Removed
-
The HTTP SSH key-authorization endpoint (
POST /authorize-keyon port 9000) is gone, along with its handler, its rate limiter, and the/tmp/lager-authorized-keys.dstaging directory it wrote to. The endpoint let any caller holding the bearer token create an arbitrarily-labelled.pubfile, and the keys it created could never be removed, because the old sync only appended. It was also the first link in a privilege-escalation chain: a container-side file write became host SSH access, and from there host root via the privileged runtime container. If you provision boxes through this endpoint, switch to writing<name>.pubinto/etc/lager/authorized_keys.d/directly. That directory is bind-mounted into the runtime container, so a control plane can still write it from inside the container before it has SSH access — the bootstrap path is unchanged, and keys still appear in~/.ssh/authorized_keyswithin about five seconds. No CLI command called this endpoint, so command-line workflows are unaffected.
Changed
-
~/.ssh/authorized_keysis now rebuilt from the key directory rather than appended to. The box owns only the region between its# BEGIN LAGER MANAGED KEYSand# END LAGER MANAGED KEYSmarkers, and regenerates that region on every pass, writing a temp file and renaming sosshdnever sees a partial file. Deleting a.pubnow revokes the key, which was previously impossible, and the old check-then-append race can no longer duplicate lines — boxes have been found with five entries built from three key files. Keys installed by any other route —lager ssh-setup,ssh-copy-id, cloud-init — live outside the marked region and are preserved byte-for-byte. A key that is also published through the key directory becomes managed, though, so deleting its.publater removes it outright, including the copy the other route installed. Use a distinct key per access path when the two must be revoked independently. Another system that manages this file must claim its own distinct marker pair; two managers sharing one pair would each rebuild the other’s region on every pass.
Bug Fixes
start_box.shis now single-instance. Concurrent copies raced each other and accumulated across restarts — boxes have been found running ten or more at once, some months old, each having burned hours of CPU, with their key-sync loops appending over one another. The script now takes a non-blocking lock for its lifetime and exits with a clear message if another copy holds it. The background key-sync poller closes the inherited lock descriptor, so a long-lived poller cannot pin the lock against later runs.