0rCh0OL+P88lu3Rt21MQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/openbsd-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.20.0.tgz",
-      "integrity": "sha512-HKoUGXz/TOVXKQ+67NhxyHv+aDSZf44QpWLa3I1lLvAwGq8x1k0T+e2HHSRvxWhfJrFxaaqre1+YyzQ99KixoA==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/sunos-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.20.0.tgz",
-      "integrity": "sha512-GDwAqgHQm1mVoPppGsoq4WJwT3vhnz/2N62CzhvApFD1eJyTroob30FPpOZabN+FgCjhG+AgcZyOPIkR8dfD7g==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/win32-arm64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.20.0.tgz",
-      "integrity": "sha512-0vYsP8aC4TvMlOQYozoksiaxjlvUcQrac+muDqj1Fxy6jh9l9CZJzj7zmh8JGfiV49cYLTorFLxg7593pGldwQ==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/win32-ia32": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.20.0.tgz",
-      "integrity": "sha512-p98u4rIgfh4gdpV00IqknBD5pC84LCub+4a3MO+zjqvU5MVXOc3hqR2UgT2jI2nh3h8s9EQxmOsVI3tyzv1iFg==",
-      "dev": true,
-      "optional": true
-    },
-    "@esbuild/win32-x64": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.20.0.tgz",
-      "integrity": "sha512-NgJnesu1RtWihtTtXGFMU5YSE6JyyHPMxCwBZK7a6/8d31GuSo9l0Ss7w1Jw5QnKUawG6UEehs883kcXf5fYwg==",
-      "dev": true,
-      "optional": true
-    },
    "@iarna/toml": {
      "version": "2.2.5",
      "resolved": "https://registry.npmjs.org/@iarna/toml/-/toml-2.2.5.tgz",
@@ -3186,6 +2619,7 @@
        "@types/jest": "^29.4.0",
        "isomorphic-fetch": "^3.0.0",
        "jest": "^29.4.3",
+        "prettier": "^3.2.5",
        "ts-jest": "^29.0.5",
        "ts-matches": "^5.4.1",
        "ts-node": "^10.9.1",
@@ -3732,37 +3166,6 @@
      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="
    },
-    "esbuild": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.20.0.tgz",
-      "integrity": "sha512-6iwE3Y2RVYCME1jLpBqq7LQWK3MW6vjV2bZy6gt/WrqkY+WE74Spyc0ThAOYpMtITvnjX09CrC6ym7A/m9mebA==",
-      "dev": true,
-      "requires": {
-        "@esbuild/aix-ppc64": "0.20.0",
-        "@esbuild/android-arm": "0.20.0",
-        "@esbuild/android-arm64": "0.20.0",
-        "@esbuild/android-x64": "0.20.0",
-        "@esbuild/darwin-arm64": "0.20.0",
-        "@esbuild/darwin-x64": "0.20.0",
-        "@esbuild/freebsd-arm64": "0.20.0",
-        "@esbuild/freebsd-x64": "0.20.0",
-        "@esbuild/linux-arm": "0.20.0",
-        "@esbuild/linux-arm64": "0.20.0",
-        "@esbuild/linux-ia32": "0.20.0",
-        "@esbuild/linux-loong64": "0.20.0",
-        "@esbuild/linux-mips64el": "0.20.0",
-        "@esbuild/linux-ppc64": "0.20.0",
-        "@esbuild/linux-riscv64": "0.20.0",
-        "@esbuild/linux-s390x": "0.20.0",
-        "@esbuild/linux-x64": "0.20.0",
-        "@esbuild/netbsd-x64": "0.20.0",
-        "@esbuild/openbsd-x64": "0.20.0",
-        "@esbuild/sunos-x64": "0.20.0",
-        "@esbuild/win32-arm64": "0.20.0",
-        "@esbuild/win32-ia32": "0.20.0",
-        "@esbuild/win32-x64": "0.20.0"
-      }
-    },
    "esbuild-plugin-resolve": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/esbuild-plugin-resolve/-/esbuild-plugin-resolve-2.0.0.tgz",
--- a/container-runtime/package.json
+++ b/container-runtime/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "start-init",
+  "name": "container-runtime",
  "version": "0.0.0",
  "description": "We want to be the sdk intermitent for the system",
  "module": "./index.js",
--- a/container-runtime/src/Adapters/RpcListener.ts
+++ b/container-runtime/src/Adapters/RpcListener.ts
@@ -101,7 +101,7 @@ const evalType = object({
  }),
 })

-const jsonParse = (x: Buffer) => JSON.parse(x.toString())
+const jsonParse = (x: string) => JSON.parse(x)
 function reduceMethod(
  methodArgs: object,
  effects: HostSystem,
@@ -160,21 +160,21 @@ export class RpcListener {
            details: error?.message ?? String(error),
            debug: error?.stack,
          },
-          code: 0,
+          code: 1,
        },
      })
      const writeDataToSocket = (x: SocketResponse) =>
-        new Promise((resolve) => s.write(JSON.stringify(x), resolve))
+        new Promise((resolve) => s.write(JSON.stringify(x) + "\n", resolve))
      s.on("data", (a) =>
        Promise.resolve(a)
+          .then((b) => b.toString())
          .then(logData("dataIn"))
          .then(jsonParse)
          .then(captureId)
          .then((x) => this.dealWithInput(x))
          .catch(mapError)
          .then(logData("response"))
-          .then(writeDataToSocket)
-          .finally(() => void s.end()),
+          .then(writeDataToSocket),
      )
    })
  }
@@ -244,7 +244,7 @@ export class RpcListener {
          })),
      )
      .when(exitType, async ({ id }) => {
-        if (this._system) this._system.exit(this.effects)
+        if (this._system) await this._system.exit(this.effects)
        delete this._system
        delete this._effects

--- a/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
+++ b/container-runtime/src/Adapters/Systems/SystemForEmbassy/index.ts
@@ -30,7 +30,7 @@ import {
 import { HostSystemStartOs } from "../../HostSystemStartOs"
 import { JsonPath, unNestPath } from "../../../Models/JsonPath"
 import { RpcResult, matchRpcResult } from "../../RpcListener"
-import { InputSpec } from "@start9labs/start-sdk/cjs/sdk/lib/config/configTypes"
+import { CT } from "@start9labs/start-sdk"

 type Optional<A> = A | undefined | null
 function todo(): never {
@@ -326,7 +326,7 @@ export class SystemForEmbassy implements System {
          name: action.name,
          description: action.description,
          warning: action.warning || null,
-          input: action["input-spec"] as InputSpec,
+          input: action["input-spec"] as CT.InputSpec,
          disabled: false,
          allowedStatuses,
          group: null,
--- a/container-runtime/tsconfig.json
+++ b/container-runtime/tsconfig.json
@@ -1,11 +1,5 @@
 {
-  "include": [
-    "./**/*.mjs",
-    "./**/*.js",
-    "src/Adapters/RpcListener.ts",
-    "src/index.ts",
-    "effects.ts"
-  ],
+  "include": ["./**/*.ts"],
  "exclude": ["dist"],
  "inputs": ["./src/index.ts"],
  "compilerOptions": {
--- a/core/.gitignore
+++ b/core/.gitignore
@@ -8,3 +8,4 @@ secrets.db
 .env
 .editorconfig
 proptest-regressions/**/*
+/startos/bindings/*
--- a/core/startos/bindings/ActionMetadata.ts
+++ b/core/startos/bindings/ActionMetadata.ts
@@ -1,12 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AllowedStatuses } from "./AllowedStatuses";
-
-export type ActionMetadata = {
-  name: string;
-  description: string;
-  warning: string | null;
-  input: any;
-  disabled: boolean;
-  allowedStatuses: AllowedStatuses;
-  group: string | null;
-};
--- a/core/startos/bindings/AddressInfo.ts
+++ b/core/startos/bindings/AddressInfo.ts
@@ -1,10 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { BindOptions } from "./BindOptions";
-import type { HostId } from "./HostId";
-
-export type AddressInfo = {
-  username: string | null;
-  hostId: HostId;
-  bindOptions: BindOptions;
-  suffix: string;
-};
--- a/core/startos/bindings/BindOptions.ts
+++ b/core/startos/bindings/BindOptions.ts
@@ -1,10 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AddSslOptions } from "./AddSslOptions";
-import type { Security } from "./Security";
-
-export type BindOptions = {
-  scheme: string | null;
-  preferredExternalPort: number;
-  addSsl: AddSslOptions | null;
-  secure: Security | null;
-};
--- a/core/startos/bindings/BindParams.ts
+++ b/core/startos/bindings/BindParams.ts
@@ -1,15 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AddSslOptions } from "./AddSslOptions";
-import type { HostId } from "./HostId";
-import type { HostKind } from "./HostKind";
-import type { Security } from "./Security";
-
-export type BindParams = {
-  kind: HostKind;
-  id: HostId;
-  internalPort: number;
-  scheme: string | null;
-  preferredExternalPort: number;
-  addSsl: AddSslOptions | null;
-  secure: Security | null;
-};
--- a/core/startos/bindings/Dependencies.ts
+++ b/core/startos/bindings/Dependencies.ts
@@ -1,5 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { DepInfo } from "./DepInfo";
-import type { PackageId } from "./PackageId";
-
-export type Dependencies = { [key: PackageId]: DepInfo };
--- a/core/startos/bindings/DestroyOverlayedImageParams.ts
+++ b/core/startos/bindings/DestroyOverlayedImageParams.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type DestroyOverlayedImageParams = { guid: string };
--- a/core/startos/bindings/ExportServiceInterfaceParams.ts
+++ b/core/startos/bindings/ExportServiceInterfaceParams.ts
@@ -1,14 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AddressInfo } from "./AddressInfo";
-import type { ServiceInterfaceType } from "./ServiceInterfaceType";
-
-export type ExportServiceInterfaceParams = {
-  id: string;
-  name: string;
-  description: string;
-  hasPrimary: boolean;
-  disabled: boolean;
-  masked: boolean;
-  addressInfo: AddressInfo;
-  type: ServiceInterfaceType;
-};
--- a/core/startos/bindings/ExportedHostnameInfo.ts
+++ b/core/startos/bindings/ExportedHostnameInfo.ts
@@ -1,12 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ExportedIpHostname } from "./ExportedIpHostname";
-import type { ExportedOnionHostname } from "./ExportedOnionHostname";
-
-export type ExportedHostnameInfo =
-  | {
-      kind: "ip";
-      networkInterfaceId: string;
-      public: boolean;
-      hostname: ExportedIpHostname;
-    }
-  | { kind: "onion"; hostname: ExportedOnionHostname };
--- a/core/startos/bindings/ExposeForDependentsParams.ts
+++ b/core/startos/bindings/ExposeForDependentsParams.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ExposeForDependentsParams = { paths: string[] };
--- a/core/startos/bindings/GetSystemSmtpParams.ts
+++ b/core/startos/bindings/GetSystemSmtpParams.ts
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Callback } from "./Callback";
-
-export type GetSystemSmtpParams = { callback: Callback };
--- a/core/startos/bindings/Host.ts
+++ b/core/startos/bindings/Host.ts
@@ -1,11 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { BindInfo } from "./BindInfo";
-import type { HostAddress } from "./HostAddress";
-import type { HostKind } from "./HostKind";
-
-export type Host = {
-  kind: HostKind;
-  bindings: { [key: number]: BindInfo };
-  addresses: Array<HostAddress>;
-  primary: HostAddress | null;
-};
--- a/core/startos/bindings/HostAddress.ts
+++ b/core/startos/bindings/HostAddress.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type HostAddress = { kind: "onion"; address: string };
--- a/core/startos/bindings/HostInfo.ts
+++ b/core/startos/bindings/HostInfo.ts
@@ -1,5 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Host } from "./Host";
-import type { HostId } from "./HostId";
-
-export type HostInfo = { [key: HostId]: Host };
--- a/core/startos/bindings/InstalledState.ts
+++ b/core/startos/bindings/InstalledState.ts
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Manifest } from "./Manifest";
-
-export type InstalledState = { manifest: Manifest };
--- a/core/startos/bindings/MainStatus.ts
+++ b/core/startos/bindings/MainStatus.ts
@@ -1,20 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Duration } from "./Duration";
-import type { HealthCheckId } from "./HealthCheckId";
-import type { HealthCheckResult } from "./HealthCheckResult";
-
-export type MainStatus =
-  | { status: "stopped" }
-  | { status: "restarting" }
-  | { status: "stopping"; timeout: Duration }
-  | { status: "starting" }
-  | {
-      status: "running";
-      started: string;
-      health: { [key: HealthCheckId]: HealthCheckResult };
-    }
-  | {
-      status: "backingUp";
-      started: string | null;
-      health: { [key: HealthCheckId]: HealthCheckResult };
-    };
--- a/core/startos/bindings/Manifest.ts
+++ b/core/startos/bindings/Manifest.ts
@@ -1,32 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Alerts } from "./Alerts";
-import type { Dependencies } from "./Dependencies";
-import type { Description } from "./Description";
-import type { HardwareRequirements } from "./HardwareRequirements";
-import type { ImageId } from "./ImageId";
-import type { PackageId } from "./PackageId";
-import type { VolumeId } from "./VolumeId";
-
-export type Manifest = {
-  id: PackageId;
-  title: string;
-  version: string;
-  releaseNotes: string;
-  license: string;
-  replaces: Array<string>;
-  wrapperRepo: string;
-  upstreamRepo: string;
-  supportSite: string;
-  marketingSite: string;
-  donationUrl: string | null;
-  description: Description;
-  images: Array<ImageId>;
-  assets: Array<VolumeId>;
-  volumes: Array<VolumeId>;
-  alerts: Alerts;
-  dependencies: Dependencies;
-  hardwareRequirements: HardwareRequirements;
-  gitHash: string | null;
-  osVersion: string;
-  hasConfig: boolean;
-};
--- a/core/startos/bindings/PackageDataEntry.ts
+++ b/core/startos/bindings/PackageDataEntry.ts
@@ -1,26 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ActionId } from "./ActionId";
-import type { ActionMetadata } from "./ActionMetadata";
-import type { CurrentDependencies } from "./CurrentDependencies";
-import type { DataUrl } from "./DataUrl";
-import type { HostInfo } from "./HostInfo";
-import type { PackageState } from "./PackageState";
-import type { ServiceInterfaceId } from "./ServiceInterfaceId";
-import type { ServiceInterfaceWithHostInfo } from "./ServiceInterfaceWithHostInfo";
-import type { Status } from "./Status";
-
-export type PackageDataEntry = {
-  stateInfo: PackageState;
-  status: Status;
-  marketplaceUrl: string | null;
-  developerKey: string;
-  icon: DataUrl;
-  lastBackup: string | null;
-  currentDependencies: CurrentDependencies;
-  actions: { [key: ActionId]: ActionMetadata };
-  serviceInterfaces: {
-    [key: ServiceInterfaceId]: ServiceInterfaceWithHostInfo;
-  };
-  hosts: HostInfo;
-  storeExposedDependents: string[];
-};
--- a/core/startos/bindings/ParamsMaybePackageId.ts
+++ b/core/startos/bindings/ParamsMaybePackageId.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ParamsMaybePackageId = { packageId: string | null };
--- a/core/startos/bindings/ParamsPackageId.ts
+++ b/core/startos/bindings/ParamsPackageId.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ParamsPackageId = { packageId: string };
--- a/core/startos/bindings/PasswordType.ts
+++ b/core/startos/bindings/PasswordType.ts
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { EncryptedWire } from "./EncryptedWire";
-
-export type PasswordType = EncryptedWire | string;
--- a/core/startos/bindings/Public.ts
+++ b/core/startos/bindings/Public.ts
@@ -1,9 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AllPackageData } from "./AllPackageData";
-import type { ServerInfo } from "./ServerInfo";
-
-export type Public = {
-  serverInfo: ServerInfo;
-  packageData: AllPackageData;
-  ui: any;
-};
--- a/core/startos/bindings/RemoveActionParams.ts
+++ b/core/startos/bindings/RemoveActionParams.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type RemoveActionParams = { id: string };
--- a/core/startos/bindings/RemoveAddressParams.ts
+++ b/core/startos/bindings/RemoveAddressParams.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type RemoveAddressParams = { id: string };
--- a/core/startos/bindings/ReverseProxyBind.ts
+++ b/core/startos/bindings/ReverseProxyBind.ts
@@ -1,7 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ReverseProxyBind = {
-  ip: string | null;
-  port: number;
-  ssl: boolean;
-};
--- a/core/startos/bindings/ReverseProxyParams.ts
+++ b/core/startos/bindings/ReverseProxyParams.ts
@@ -1,10 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ReverseProxyBind } from "./ReverseProxyBind";
-import type { ReverseProxyDestination } from "./ReverseProxyDestination";
-import type { ReverseProxyHttp } from "./ReverseProxyHttp";
-
-export type ReverseProxyParams = {
-  bind: ReverseProxyBind;
-  dst: ReverseProxyDestination;
-  http: ReverseProxyHttp;
-};
--- a/core/startos/bindings/ServerInfo.ts
+++ b/core/startos/bindings/ServerInfo.ts
@@ -1,31 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Governor } from "./Governor";
-import type { IpInfo } from "./IpInfo";
-import type { ServerStatus } from "./ServerStatus";
-import type { WifiInfo } from "./WifiInfo";
-
-export type ServerInfo = {
-  arch: string;
-  platform: string;
-  id: string;
-  hostname: string;
-  version: string;
-  lastBackup: string | null;
-  eosVersionCompat: string;
-  lanAddress: string;
-  onionAddress: string;
-  /**
-   * for backwards compatibility
-   */
-  torAddress: string;
-  ipInfo: { [key: string]: IpInfo };
-  statusInfo: ServerStatus;
-  wifi: WifiInfo;
-  unreadNotificationCount: number;
-  passwordHash: string;
-  pubkey: string;
-  caFingerprint: string;
-  ntpSynced: boolean;
-  zram: boolean;
-  governor: Governor | null;
-};
--- a/core/startos/bindings/ServerStatus.ts
+++ b/core/startos/bindings/ServerStatus.ts
@@ -1,12 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { BackupProgress } from "./BackupProgress";
-import type { PackageId } from "./PackageId";
-import type { UpdateProgress } from "./UpdateProgress";
-
-export type ServerStatus = {
-  backupProgress: { [key: PackageId]: BackupProgress } | null;
-  updated: boolean;
-  updateProgress: UpdateProgress | null;
-  shuttingDown: boolean;
-  restarting: boolean;
-};
--- a/core/startos/bindings/ServiceInterface.ts
+++ b/core/startos/bindings/ServiceInterface.ts
@@ -1,15 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AddressInfo } from "./AddressInfo";
-import type { ServiceInterfaceId } from "./ServiceInterfaceId";
-import type { ServiceInterfaceType } from "./ServiceInterfaceType";
-
-export type ServiceInterface = {
-  id: ServiceInterfaceId;
-  name: string;
-  description: string;
-  hasPrimary: boolean;
-  disabled: boolean;
-  masked: boolean;
-  addressInfo: AddressInfo;
-  type: ServiceInterfaceType;
-};
--- a/core/startos/bindings/ServiceInterfaceType.ts
+++ b/core/startos/bindings/ServiceInterfaceType.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type ServiceInterfaceType = "ui" | "p2p" | "api";
--- a/core/startos/bindings/ServiceInterfaceWithHostInfo.ts
+++ b/core/startos/bindings/ServiceInterfaceWithHostInfo.ts
@@ -1,17 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AddressInfo } from "./AddressInfo";
-import type { ExportedHostInfo } from "./ExportedHostInfo";
-import type { ServiceInterfaceId } from "./ServiceInterfaceId";
-import type { ServiceInterfaceType } from "./ServiceInterfaceType";
-
-export type ServiceInterfaceWithHostInfo = {
-  hostInfo: ExportedHostInfo;
-  id: ServiceInterfaceId;
-  name: string;
-  description: string;
-  hasPrimary: boolean;
-  disabled: boolean;
-  masked: boolean;
-  addressInfo: AddressInfo;
-  type: ServiceInterfaceType;
-};
--- a/core/startos/bindings/SetConfigured.ts
+++ b/core/startos/bindings/SetConfigured.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SetConfigured = { configured: boolean };
--- a/core/startos/bindings/SetMainStatus.ts
+++ b/core/startos/bindings/SetMainStatus.ts
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { Status } from "./Status";
-
-export type SetMainStatus = { status: Status };
--- a/core/startos/bindings/SetStoreParams.ts
+++ b/core/startos/bindings/SetStoreParams.ts
@@ -1,3 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-
-export type SetStoreParams = { value: any; path: string };
--- a/core/startos/bindings/Status.ts
+++ b/core/startos/bindings/Status.ts
@@ -1,4 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { MainStatus } from "./MainStatus";
-
-export type Status = { configured: boolean; main: MainStatus };
--- a/core/startos/bindings/UpdatingState.ts
+++ b/core/startos/bindings/UpdatingState.ts
@@ -1,8 +0,0 @@
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { InstallingInfo } from "./InstallingInfo";
-import type { Manifest } from "./Manifest";
-
-export type UpdatingState = {
-  manifest: Manifest;
-  installingInfo: InstallingInfo;
-};
--- a/core/startos/bindings/index.ts
+++ b/core/startos/bindings/index.ts
@@ -1,101 +0,0 @@
-export { ActionId } from "./ActionId";
-export { ActionMetadata } from "./ActionMetadata";
-export { AddressInfo } from "./AddressInfo";
-export { AddSslOptions } from "./AddSslOptions";
-export { Alerts } from "./Alerts";
-export { Algorithm } from "./Algorithm";
-export { AllowedStatuses } from "./AllowedStatuses";
-export { AllPackageData } from "./AllPackageData";
-export { AlpnInfo } from "./AlpnInfo";
-export { BackupProgress } from "./BackupProgress";
-export { BindInfo } from "./BindInfo";
-export { BindOptions } from "./BindOptions";
-export { BindParams } from "./BindParams";
-export { Callback } from "./Callback";
-export { ChrootParams } from "./ChrootParams";
-export { CreateOverlayedImageParams } from "./CreateOverlayedImageParams";
-export { CurrentDependencies } from "./CurrentDependencies";
-export { CurrentDependencyInfo } from "./CurrentDependencyInfo";
-export { DataUrl } from "./DataUrl";
-export { Dependencies } from "./Dependencies";
-export { DependencyKind } from "./DependencyKind";
-export { DependencyRequirement } from "./DependencyRequirement";
-export { DepInfo } from "./DepInfo";
-export { Description } from "./Description";
-export { DestroyOverlayedImageParams } from "./DestroyOverlayedImageParams";
-export { Duration } from "./Duration";
-export { EncryptedWire } from "./EncryptedWire";
-export { ExecuteAction } from "./ExecuteAction";
-export { ExportActionParams } from "./ExportActionParams";
-export { ExportedHostInfo } from "./ExportedHostInfo";
-export { ExportedHostnameInfo } from "./ExportedHostnameInfo";
-export { ExportedIpHostname } from "./ExportedIpHostname";
-export { ExportedOnionHostname } from "./ExportedOnionHostname";
-export { ExportServiceInterfaceParams } from "./ExportServiceInterfaceParams";
-export { ExposeForDependentsParams } from "./ExposeForDependentsParams";
-export { FullProgress } from "./FullProgress";
-export { GetHostInfoParamsKind } from "./GetHostInfoParamsKind";
-export { GetHostInfoParams } from "./GetHostInfoParams";
-export { GetPrimaryUrlParams } from "./GetPrimaryUrlParams";
-export { GetServiceInterfaceParams } from "./GetServiceInterfaceParams";
-export { GetServicePortForwardParams } from "./GetServicePortForwardParams";
-export { GetSslCertificateParams } from "./GetSslCertificateParams";
-export { GetSslKeyParams } from "./GetSslKeyParams";
-export { GetStoreParams } from "./GetStoreParams";
-export { GetSystemSmtpParams } from "./GetSystemSmtpParams";
-export { Governor } from "./Governor";
-export { HardwareRequirements } from "./HardwareRequirements";
-export { HealthCheckId } from "./HealthCheckId";
-export { HealthCheckResult } from "./HealthCheckResult";
-export { HostAddress } from "./HostAddress";
-export { HostId } from "./HostId";
-export { HostInfo } from "./HostInfo";
-export { HostKind } from "./HostKind";
-export { Host } from "./Host";
-export { ImageId } from "./ImageId";
-export { InstalledState } from "./InstalledState";
-export { InstallingInfo } from "./InstallingInfo";
-export { InstallingState } from "./InstallingState";
-export { IpInfo } from "./IpInfo";
-export { ListServiceInterfacesParams } from "./ListServiceInterfacesParams";
-export { MainStatus } from "./MainStatus";
-export { Manifest } from "./Manifest";
-export { MaybeUtf8String } from "./MaybeUtf8String";
-export { MountParams } from "./MountParams";
-export { MountTarget } from "./MountTarget";
-export { NamedProgress } from "./NamedProgress";
-export { PackageDataEntry } from "./PackageDataEntry";
-export { PackageId } from "./PackageId";
-export { PackageState } from "./PackageState";
-export { ParamsMaybePackageId } from "./ParamsMaybePackageId";
-export { ParamsPackageId } from "./ParamsPackageId";
-export { PasswordType } from "./PasswordType";
-export { Progress } from "./Progress";
-export { Public } from "./Public";
-export { RemoveActionParams } from "./RemoveActionParams";
-export { RemoveAddressParams } from "./RemoveAddressParams";
-export { ReverseProxyBind } from "./ReverseProxyBind";
-export { ReverseProxyDestination } from "./ReverseProxyDestination";
-export { ReverseProxyHttp } from "./ReverseProxyHttp";
-export { ReverseProxyParams } from "./ReverseProxyParams";
-export { Security } from "./Security";
-export { ServerInfo } from "./ServerInfo";
-export { ServerSpecs } from "./ServerSpecs";
-export { ServerStatus } from "./ServerStatus";
-export { ServiceInterfaceId } from "./ServiceInterfaceId";
-export { ServiceInterface } from "./ServiceInterface";
-export { ServiceInterfaceType } from "./ServiceInterfaceType";
-export { ServiceInterfaceWithHostInfo } from "./ServiceInterfaceWithHostInfo";
-export { SessionList } from "./SessionList";
-export { Sessions } from "./Sessions";
-export { Session } from "./Session";
-export { SetConfigured } from "./SetConfigured";
-export { SetDependenciesParams } from "./SetDependenciesParams";
-export { SetHealth } from "./SetHealth";
-export { SetMainStatus } from "./SetMainStatus";
-export { SetStoreParams } from "./SetStoreParams";
-export { Status } from "./Status";
-export { UpdateProgress } from "./UpdateProgress";
-export { UpdatingState } from "./UpdatingState";
-export { VolumeId } from "./VolumeId";
-export { WifiInfo } from "./WifiInfo";
--- a/core/startos/src/backup/restore.rs
+++ b/core/startos/src/backup/restore.rs
@@ -149,6 +149,7 @@ async fn restore_packages(
                S9pk::open(
                    backup_dir.path().join(&id).with_extension("s9pk"),
                    Some(&id),
+                    true,
                )
                .await?,
                Some(backup_dir),
--- a/core/startos/src/core/rpc_continuations.rs
+++ b/core/startos/src/core/rpc_continuations.rs
@@ -19,7 +19,7 @@ impl RequestGuid {
    }

    pub fn from(r: &str) -> Option<RequestGuid> {
-        if r.len() != 64 {
+        if r.len() != 32 {
            return None;
        }
        for c in r.chars() {
--- a/core/startos/src/disk/main.rs
+++ b/core/startos/src/disk/main.rs
@@ -64,10 +64,10 @@ where
            .await?;
    }
    let mut guid = format!(
-        "EMBASSY_{}",
+        "STARTOS_{}",
        base32::encode(
            base32::Alphabet::RFC4648 { padding: false },
-            &rand::random::<[u8; 32]>(),
+            &rand::random::<[u8; 20]>(),
        )
    );
    if !encrypted {
@@ -219,7 +219,7 @@ pub async fn import<P: AsRef<Path>>(
    if scan
        .values()
        .filter_map(|a| a.as_ref())
-        .filter(|a| a.starts_with("EMBASSY_"))
+        .filter(|a| a.starts_with("STARTOS_") || a.starts_with("EMBASSY_"))
        .next()
        .is_none()
    {
--- a/core/startos/src/disk/mount/guard.rs
+++ b/core/startos/src/disk/mount/guard.rs
@@ -2,6 +2,7 @@ use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 use std::sync::{Arc, Weak};

+use bytes::Buf;
 use lazy_static::lazy_static;
 use models::ResultExt;
 use tokio::sync::Mutex;
@@ -115,7 +116,7 @@ impl GenericMountGuard for MountGuard {
 async fn tmp_mountpoint(source: &impl FileSystem) -> Result<PathBuf, Error> {
    Ok(Path::new(TMP_MOUNTPOINT).join(base32::encode(
        base32::Alphabet::RFC4648 { padding: false },
-        &source.source_hash().await?,
+        &source.source_hash().await?[0..20],
    )))
 }

--- a/core/startos/src/inspect.rs
+++ b/core/startos/src/inspect.rs
@@ -1,127 +0,0 @@
-use std::path::PathBuf;
-
-use clap::Parser;
-use rpc_toolkit::{command, from_fn_async, AnyContext, HandlerExt, ParentHandler};
-use serde::{Deserialize, Serialize};
-
-use crate::context::CliContext;
-use crate::s9pk::manifest::Manifest;
-// use crate::s9pk::reader::S9pkReader;
-use crate::util::serde::HandlerExtSerde;
-use crate::Error;
-
-pub fn inspect() -> ParentHandler {
-    ParentHandler::new()
-        .subcommand("hash", from_fn_async(hash))
-        .subcommand(
-            "manifest",
-            from_fn_async(manifest).with_display_serializable(),
-        )
-        .subcommand("license", from_fn_async(license).no_display())
-        .subcommand("icon", from_fn_async(icon).no_display())
-        .subcommand("instructions", from_fn_async(instructions).no_display())
-        .subcommand("docker-images", from_fn_async(docker_images).no_display())
-}
-
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
-pub struct HashParams {
-    path: PathBuf,
-}
-
-pub async fn hash(_: CliContext, HashParams { path }: HashParams) -> Result<String, Error> {
-    Ok(S9pkReader::open(path, true)
-        .await?
-        .hash_str()
-        .unwrap()
-        .to_owned())
-}
-
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
-pub struct ManifestParams {
-    path: PathBuf,
-    #[arg(long = "no-verify")]
-    no_verify: bool,
-}
-
-// #[command(cli_only, display(display_serializable))]
-pub async fn manifest(
-    _: CliContext,
-    ManifestParams { .. }: ManifestParams,
-) -> Result<Manifest, Error> {
-    // S9pkReader::open(path, !no_verify).await?.manifest().await
-    todo!()
-}
-
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
-pub struct InspectParams {
-    path: PathBuf,
-    #[arg(long = "no-verify")]
-    no_verify: bool,
-}
-
-pub async fn license(
-    _: AnyContext,
-    InspectParams { path, no_verify }: InspectParams,
-) -> Result<(), Error> {
-    tokio::io::copy(
-        &mut S9pkReader::open(path, !no_verify).await?.license().await?,
-        &mut tokio::io::stdout(),
-    )
-    .await?;
-    Ok(())
-}
-
-pub async fn icon(
-    _: AnyContext,
-    InspectParams { path, no_verify }: InspectParams,
-) -> Result<(), Error> {
-    tokio::io::copy(
-        &mut S9pkReader::open(path, !no_verify).await?.icon().await?,
-        &mut tokio::io::stdout(),
-    )
-    .await?;
-    Ok(())
-}
-#[derive(Deserialize, Serialize, Parser, TS)]
-#[serde(rename_all = "camelCase")]
-#[command(rename_all = "kebab-case")]
-pub struct InstructionParams {
-    path: PathBuf,
-    #[arg(long = "no-verify")]
-    no_verify: bool,
-}
-
-pub async fn instructions(
-    _: CliContext,
-    InstructionParams { path, no_verify }: InstructionParams,
-) -> Result<(), Error> {
-    tokio::io::copy(
-        &mut S9pkReader::open(path, !no_verify)
-            .await?
-            .instructions()
-            .await?,
-        &mut tokio::io::stdout(),
-    )
-    .await?;
-    Ok(())
-}
-pub async fn docker_images(
-    _: AnyContext,
-    InspectParams { path, no_verify }: InspectParams,
-) -> Result<(), Error> {
-    tokio::io::copy(
-        &mut S9pkReader::open(path, !no_verify)
-            .await?
-            .docker_images()
-            .await?,
-        &mut tokio::io::stdout(),
-    )
-    .await?;
-    Ok(())
-}
--- a/core/startos/src/install/mod.rs
+++ b/core/startos/src/install/mod.rs
@@ -148,6 +148,7 @@ pub async fn install(
            .parse()?,
        )
        .await?,
+        true,
    )
    .await?;

@@ -257,7 +258,7 @@ pub async fn sideload(ctx: RpcContext) -> Result<SideloadResponse, Error> {
    .await;
    tokio::spawn(async move {
        if let Err(e) = async {
-            let s9pk = S9pk::deserialize(&file).await?;
+            let s9pk = S9pk::deserialize(&file, true).await?;
            let _ = id_send.send(s9pk.as_manifest().id.clone());
            ctx.services
                .install(ctx.clone(), s9pk, None::<Never>)
@@ -423,7 +424,12 @@ pub async fn uninstall(

    let return_id = id.clone();

-    tokio::spawn(async move { ctx.services.uninstall(&ctx, &id).await });
+    tokio::spawn(async move {
+        if let Err(e) = ctx.services.uninstall(&ctx, &id).await {
+            tracing::error!("Error uninstalling service {id}: {e}");
+            tracing::debug!("{e:?}");
+        }
+    });

    Ok(return_id)
 }
--- a/core/startos/src/lib.rs
+++ b/core/startos/src/lib.rs
@@ -38,8 +38,6 @@ pub mod error;
 pub mod firmware;
 pub mod hostname;
 pub mod init;
-pub mod progress;
-// pub mod inspect;
 pub mod install;
 pub mod logs;
 pub mod lxc;
@@ -48,6 +46,7 @@ pub mod net;
 pub mod notifications;
 pub mod os_install;
 pub mod prelude;
+pub mod progress;
 pub mod properties;
 pub mod registry;
 pub mod s9pk;
--- a/core/startos/src/logs.rs
+++ b/core/startos/src/logs.rs
@@ -18,17 +18,13 @@ use tokio_stream::wrappers::LinesStream;
 use tokio_tungstenite::tungstenite::Message;
 use tracing::instrument;

+use crate::context::{CliContext, RpcContext};
+use crate::core::rpc_continuations::{RequestGuid, RpcContinuation};
 use crate::error::ResultExt;
+use crate::lxc::ContainerId;
 use crate::prelude::*;
 use crate::util::serde::Reversible;
-use crate::{
-    context::{CliContext, RpcContext},
-    lxc::ContainerId,
-};
-use crate::{
-    core::rpc_continuations::{RequestGuid, RpcContinuation},
-    util::Invoke,
-};
+use crate::util::Invoke;

 #[pin_project::pin_project]
 pub struct LogStream {
@@ -393,7 +389,9 @@ pub async fn journalctl(
    before: bool,
    follow: bool,
 ) -> Result<LogStream, Error> {
-    let mut cmd = gen_journalctl_command(&id, limit);
+    let mut cmd = gen_journalctl_command(&id);
+
+    cmd.arg(format!("--lines={}", limit));

    let cursor_formatted = format!("--after-cursor={}", cursor.unwrap_or(""));
    if cursor.is_some() {
@@ -410,12 +408,15 @@ pub async fn journalctl(
        .with_kind(ErrorKind::Deserialization)?;

    if follow {
-        let mut follow_cmd = gen_journalctl_command(&id, limit);
+        let mut follow_cmd = gen_journalctl_command(&id);
        follow_cmd.arg("-f");
        if let Some(last) = deserialized_entries.last() {
-            cmd.arg(format!("--after-cursor={}", last.cursor));
+            follow_cmd.arg(format!("--after-cursor={}", last.cursor));
+            follow_cmd.arg("--lines=all");
+        } else {
+            follow_cmd.arg("--lines=0");
        }
-        let mut child = cmd.stdout(Stdio::piped()).spawn()?;
+        let mut child = follow_cmd.stdout(Stdio::piped()).spawn()?;
        let out =
            BufReader::new(child.stdout.take().ok_or_else(|| {
                Error::new(eyre!("No stdout available"), crate::ErrorKind::Journald)
@@ -450,7 +451,7 @@ pub async fn journalctl(
    }
 }

-fn gen_journalctl_command(id: &LogSource, limit: usize) -> Command {
+fn gen_journalctl_command(id: &LogSource) -> Command {
    let mut cmd = match id {
        LogSource::Container(container_id) => {
            let mut cmd = Command::new("lxc-attach");
@@ -465,7 +466,6 @@ fn gen_journalctl_command(id: &LogSource, limit: usize) -> Command {

    cmd.arg("--output=json");
    cmd.arg("--output-fields=MESSAGE");
-    cmd.arg(format!("-n{}", limit));
    match id {
        LogSource::Kernel => {
            cmd.arg("-k");
@@ -477,7 +477,6 @@ fn gen_journalctl_command(id: &LogSource, limit: usize) -> Command {
        LogSource::System => {
            cmd.arg("-u");
            cmd.arg(SYSTEM_UNIT);
-            cmd.arg(format!("_COMM={}", SYSTEM_UNIT));
        }
        LogSource::Container(_container_id) => {
            cmd.arg("-u").arg("container-runtime.service");
--- a/core/startos/src/lxc/mod.rs
+++ b/core/startos/src/lxc/mod.rs
@@ -288,14 +288,6 @@ impl LxcContainer {
        }
        self.rootfs.take().unmount(true).await?;
        let rootfs_path = self.rootfs_dir();
-        let err_path = rootfs_path.join("var/log/containerRuntime.err");
-        if tokio::fs::metadata(&err_path).await.is_ok() {
-            let mut lines = BufReader::new(File::open(&err_path).await?).lines();
-            while let Some(line) = lines.next_line().await? {
-                let container = &**self.guid;
-                tracing::error!(container, "{}", line);
-            }
-        }
        if tokio::fs::metadata(&rootfs_path).await.is_ok()
            && tokio_stream::wrappers::ReadDirStream::new(tokio::fs::read_dir(&rootfs_path).await?)
                .count()
--- a/core/startos/src/registry/admin.rs
+++ b/core/startos/src/registry/admin.rs
@@ -134,7 +134,7 @@ pub async fn publish(
            .with_prefix("[1/3]")
            .with_message("Querying s9pk");
        pb.enable_steady_tick(Duration::from_millis(200));
-        let s9pk = S9pk::open(&path, None).await?;
+        let s9pk = S9pk::open(&path, None, false).await?;
        let m = s9pk.as_manifest().clone();
        pb.set_style(plain_line_style.clone());
        pb.abandon();
@@ -145,7 +145,7 @@ pub async fn publish(
            .with_prefix("[1/3]")
            .with_message("Verifying s9pk");
        pb.enable_steady_tick(Duration::from_millis(200));
-        let s9pk = S9pk::open(&path, None).await?;
+        let s9pk = S9pk::open(&path, None, false).await?;
        // s9pk.validate().await?;
        todo!();
        let m = s9pk.as_manifest().clone();
--- a/core/startos/src/s9pk/rpc.rs
+++ b/core/startos/src/s9pk/rpc.rs
@@ -1,3 +1,4 @@
+use std::collections::BTreeSet;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;

@@ -60,6 +61,10 @@ fn inspect() -> ParentHandler<S9pkPath> {
                .with_inherited(only_parent)
                .with_display_serializable(),
        )
+        .subcommand(
+            "cat",
+            from_fn_async(cat).with_inherited(only_parent).no_display(),
+        )
        .subcommand(
            "manifest",
            from_fn_async(inspect_manifest)
@@ -72,109 +77,116 @@ fn inspect() -> ParentHandler<S9pkPath> {
 struct AddImageParams {
    id: ImageId,
    image: String,
+    arches: Option<Vec<String>>,
 }
 async fn add_image(
    ctx: CliContext,
-    AddImageParams { id, image }: AddImageParams,
+    AddImageParams { id, image, arches }: AddImageParams,
    S9pkPath { s9pk: s9pk_path }: S9pkPath,
 ) -> Result<(), Error> {
+    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?, false)
+        .await?
+        .into_dyn();
+    let arches: BTreeSet<_> = arches
+        .unwrap_or_else(|| vec!["x86_64".to_owned(), "aarch64".to_owned()])
+        .into_iter()
+        .collect();
    let tmpdir = TmpDir::new().await?;
-    let sqfs_path = tmpdir.join("image.squashfs");
-    let arch = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("run")
-            .arg("--rm")
-            .arg("--entrypoint")
-            .arg("uname")
-            .arg(&image)
-            .arg("-m")
-            .invoke(ErrorKind::Docker)
-            .await?,
-    )?;
-    let env = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("run")
-            .arg("--rm")
-            .arg("--entrypoint")
-            .arg("env")
-            .arg(&image)
-            .invoke(ErrorKind::Docker)
-            .await?,
-    )?
-    .lines()
-    .filter(|l| {
-        l.trim()
-            .split_once("=")
-            .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
-    })
-    .join("\n")
-        + "\n";
-    let workdir = Path::new(
-        String::from_utf8(
+    for arch in arches {
+        let sqfs_path = tmpdir.join(format!("image.{arch}.squashfs"));
+        let docker_platform = if arch == "x86_64" {
+            "--platform=linux/amd64".to_owned()
+        } else if arch == "aarch64" {
+            "--platform=linux/arm64".to_owned()
+        } else {
+            format!("--platform=linux/{arch}")
+        };
+        let env = String::from_utf8(
            Command::new(CONTAINER_TOOL)
                .arg("run")
                .arg("--rm")
+                .arg(&docker_platform)
                .arg("--entrypoint")
-                .arg("pwd")
+                .arg("env")
                .arg(&image)
                .invoke(ErrorKind::Docker)
                .await?,
        )?
-        .trim(),
-    )
-    .to_owned();
-    let container_id = String::from_utf8(
-        Command::new(CONTAINER_TOOL)
-            .arg("create")
-            .arg(&image)
+        .lines()
+        .filter(|l| {
+            l.trim()
+                .split_once("=")
+                .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+        })
+        .join("\n")
+            + "\n";
+        let workdir = Path::new(
+            String::from_utf8(
+                Command::new(CONTAINER_TOOL)
+                    .arg("run")
+                    .arg(&docker_platform)
+                    .arg("--rm")
+                    .arg("--entrypoint")
+                    .arg("pwd")
+                    .arg(&image)
+                    .invoke(ErrorKind::Docker)
+                    .await?,
+            )?
+            .trim(),
+        )
+        .to_owned();
+        let container_id = String::from_utf8(
+            Command::new(CONTAINER_TOOL)
+                .arg("create")
+                .arg(&docker_platform)
+                .arg(&image)
+                .invoke(ErrorKind::Docker)
+                .await?,
+        )?;
+        Command::new("bash")
+            .arg("-c")
+            .arg(format!(
+                "{CONTAINER_TOOL} export {container_id} | mksquashfs - {sqfs} -tar",
+                container_id = container_id.trim(),
+                sqfs = sqfs_path.display()
+            ))
            .invoke(ErrorKind::Docker)
-            .await?,
-    )?;
-    Command::new("bash")
-        .arg("-c")
-        .arg(format!(
-            "{CONTAINER_TOOL} export {container_id} | mksquashfs - {sqfs} -tar",
-            container_id = container_id.trim(),
-            sqfs = sqfs_path.display()
-        ))
-        .invoke(ErrorKind::Docker)
-        .await?;
-    Command::new(CONTAINER_TOOL)
-        .arg("rm")
-        .arg(container_id.trim())
-        .invoke(ErrorKind::Docker)
-        .await?;
-    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?)
-        .await?
-        .into_dyn();
-    let archive = s9pk.as_archive_mut();
-    archive.set_signer(ctx.developer_key()?.clone());
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("squashfs"),
-        Entry::file(DynFileSource::new(sqfs_path)),
-    )?;
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("env"),
-        Entry::file(DynFileSource::new(Arc::from(Vec::from(env)))),
-    )?;
-    archive.contents_mut().insert_path(
-        Path::new("images")
-            .join(arch.trim())
-            .join(&id)
-            .with_extension("json"),
-        Entry::file(DynFileSource::new(Arc::from(
-            serde_json::to_vec(&serde_json::json!({
-                "workdir": workdir
-            }))
-            .with_kind(ErrorKind::Serialization)?,
-        ))),
-    )?;
+            .await?;
+        Command::new(CONTAINER_TOOL)
+            .arg("rm")
+            .arg(container_id.trim())
+            .invoke(ErrorKind::Docker)
+            .await?;
+        let archive = s9pk.as_archive_mut();
+        archive.set_signer(ctx.developer_key()?.clone());
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("squashfs"),
+            Entry::file(DynFileSource::new(sqfs_path)),
+        )?;
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("env"),
+            Entry::file(DynFileSource::new(Arc::from(Vec::from(env)))),
+        )?;
+        archive.contents_mut().insert_path(
+            Path::new("images")
+                .join(&arch)
+                .join(&id)
+                .with_extension("json"),
+            Entry::file(DynFileSource::new(Arc::from(
+                serde_json::to_vec(&serde_json::json!({
+                    "workdir": workdir
+                }))
+                .with_kind(ErrorKind::Serialization)?,
+            ))),
+        )?;
+    }
+    s9pk.as_manifest_mut().images.insert(id);
    let tmp_path = s9pk_path.with_extension("s9pk.tmp");
    let mut tmp_file = File::create(&tmp_path).await?;
    s9pk.serialize(&mut tmp_file, true).await?;
@@ -193,7 +205,7 @@ async fn edit_manifest(
    EditManifestParams { expression }: EditManifestParams,
    S9pkPath { s9pk: s9pk_path }: S9pkPath,
 ) -> Result<Manifest, Error> {
-    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?).await?;
+    let mut s9pk = S9pk::from_file(super::load(&ctx, &s9pk_path).await?, false).await?;
    let old = serde_json::to_value(s9pk.as_manifest()).with_kind(ErrorKind::Serialization)?;
    *s9pk.as_manifest_mut() = serde_json::from_value(apply_expr(old.into(), &expression)?.into())
        .with_kind(ErrorKind::Serialization)?;
@@ -214,15 +226,45 @@ async fn file_tree(
    _: Empty,
    S9pkPath { s9pk }: S9pkPath,
 ) -> Result<Vec<PathBuf>, Error> {
-    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?).await?;
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
    Ok(s9pk.as_archive().contents().file_paths(""))
 }

+#[derive(Deserialize, Serialize, Parser, TS)]
+#[serde(rename_all = "camelCase")]
+#[command(rename_all = "kebab-case")]
+struct CatParams {
+    file_path: PathBuf,
+}
+async fn cat(
+    ctx: CliContext,
+    CatParams { file_path }: CatParams,
+    S9pkPath { s9pk }: S9pkPath,
+) -> Result<(), Error> {
+    use crate::s9pk::merkle_archive::source::FileSource;
+
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
+    tokio::io::copy(
+        &mut s9pk
+            .as_archive()
+            .contents()
+            .get_path(&file_path)
+            .or_not_found(&file_path.display())?
+            .as_file()
+            .or_not_found(&file_path.display())?
+            .reader()
+            .await?,
+        &mut tokio::io::stdout(),
+    )
+    .await?;
+    Ok(())
+}
+
 async fn inspect_manifest(
    ctx: CliContext,
    _: Empty,
    S9pkPath { s9pk }: S9pkPath,
 ) -> Result<Manifest, Error> {
-    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?).await?;
+    let s9pk = S9pk::from_file(super::load(&ctx, &s9pk).await?, false).await?;
    Ok(s9pk.as_manifest().clone())
 }
--- a/core/startos/src/s9pk/v1/docker.rs
+++ b/core/startos/src/s9pk/v1/docker.rs
@@ -1,4 +1,3 @@
-use std::borrow::Cow;
 use std::collections::BTreeSet;
 use std::io::SeekFrom;
 use std::path::Path;
@@ -10,7 +9,7 @@ use tokio::io::{AsyncRead, AsyncSeek, AsyncSeekExt};
 use tokio_tar::{Archive, Entry};

 use crate::util::io::from_cbor_async_reader;
-use crate::{Error, ErrorKind, ARCH};
+use crate::{Error, ErrorKind};

 #[derive(Default, Deserialize, Serialize)]
 #[serde(rename_all = "camelCase")]
@@ -26,8 +25,8 @@ pub enum DockerReader<R: AsyncRead + Unpin> {
    MultiArch(#[pin] Entry<Archive<R>>),
 }
 impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> DockerReader<R> {
-    pub async fn new(mut rdr: R) -> Result<Self, Error> {
-        let arch = if let Some(multiarch) = tokio_tar::Archive::new(&mut rdr)
+    pub async fn list_arches(rdr: &mut R) -> Result<BTreeSet<String>, Error> {
+        if let Some(multiarch) = tokio_tar::Archive::new(rdr)
            .entries()?
            .try_filter_map(|e| {
                async move {
@@ -43,41 +42,38 @@ impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> DockerReader<R> {
            .await?
        {
            let multiarch: DockerMultiArch = from_cbor_async_reader(multiarch).await?;
-            Some(if multiarch.available.contains(&**ARCH) {
-                Cow::Borrowed(&**ARCH)
-            } else {
-                Cow::Owned(multiarch.default)
-            })
+            Ok(multiarch.available)
        } else {
-            None
-        };
+            Err(Error::new(
+                eyre!("Single arch legacy s9pks not supported"),
+                ErrorKind::ParseS9pk,
+            ))
+        }
+    }
+    pub async fn new(mut rdr: R, arch: &str) -> Result<Self, Error> {
        rdr.seek(SeekFrom::Start(0)).await?;
-        if let Some(arch) = arch {
-            if let Some(image) = tokio_tar::Archive::new(rdr)
-                .entries()?
-                .try_filter_map(|e| {
-                    let arch = arch.clone();
-                    async move {
-                        Ok(if &*e.path()? == Path::new(&format!("{}.tar", arch)) {
-                            Some(e)
-                        } else {
-                            None
-                        })
-                    }
-                    .boxed()
-                })
-                .try_next()
-                .await?
-            {
-                Ok(Self::MultiArch(image))
-            } else {
-                Err(Error::new(
-                    eyre!("Docker image section does not contain tarball for architecture"),
-                    ErrorKind::ParseS9pk,
-                ))
-            }
+        if let Some(image) = tokio_tar::Archive::new(rdr)
+            .entries()?
+            .try_filter_map(|e| {
+                let arch = arch.clone();
+                async move {
+                    Ok(if &*e.path()? == Path::new(&format!("{}.tar", arch)) {
+                        Some(e)
+                    } else {
+                        None
+                    })
+                }
+                .boxed()
+            })
+            .try_next()
+            .await?
+        {
+            Ok(Self::MultiArch(image))
        } else {
-            Ok(Self::SingleArch(rdr))
+            Err(Error::new(
+                eyre!("Docker image section does not contain tarball for architecture"),
+                ErrorKind::ParseS9pk,
+            ))
        }
    }
 }
--- a/core/startos/src/s9pk/v1/reader.rs
+++ b/core/startos/src/s9pk/v1/reader.rs
@@ -1,3 +1,4 @@
+use std::collections::BTreeSet;
 use std::io::SeekFrom;
 use std::ops::Range;
 use std::path::Path;
@@ -158,8 +159,8 @@ impl S9pkReader {
 }
 impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> S9pkReader<R> {
    #[instrument(skip_all)]
-    pub async fn image_tags(&mut self) -> Result<Vec<ImageTag>, Error> {
-        let mut tar = tokio_tar::Archive::new(self.docker_images().await?);
+    pub async fn image_tags(&mut self, arch: &str) -> Result<Vec<ImageTag>, Error> {
+        let mut tar = tokio_tar::Archive::new(self.docker_images(arch).await?);
        let mut entries = tar.entries()?;
        while let Some(mut entry) = entries.try_next().await? {
            if &*entry.path()? != Path::new("manifest.json") {
@@ -280,8 +281,15 @@ impl<R: AsyncRead + AsyncSeek + Unpin + Send + Sync> S9pkReader<R> {
        self.read_handle(self.toc.icon).await
    }

-    pub async fn docker_images(&mut self) -> Result<DockerReader<ReadHandle<'_, R>>, Error> {
-        DockerReader::new(self.read_handle(self.toc.docker_images).await?).await
+    pub async fn docker_arches(&mut self) -> Result<BTreeSet<String>, Error> {
+        DockerReader::list_arches(&mut self.read_handle(self.toc.docker_images).await?).await
+    }
+
+    pub async fn docker_images(
+        &mut self,
+        arch: &str,
+    ) -> Result<DockerReader<ReadHandle<'_, R>>, Error> {
+        DockerReader::new(self.read_handle(self.toc.docker_images).await?, arch).await
    }

    pub async fn assets(&mut self) -> Result<ReadHandle<'_, R>, Error> {
--- a/core/startos/src/s9pk/v2/compat.rs
+++ b/core/startos/src/s9pk/v2/compat.rs
@@ -21,7 +21,6 @@ use crate::s9pk::v1::reader::S9pkReader;
 use crate::s9pk::v2::S9pk;
 use crate::util::io::TmpDir;
 use crate::util::Invoke;
-use crate::ARCH;

 pub const MAGIC_AND_VERSION: &[u8] = &[0x3b, 0x3b, 0x01];

@@ -96,155 +95,166 @@ impl S9pk<Section<MultiCursorFile>> {
        )?;

        // images
-        let images_dir = scratch_dir.join("images");
-        tokio::fs::create_dir_all(&images_dir).await?;
-        Command::new(CONTAINER_TOOL)
-            .arg("load")
-            .input(Some(&mut reader.docker_images().await?))
-            .invoke(ErrorKind::Docker)
-            .await?;
-        #[derive(serde::Deserialize)]
-        #[serde(rename_all = "PascalCase")]
-        struct DockerImagesOut {
-            repository: Option<String>,
-            tag: Option<String>,
-            #[serde(default)]
-            names: Vec<String>,
-        }
-        for image in {
-            #[cfg(feature = "docker")]
-            let images = std::str::from_utf8(
-                &Command::new(CONTAINER_TOOL)
-                    .arg("images")
-                    .arg("--format=json")
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?
-            .lines()
-            .map(|l| serde_json::from_str::<DockerImagesOut>(l))
-            .collect::<Result<Vec<_>, _>>()
-            .with_kind(ErrorKind::Deserialization)?
-            .into_iter();
-            #[cfg(not(feature = "docker"))]
-            let images = serde_json::from_slice::<Vec<DockerImagesOut>>(
-                &Command::new(CONTAINER_TOOL)
-                    .arg("images")
-                    .arg("--format=json")
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )
-            .with_kind(ErrorKind::Deserialization)?
-            .into_iter();
-            images
-        }
-        .flat_map(|i| {
-            if let (Some(repository), Some(tag)) = (i.repository, i.tag) {
-                vec![format!("{repository}:{tag}")]
+        for arch in reader.docker_arches().await? {
+            let images_dir = scratch_dir.join("images").join(&arch);
+            let docker_platform = if arch == "x86_64" {
+                "--platform=linux/amd64".to_owned()
+            } else if arch == "aarch64" {
+                "--platform=linux/arm64".to_owned()
            } else {
-                i.names
-                    .into_iter()
-                    .filter_map(|i| i.strip_prefix("docker.io/").map(|s| s.to_owned()))
-                    .collect()
+                format!("--platform=linux/{arch}")
+            };
+            tokio::fs::create_dir_all(&images_dir).await?;
+            Command::new(CONTAINER_TOOL)
+                .arg("load")
+                .input(Some(&mut reader.docker_images(&arch).await?))
+                .invoke(ErrorKind::Docker)
+                .await?;
+            #[derive(serde::Deserialize)]
+            #[serde(rename_all = "PascalCase")]
+            struct DockerImagesOut {
+                repository: Option<String>,
+                tag: Option<String>,
+                #[serde(default)]
+                names: Vec<String>,
            }
-        })
-        .filter_map(|i| {
-            i.strip_suffix(&format!(":{}", manifest.version))
-                .map(|s| s.to_owned())
-        })
-        .filter_map(|i| {
-            i.strip_prefix(&format!("start9/{}/", manifest.id))
-                .map(|s| s.to_owned())
-        }) {
-            new_manifest.images.insert(image.parse()?);
-            let sqfs_path = images_dir.join(&image).with_extension("squashfs");
-            let image_name = format!("start9/{}/{}:{}", manifest.id, image, manifest.version);
-            let id = String::from_utf8(
-                Command::new(CONTAINER_TOOL)
-                    .arg("create")
-                    .arg(&image_name)
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?;
-            let env = String::from_utf8(
-                Command::new(CONTAINER_TOOL)
-                    .arg("run")
-                    .arg("--rm")
-                    .arg("--entrypoint")
-                    .arg("env")
-                    .arg(&image_name)
-                    .invoke(ErrorKind::Docker)
-                    .await?,
-            )?
-            .lines()
-            .filter(|l| {
-                l.trim()
-                    .split_once("=")
-                    .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+            for image in {
+                #[cfg(feature = "docker")]
+                let images = std::str::from_utf8(
+                    &Command::new(CONTAINER_TOOL)
+                        .arg("images")
+                        .arg("--format=json")
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )?
+                .lines()
+                .map(|l| serde_json::from_str::<DockerImagesOut>(l))
+                .collect::<Result<Vec<_>, _>>()
+                .with_kind(ErrorKind::Deserialization)?
+                .into_iter();
+                #[cfg(not(feature = "docker"))]
+                let images = serde_json::from_slice::<Vec<DockerImagesOut>>(
+                    &Command::new(CONTAINER_TOOL)
+                        .arg("images")
+                        .arg("--format=json")
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )
+                .with_kind(ErrorKind::Deserialization)?
+                .into_iter();
+                images
+            }
+            .flat_map(|i| {
+                if let (Some(repository), Some(tag)) = (i.repository, i.tag) {
+                    vec![format!("{repository}:{tag}")]
+                } else {
+                    i.names
+                        .into_iter()
+                        .filter_map(|i| i.strip_prefix("docker.io/").map(|s| s.to_owned()))
+                        .collect()
+                }
            })
-            .join("\n")
-                + "\n";
-            let workdir = Path::new(
-                String::from_utf8(
+            .filter_map(|i| {
+                i.strip_suffix(&format!(":{}", manifest.version))
+                    .map(|s| s.to_owned())
+            })
+            .filter_map(|i| {
+                i.strip_prefix(&format!("start9/{}/", manifest.id))
+                    .map(|s| s.to_owned())
+            }) {
+                new_manifest.images.insert(image.parse()?);
+                let sqfs_path = images_dir.join(&image).with_extension("squashfs");
+                let image_name = format!("start9/{}/{}:{}", manifest.id, image, manifest.version);
+                let id = String::from_utf8(
+                    Command::new(CONTAINER_TOOL)
+                        .arg("create")
+                        .arg(&docker_platform)
+                        .arg(&image_name)
+                        .invoke(ErrorKind::Docker)
+                        .await?,
+                )?;
+                let env = String::from_utf8(
                    Command::new(CONTAINER_TOOL)
                        .arg("run")
                        .arg("--rm")
+                        .arg(&docker_platform)
                        .arg("--entrypoint")
-                        .arg("pwd")
+                        .arg("env")
                        .arg(&image_name)
                        .invoke(ErrorKind::Docker)
                        .await?,
                )?
-                .trim(),
-            )
-            .to_owned();
-            Command::new("bash")
-                .arg("-c")
-                .arg(format!(
-                    "{CONTAINER_TOOL} export {id} | mksquashfs - {sqfs} -tar",
-                    id = id.trim(),
-                    sqfs = sqfs_path.display()
-                ))
-                .invoke(ErrorKind::Docker)
-                .await?;
-            Command::new(CONTAINER_TOOL)
-                .arg("rm")
-                .arg(id.trim())
-                .invoke(ErrorKind::Docker)
-                .await?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("squashfs"),
-                Entry::file(CompatSource::File(sqfs_path)),
-            )?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("env"),
-                Entry::file(CompatSource::Buffered(Vec::from(env).into())),
-            )?;
-            archive.insert_path(
-                Path::new("images")
-                    .join(&*ARCH)
-                    .join(&image)
-                    .with_extension("json"),
-                Entry::file(CompatSource::Buffered(
-                    serde_json::to_vec(&serde_json::json!({
-                        "workdir": workdir
-                    }))
-                    .with_kind(ErrorKind::Serialization)?
-                    .into(),
-                )),
-            )?;
+                .lines()
+                .filter(|l| {
+                    l.trim()
+                        .split_once("=")
+                        .map_or(false, |(v, _)| !SKIP_ENV.contains(&v))
+                })
+                .join("\n")
+                    + "\n";
+                let workdir = Path::new(
+                    String::from_utf8(
+                        Command::new(CONTAINER_TOOL)
+                            .arg("run")
+                            .arg("--rm")
+                            .arg(&docker_platform)
+                            .arg("--entrypoint")
+                            .arg("pwd")
+                            .arg(&image_name)
+                            .invoke(ErrorKind::Docker)
+                            .await?,
+                    )?
+                    .trim(),
+                )
+                .to_owned();
+                Command::new("bash")
+                    .arg("-c")
+                    .arg(format!(
+                        "{CONTAINER_TOOL} export {id} | mksquashfs - {sqfs} -tar",
+                        id = id.trim(),
+                        sqfs = sqfs_path.display()
+                    ))
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+                Command::new(CONTAINER_TOOL)
+                    .arg("rm")
+                    .arg(id.trim())
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("squashfs"),
+                    Entry::file(CompatSource::File(sqfs_path)),
+                )?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("env"),
+                    Entry::file(CompatSource::Buffered(Vec::from(env).into())),
+                )?;
+                archive.insert_path(
+                    Path::new("images")
+                        .join(&arch)
+                        .join(&image)
+                        .with_extension("json"),
+                    Entry::file(CompatSource::Buffered(
+                        serde_json::to_vec(&serde_json::json!({
+                            "workdir": workdir
+                        }))
+                        .with_kind(ErrorKind::Serialization)?
+                        .into(),
+                    )),
+                )?;
+                Command::new(CONTAINER_TOOL)
+                    .arg("rmi")
+                    .arg(&image_name)
+                    .invoke(ErrorKind::Docker)
+                    .await?;
+            }
        }
-        Command::new(CONTAINER_TOOL)
-            .arg("image")
-            .arg("prune")
-            .arg("-af")
-            .invoke(ErrorKind::Docker)
-            .await?;

        // assets
        let asset_dir = scratch_dir.join("assets");
@@ -312,9 +322,10 @@ impl S9pk<Section<MultiCursorFile>> {

        scratch_dir.delete().await?;

-        Ok(S9pk::deserialize(&MultiCursorFile::from(
-            File::open(destination.as_ref()).await?,
-        ))
+        Ok(S9pk::deserialize(
+            &MultiCursorFile::from(File::open(destination.as_ref()).await?),
+            false,
+        )
        .await?)
    }
 }
--- a/core/startos/src/s9pk/v2/mod.rs
+++ b/core/startos/src/s9pk/v2/mod.rs
@@ -173,7 +173,7 @@ impl<S: FileSource> S9pk<S> {

 impl<S: ArchiveSource> S9pk<Section<S>> {
    #[instrument(skip_all)]
-    pub async fn deserialize(source: &S) -> Result<Self, Error> {
+    pub async fn deserialize(source: &S, apply_filter: bool) -> Result<Self, Error> {
        use tokio::io::AsyncReadExt;

        let mut header = source
@@ -193,7 +193,9 @@ impl<S: ArchiveSource> S9pk<Section<S>> {

        let mut archive = MerkleArchive::deserialize(source, &mut header).await?;

-        archive.filter(filter)?;
+        if apply_filter {
+            archive.filter(filter)?;
+        }

        archive.sort_by(|a, b| match (priority(a), priority(b)) {
            (Some(a), Some(b)) => a.cmp(&b),
@@ -206,11 +208,15 @@ impl<S: ArchiveSource> S9pk<Section<S>> {
    }
 }
 impl S9pk {
-    pub async fn from_file(file: File) -> Result<Self, Error> {
-        Self::deserialize(&MultiCursorFile::from(file)).await
+    pub async fn from_file(file: File, apply_filter: bool) -> Result<Self, Error> {
+        Self::deserialize(&MultiCursorFile::from(file), apply_filter).await
    }
-    pub async fn open(path: impl AsRef<Path>, id: Option<&PackageId>) -> Result<Self, Error> {
-        let res = Self::from_file(tokio::fs::File::open(path).await?).await?;
+    pub async fn open(
+        path: impl AsRef<Path>,
+        id: Option<&PackageId>,
+        apply_filter: bool,
+    ) -> Result<Self, Error> {
+        let res = Self::from_file(tokio::fs::File::open(path).await?, apply_filter).await?;
        if let Some(id) = id {
            ensure_code!(
                &res.as_manifest().id == id,
--- a/core/startos/src/service/mod.rs
+++ b/core/startos/src/service/mod.rs
@@ -13,12 +13,14 @@ use start_stop::StartStop;
 use tokio::sync::Notify;
 use ts_rs::TS;

+use crate::context::{CliContext, RpcContext};
 use crate::core::rpc_continuations::RequestGuid;
 use crate::db::model::package::{
    InstalledState, PackageDataEntry, PackageState, PackageStateMatchModelRef, UpdatingState,
 };
 use crate::disk::mount::guard::GenericMountGuard;
 use crate::install::PKG_ARCHIVE_DIR;
+use crate::lxc::ContainerId;
 use crate::prelude::*;
 use crate::progress::{NamedProgress, Progress};
 use crate::s9pk::S9pk;
@@ -31,10 +33,6 @@ use crate::util::actor::concurrent::ConcurrentActor;
 use crate::util::actor::Actor;
 use crate::util::serde::Pem;
 use crate::volume::data_dir;
-use crate::{
-    context::{CliContext, RpcContext},
-    lxc::ContainerId,
-};

 mod action;
 pub mod cli;
@@ -138,7 +136,7 @@ impl Service {
        match entry.as_state_info().as_match() {
            PackageStateMatchModelRef::Installing(_) => {
                if disposition == LoadDisposition::Retry {
-                    if let Ok(s9pk) = S9pk::open(s9pk_path, Some(id)).await.map_err(|e| {
+                    if let Ok(s9pk) = S9pk::open(s9pk_path, Some(id), true).await.map_err(|e| {
                        tracing::error!("Error opening s9pk for install: {e}");
                        tracing::debug!("{e:?}")
                    }) {
@@ -171,7 +169,7 @@ impl Service {
                                && progress == &Progress::Complete(true)
                        })
                {
-                    if let Ok(s9pk) = S9pk::open(&s9pk_path, Some(id)).await.map_err(|e| {
+                    if let Ok(s9pk) = S9pk::open(&s9pk_path, Some(id), true).await.map_err(|e| {
                        tracing::error!("Error opening s9pk for update: {e}");
                        tracing::debug!("{e:?}")
                    }) {
@@ -190,7 +188,7 @@ impl Service {
                        }
                    }
                }
-                let s9pk = S9pk::open(s9pk_path, Some(id)).await?;
+                let s9pk = S9pk::open(s9pk_path, Some(id), true).await?;
                ctx.db
                    .mutate({
                        |db| {
@@ -215,7 +213,7 @@ impl Service {
                handle_installed(s9pk, entry).await
            }
            PackageStateMatchModelRef::Removing(_) | PackageStateMatchModelRef::Restoring(_) => {
-                if let Ok(s9pk) = S9pk::open(s9pk_path, Some(id)).await.map_err(|e| {
+                if let Ok(s9pk) = S9pk::open(s9pk_path, Some(id), true).await.map_err(|e| {
                    tracing::error!("Error opening s9pk for removal: {e}");
                    tracing::debug!("{e:?}")
                }) {
@@ -243,7 +241,7 @@ impl Service {
                Ok(None)
            }
            PackageStateMatchModelRef::Installed(_) => {
-                handle_installed(S9pk::open(s9pk_path, Some(id)).await?, entry).await
+                handle_installed(S9pk::open(s9pk_path, Some(id), true).await?, entry).await
            }
            PackageStateMatchModelRef::Error(e) => Err(Error::new(
                eyre!("Failed to parse PackageDataEntry, found {e:?}"),
@@ -349,6 +347,7 @@ impl Service {
        }
        Ok(())
    }
+
    pub async fn backup(&self, _guard: impl GenericMountGuard) -> Result<BackupReturn, Error> {
        // TODO
        Err(Error::new(eyre!("not yet implemented"), ErrorKind::Unknown))
--- a/core/startos/src/service/persistent_container.rs
+++ b/core/startos/src/service/persistent_container.rs
@@ -4,7 +4,7 @@ use std::sync::{Arc, Weak};
 use std::time::Duration;

 use futures::future::ready;
-use futures::Future;
+use futures::{Future, FutureExt};
 use helpers::NonDetachingJoinHandle;
 use imbl_value::InternedString;
 use models::{ProcedureName, VolumeId};
@@ -92,6 +92,7 @@ pub struct PersistentContainer {
    pub(super) overlays: Arc<Mutex<BTreeMap<InternedString, OverlayGuard>>>,
    pub(super) state: Arc<watch::Sender<ServiceState>>,
    pub(super) net_service: Mutex<NetService>,
+    destroyed: bool,
 }

 impl PersistentContainer {
@@ -217,6 +218,7 @@ impl PersistentContainer {
            overlays: Arc::new(Mutex::new(BTreeMap::new())),
            state: Arc::new(watch::channel(ServiceState::new(start)).0),
            net_service: Mutex::new(net_service),
+            destroyed: false,
        })
    }

@@ -285,7 +287,10 @@ impl PersistentContainer {
    }

    #[instrument(skip_all)]
-    fn destroy(&mut self) -> impl Future<Output = Result<(), Error>> + 'static {
+    fn destroy(&mut self) -> Option<impl Future<Output = Result<(), Error>> + 'static> {
+        if self.destroyed {
+            return None;
+        }
        let rpc_client = self.rpc_client.clone();
        let rpc_server = self.rpc_server.send_replace(None);
        let js_mount = self.js_mount.take();
@@ -293,33 +298,45 @@ impl PersistentContainer {
        let assets = std::mem::take(&mut self.assets);
        let overlays = self.overlays.clone();
        let lxc_container = self.lxc_container.take();
-        async move {
-            let mut errs = ErrorCollection::new();
-            if let Some((hdl, shutdown)) = rpc_server {
-                errs.handle(rpc_client.request(rpc::Exit, Empty {}).await);
-                shutdown.shutdown();
-                errs.handle(hdl.await.with_kind(ErrorKind::Cancelled));
+        self.destroyed = true;
+        Some(
+            async move {
+                dbg!(
+                    async move {
+                        let mut errs = ErrorCollection::new();
+                        if let Some((hdl, shutdown)) = rpc_server {
+                            errs.handle(rpc_client.request(rpc::Exit, Empty {}).await);
+                            shutdown.shutdown();
+                            errs.handle(hdl.await.with_kind(ErrorKind::Cancelled));
+                        }
+                        for (_, volume) in volumes {
+                            errs.handle(volume.unmount(true).await);
+                        }
+                        for (_, assets) in assets {
+                            errs.handle(assets.unmount(true).await);
+                        }
+                        for (_, overlay) in std::mem::take(&mut *overlays.lock().await) {
+                            errs.handle(overlay.unmount(true).await);
+                        }
+                        errs.handle(js_mount.unmount(true).await);
+                        if let Some(lxc_container) = lxc_container {
+                            errs.handle(lxc_container.exit().await);
+                        }
+                        dbg!(errs.into_result())
+                    }
+                    .await
+                )
            }
-            for (_, volume) in volumes {
-                errs.handle(volume.unmount(true).await);
-            }
-            for (_, assets) in assets {
-                errs.handle(assets.unmount(true).await);
-            }
-            for (_, overlay) in std::mem::take(&mut *overlays.lock().await) {
-                errs.handle(overlay.unmount(true).await);
-            }
-            errs.handle(js_mount.unmount(true).await);
-            if let Some(lxc_container) = lxc_container {
-                errs.handle(lxc_container.exit().await);
-            }
-            errs.into_result()
-        }
+            .map(|a| dbg!(a)),
+        )
    }

    #[instrument(skip_all)]
    pub async fn exit(mut self) -> Result<(), Error> {
-        self.destroy().await?;
+        if let Some(destroy) = self.destroy() {
+            dbg!(destroy.await)?;
+        }
+        tracing::info!("Service for {} exited", self.s9pk.as_manifest().id);

        Ok(())
    }
@@ -416,7 +433,8 @@ impl PersistentContainer {

 impl Drop for PersistentContainer {
    fn drop(&mut self) {
-        let destroy = self.destroy();
-        tokio::spawn(async move { destroy.await.unwrap() });
+        if let Some(destroy) = self.destroy() {
+            tokio::spawn(async move { destroy.await.unwrap() });
+        }
    }
 }
--- a/core/startos/src/service/service_effect_handler.rs
+++ b/core/startos/src/service/service_effect_handler.rs
@@ -1165,6 +1165,7 @@ async fn set_dependencies(
                        .join(&format!("package/v2/{}.s9pk?spec={}", dep_id, version_spec))?,
                )
                .await?,
+                true,
            )
            .await?;

--- a/core/startos/src/service/service_map.rs
+++ b/core/startos/src/service/service_map.rs
@@ -42,10 +42,9 @@ pub struct InstallProgressHandles {
 pub struct ServiceMap(Mutex<OrdMap<PackageId, Arc<RwLock<Option<Service>>>>>);
 impl ServiceMap {
    async fn entry(&self, id: &PackageId) -> Arc<RwLock<Option<Service>>> {
-        self.0
-            .lock()
-            .await
-            .entry(id.clone())
+        let mut lock = self.0.lock().await;
+        dbg!(lock.keys().collect::<Vec<_>>());
+        lock.entry(id.clone())
            .or_insert_with(|| Arc::new(RwLock::new(None)))
            .clone()
    }
@@ -230,7 +229,7 @@ impl ServiceMap {
                .await?;
            Ok(reload_guard
                .handle_last(async move {
-                    let s9pk = S9pk::open(&installed_path, Some(&id)).await?;
+                    let s9pk = S9pk::open(&installed_path, Some(&id), true).await?;
                    let prev = if let Some(service) = service.take() {
                        ensure_code!(
                            recovery_source.is_none(),
@@ -293,9 +292,14 @@ impl ServiceMap {
    /// This is ran during the cleanup, so when we are uninstalling the service
    #[instrument(skip_all)]
    pub async fn uninstall(&self, ctx: &RpcContext, id: &PackageId) -> Result<(), Error> {
-        if let Some(service) = self.get_mut(id).await.take() {
+        let mut guard = self.get_mut(id).await;
+        if let Some(service) = guard.take() {
            ServiceReloadGuard::new(ctx.clone(), id.clone(), "Uninstall")
-                .handle_last(service.uninstall(None))
+                .handle_last(async move {
+                    let res = service.uninstall(None).await;
+                    drop(guard);
+                    res
+                })
                .await?;
        }
        Ok(())
--- a/core/startos/src/util/actor/concurrent.rs
+++ b/core/startos/src/util/actor/concurrent.rs
@@ -96,7 +96,7 @@ impl<A: Actor + Clone> Future for ConcurrentRunner<A> {
            cont
        } {}
        let _ = this.bg_runner.as_mut().poll(cx);
-        if this.waiting.is_empty() && this.handlers.is_empty() && this.bg_runner.is_empty() {
+        if this.waiting.is_empty() && this.handlers.is_empty() && this.recv.is_closed() {
            std::task::Poll::Ready(())
        } else {
            std::task::Poll::Pending
--- a/core/startos/src/util/mod.rs
+++ b/core/startos/src/util/mod.rs
@@ -498,7 +498,7 @@ impl<'a, T> From<&'a T> for MaybeOwned<'a, T> {

 pub fn new_guid() -> InternedString {
    use rand::RngCore;
-    let mut buf = [0; 40];
+    let mut buf = [0; 20];
    rand::thread_rng().fill_bytes(&mut buf);
    InternedString::intern(base32::encode(
        base32::Alphabet::RFC4648 { padding: false },
--- a/debian/postinst
+++ b/debian/postinst
@@ -6,7 +6,7 @@ if [ -n "$DPKG_MAINTSCRIPT_PACKAGE" ]; then
 	  SYSTEMCTL=deb-systemd-helper
 fi

-if [ -f /usr/sbin/grub-probe ]; then
+if [ -f /usr/sbin/grub-probe ] && ! [ -L /usr/sbin/grub-probe ]; then
  mv /usr/sbin/grub-probe /usr/sbin/grub-probe-default
  ln -s /usr/lib/startos/scripts/grub-probe-eos /usr/sbin/grub-probe
 fi
@@ -84,7 +84,9 @@ if cat /usr/lib/startos/ENVIRONMENT.txt | grep '(^|-)docker(-|$)'; then
    mkdir -p /etc/docker
    echo '{ "storage-driver": "overlay2" }' > /etc/docker/daemon.json
 else
-    podman network create -d bridge --subnet 172.18.0.1/24 --opt com.docker.network.bridge.name=br-start9 start9
+    if ! podman network ls | grep start9; then
+        podman network create -d bridge --subnet 172.18.0.1/24 --opt com.docker.network.bridge.name=br-start9 start9
+    fi
 fi
 mkdir -p /etc/nginx/ssl

@@ -110,12 +112,14 @@ echo "fs.inotify.max_user_watches=1048576" > /etc/sysctl.d/97-embassy.conf
 locale-gen en_GB en_GB.UTF-8 
 echo "locales locales/locales_to_be_generated multiselect en_GB.UTF-8 UTF-8" | debconf-set-selections
 update-locale  LANGUAGE
-rm "/etc/locale.gen"
+rm -f "/etc/locale.gen"
 dpkg-reconfigure --frontend noninteractive locales

-groupadd embassy
+if ! getent group | grep '^embassy:'; then
+    groupadd embassy
+fi

-ln -s /usr/lib/startos/scripts/dhclient-exit-hook /etc/dhcp/dhclient-exit-hooks.d/embassy
+ln -sf /usr/lib/startos/scripts/dhclient-exit-hook /etc/dhcp/dhclient-exit-hooks.d/embassy

 rm -f /etc/motd
 ln -sf /usr/lib/startos/motd /etc/update-motd.d/00-embassy
@@ -123,7 +127,15 @@ chmod -x /etc/update-motd.d/*
 chmod +x /etc/update-motd.d/00-embassy

 # LXC
-echo "root:100000:65536" >>/etc/subuid
-echo "root:100000:65536" >>/etc/subgid
-echo "lxc.idmap = u 0 100000 65536" >>/etc/lxc/default.conf
-echo "lxc.idmap = g 0 100000 65536" >>/etc/lxc/default.conf
+cat /etc/subuid | grep -v '^root:' > /etc/subuid.tmp || true
+echo "root:100000:65536" >> /etc/subuid.tmp
+mv /etc/subuid.tmp /etc/subuid
+
+cat /etc/subgid | grep -v '^root:' > /etc/subgid.tmp || true
+echo "root:100000:65536" >> /etc/subgid.tmp
+mv /etc/subgid.tmp /etc/subgid
+
+cat /etc/lxc/default.conf | grep -v '^lxc\.idmap = [ug]' > /etc/lxc/default.conf.tmp || true
+echo "lxc.idmap = u 0 100000 65536" >> /etc/lxc/default.conf.tmp
+echo "lxc.idmap = g 0 100000 65536" >> /etc/lxc/default.conf.tmp
+mv /etc/lxc/default.conf.tmp /etc/lxc/default.conf
--- a/sdk/Makefile
+++ b/sdk/Makefile
@@ -1,19 +1,23 @@
-TS_FILES := $(shell find ./**/*.ts )
+TS_FILES := $(shell git ls-files lib) lib/test/output.ts
 version = $(shell git tag --sort=committerdate | tail -1)
+
+.PHONY: test clean bundle fmt buildOutput check
+
 test: $(TS_FILES) lib/test/output.ts
 	npm test

 clean:
-	rm -rf dist/* | true
+	rm -rf dist
+	rm -f lib/test/output.ts
+	rm -rf node_modules
 	
-lib/test/output.ts: lib/test/makeOutput.ts scripts/oldSpecToBuilder.ts
+lib/test/output.ts: node_modules lib/test/makeOutput.ts scripts/oldSpecToBuilder.ts
 	npm run buildOutput

-buildOutput: lib/test/output.ts fmt
-	echo 'done'
+bundle: dist | test fmt
+	touch dist

-
-bundle: $(TS_FILES) package.json .FORCE node_modules test fmt
+dist: $(TS_FILES) package.json node_modules README.md LICENSE
 	npx tsc
 	npx tsc --project tsconfig-cjs.json
 	cp package.json dist/package.json
@@ -21,9 +25,7 @@ bundle: $(TS_FILES) package.json .FORCE node_modules test fmt
 	cp LICENSE dist/LICENSE
 	touch dist

-full-bundle:
-	make clean
-	make bundle
+full-bundle: clean bundle

 check:
 	npm run check
@@ -32,13 +34,10 @@ fmt: node_modules
 	npx prettier --write "**/*.ts"

 node_modules: package.json
-	npm install
+	npm ci

-publish: clean bundle	 package.json README.md LICENSE
+publish: clean bundle package.json README.md LICENSE
 	cd dist && npm publish --access=public
-link: bundle	
-	cp package.json dist/package.json
-	cp README.md dist/README.md
-	cp LICENSE dist/LICENSE
+
+link: bundle
 	cd dist && npm link
-.FORCE: 
--- a/sdk/lib/interfaces/Host.ts
+++ b/sdk/lib/interfaces/Host.ts
@@ -1,10 +1,10 @@
 import { object, string } from "ts-matches"
 import { Effects } from "../types"
 import { Origin } from "./Origin"
-import { AddSslOptions } from "../../../core/startos/bindings/AddSslOptions"
-import { Security } from "../../../core/startos/bindings/Security"
-import { BindOptions } from "../../../core/startos/bindings/BindOptions"
-import { AlpnInfo } from "../../../core/startos/bindings/AlpnInfo"
+import { AddSslOptions } from ".././osBindings"
+import { Security } from ".././osBindings"
+import { BindOptions } from ".././osBindings"
+import { AlpnInfo } from ".././osBindings"

 export { AddSslOptions, Security, BindOptions }

--- a/core/startos/bindings/ActionId.ts
+++ b/core/startos/bindings/ActionId.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type ActionId = string;
+export type ActionId = string
--- a/sdk/lib/osBindings/ActionMetadata.ts
+++ b/sdk/lib/osBindings/ActionMetadata.ts
@@ -0,0 +1,12 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AllowedStatuses } from "./AllowedStatuses"
+
+export type ActionMetadata = {
+  name: string
+  description: string
+  warning: string | null
+  input: any
+  disabled: boolean
+  allowedStatuses: AllowedStatuses
+  group: string | null
+}
--- a/core/startos/bindings/AddSslOptions.ts
+++ b/core/startos/bindings/AddSslOptions.ts
@@ -1,8 +1,8 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AlpnInfo } from "./AlpnInfo";
+import type { AlpnInfo } from "./AlpnInfo"

 export type AddSslOptions = {
-  scheme: string | null;
-  preferredExternalPort: number;
-  alpn: AlpnInfo;
-};
+  scheme: string | null
+  preferredExternalPort: number
+  alpn: AlpnInfo
+}
--- a/sdk/lib/osBindings/AddressInfo.ts
+++ b/sdk/lib/osBindings/AddressInfo.ts
@@ -0,0 +1,10 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { BindOptions } from "./BindOptions"
+import type { HostId } from "./HostId"
+
+export type AddressInfo = {
+  username: string | null
+  hostId: HostId
+  bindOptions: BindOptions
+  suffix: string
+}
--- a/core/startos/bindings/Alerts.ts
+++ b/core/startos/bindings/Alerts.ts
@@ -1,9 +1,9 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

 export type Alerts = {
-  install: string | null;
-  uninstall: string | null;
-  restore: string | null;
-  start: string | null;
-  stop: string | null;
-};
+  install: string | null
+  uninstall: string | null
+  restore: string | null
+  start: string | null
+  stop: string | null
+}
--- a/core/startos/bindings/Algorithm.ts
+++ b/core/startos/bindings/Algorithm.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type Algorithm = "ecdsa" | "ed25519";
+export type Algorithm = "ecdsa" | "ed25519"
--- a/core/startos/bindings/AllPackageData.ts
+++ b/core/startos/bindings/AllPackageData.ts
@@ -1,5 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { PackageDataEntry } from "./PackageDataEntry";
-import type { PackageId } from "./PackageId";
+import type { PackageDataEntry } from "./PackageDataEntry"
+import type { PackageId } from "./PackageId"

-export type AllPackageData = { [key: PackageId]: PackageDataEntry };
+export type AllPackageData = { [key: PackageId]: PackageDataEntry }
--- a/core/startos/bindings/AllowedStatuses.ts
+++ b/core/startos/bindings/AllowedStatuses.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type AllowedStatuses = "onlyRunning" | "onlyStopped" | "any";
+export type AllowedStatuses = "onlyRunning" | "onlyStopped" | "any"
--- a/core/startos/bindings/AlpnInfo.ts
+++ b/core/startos/bindings/AlpnInfo.ts
@@ -1,4 +1,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { MaybeUtf8String } from "./MaybeUtf8String";
+import type { MaybeUtf8String } from "./MaybeUtf8String"

-export type AlpnInfo = "reflect" | { specified: Array<MaybeUtf8String> };
+export type AlpnInfo = "reflect" | { specified: Array<MaybeUtf8String> }
--- a/core/startos/bindings/DependencyKind.ts
+++ b/core/startos/bindings/DependencyKind.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type DependencyKind = "exists" | "running";
+export type BackupProgress = { complete: boolean }
--- a/core/startos/bindings/BindInfo.ts
+++ b/core/startos/bindings/BindInfo.ts
@@ -1,4 +1,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { BindOptions } from "./BindOptions";
+import type { BindOptions } from "./BindOptions"

-export type BindInfo = { options: BindOptions; assignedLanPort: number | null };
+export type BindInfo = { options: BindOptions; assignedLanPort: number | null }
--- a/sdk/lib/osBindings/BindOptions.ts
+++ b/sdk/lib/osBindings/BindOptions.ts
@@ -0,0 +1,10 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AddSslOptions } from "./AddSslOptions"
+import type { Security } from "./Security"
+
+export type BindOptions = {
+  scheme: string | null
+  preferredExternalPort: number
+  addSsl: AddSslOptions | null
+  secure: Security | null
+}
--- a/sdk/lib/osBindings/BindParams.ts
+++ b/sdk/lib/osBindings/BindParams.ts
@@ -0,0 +1,15 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AddSslOptions } from "./AddSslOptions"
+import type { HostId } from "./HostId"
+import type { HostKind } from "./HostKind"
+import type { Security } from "./Security"
+
+export type BindParams = {
+  kind: HostKind
+  id: HostId
+  internalPort: number
+  scheme: string | null
+  preferredExternalPort: number
+  addSsl: AddSslOptions | null
+  secure: Security | null
+}
--- a/core/startos/bindings/Callback.ts
+++ b/core/startos/bindings/Callback.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type Callback = () => void;
+export type Callback = () => void
--- a/core/startos/bindings/ChrootParams.ts
+++ b/core/startos/bindings/ChrootParams.ts
@@ -1,10 +1,10 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

 export type ChrootParams = {
-  env: string | null;
-  workdir: string | null;
-  user: string | null;
-  path: string;
-  command: string;
-  args: string[];
-};
+  env: string | null
+  workdir: string | null
+  user: string | null
+  path: string
+  command: string
+  args: string[]
+}
--- a/sdk/lib/osBindings/CreateOverlayedImageParams.ts
+++ b/sdk/lib/osBindings/CreateOverlayedImageParams.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type CreateOverlayedImageParams = { imageId: string }
--- a/core/startos/bindings/CurrentDependencies.ts
+++ b/core/startos/bindings/CurrentDependencies.ts
@@ -1,5 +1,5 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { CurrentDependencyInfo } from "./CurrentDependencyInfo";
-import type { PackageId } from "./PackageId";
+import type { CurrentDependencyInfo } from "./CurrentDependencyInfo"
+import type { PackageId } from "./PackageId"

-export type CurrentDependencies = { [key: PackageId]: CurrentDependencyInfo };
+export type CurrentDependencies = { [key: PackageId]: CurrentDependencyInfo }
--- a/core/startos/bindings/CurrentDependencyInfo.ts
+++ b/core/startos/bindings/CurrentDependencyInfo.ts
@@ -1,10 +1,10 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { DataUrl } from "./DataUrl";
+import type { DataUrl } from "./DataUrl"

 export type CurrentDependencyInfo = {
-  title: string;
-  icon: DataUrl;
-  registryUrl: string;
-  versionSpec: string;
-  configSatisfied: boolean;
-} & ({ kind: "exists" } | { kind: "running"; healthChecks: string[] });
+  title: string
+  icon: DataUrl
+  registryUrl: string
+  versionSpec: string
+  configSatisfied: boolean
+} & ({ kind: "exists" } | { kind: "running"; healthChecks: string[] })
--- a/core/startos/bindings/DataUrl.ts
+++ b/core/startos/bindings/DataUrl.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type DataUrl = string;
+export type DataUrl = string
--- a/core/startos/bindings/DepInfo.ts
+++ b/core/startos/bindings/DepInfo.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type DepInfo = { description: string | null; optional: boolean };
+export type DepInfo = { description: string | null; optional: boolean }
--- a/sdk/lib/osBindings/Dependencies.ts
+++ b/sdk/lib/osBindings/Dependencies.ts
@@ -0,0 +1,5 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { DepInfo } from "./DepInfo"
+import type { PackageId } from "./PackageId"
+
+export type Dependencies = { [key: PackageId]: DepInfo }
--- a/sdk/lib/osBindings/DependencyKind.ts
+++ b/sdk/lib/osBindings/DependencyKind.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type DependencyKind = "exists" | "running"
--- a/core/startos/bindings/DependencyRequirement.ts
+++ b/core/startos/bindings/DependencyRequirement.ts
@@ -2,10 +2,10 @@

 export type DependencyRequirement =
  | {
-      kind: "running";
-      id: string;
-      healthChecks: string[];
-      versionSpec: string;
-      registryUrl: string;
+      kind: "running"
+      id: string
+      healthChecks: string[]
+      versionSpec: string
+      registryUrl: string
    }
-  | { kind: "exists"; id: string; versionSpec: string; registryUrl: string };
+  | { kind: "exists"; id: string; versionSpec: string; registryUrl: string }
--- a/sdk/lib/osBindings/Description.ts
+++ b/sdk/lib/osBindings/Description.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type Description = { short: string; long: string }
--- a/sdk/lib/osBindings/DestroyOverlayedImageParams.ts
+++ b/sdk/lib/osBindings/DestroyOverlayedImageParams.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type Description = { short: string; long: string };
+export type DestroyOverlayedImageParams = { guid: string }
--- a/core/startos/bindings/Duration.ts
+++ b/core/startos/bindings/Duration.ts
@@ -1,3 +1,3 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

-export type Duration = string;
+export type Duration = string
--- a/sdk/lib/osBindings/EncryptedWire.ts
+++ b/sdk/lib/osBindings/EncryptedWire.ts
@@ -0,0 +1,3 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+export type EncryptedWire = { encrypted: any }
--- a/core/startos/bindings/ExecuteAction.ts
+++ b/core/startos/bindings/ExecuteAction.ts
@@ -1,7 +1,7 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.

 export type ExecuteAction = {
-  serviceId: string | null;
-  actionId: string;
-  input: any;
-};
+  serviceId: string | null
+  actionId: string
+  input: any
+}
--- a/core/startos/bindings/ExportActionParams.ts
+++ b/core/startos/bindings/ExportActionParams.ts
@@ -1,4 +1,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ActionMetadata } from "./ActionMetadata";
+import type { ActionMetadata } from "./ActionMetadata"

-export type ExportActionParams = { id: string; metadata: ActionMetadata };
+export type ExportActionParams = { id: string; metadata: ActionMetadata }
--- a/sdk/lib/osBindings/ExportServiceInterfaceParams.ts
+++ b/sdk/lib/osBindings/ExportServiceInterfaceParams.ts
@@ -0,0 +1,14 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AddressInfo } from "./AddressInfo"
+import type { ServiceInterfaceType } from "./ServiceInterfaceType"
+
+export type ExportServiceInterfaceParams = {
+  id: string
+  name: string
+  description: string
+  hasPrimary: boolean
+  disabled: boolean
+  masked: boolean
+  addressInfo: AddressInfo
+  type: ServiceInterfaceType
+}
--- a/Show More
+++ b/Show More