x0ne OS / Handbook / Cloud and security
Cloud images
Works today for OVHcloud, built from source (measured 2026-10-11): make byol builds the Bring Your Own Linux image with cloud-init, make byoi the encrypted one (LUKS2, unlocked over SSH). Not published.
Planned — later: every other provider.
x0ne OS images for public and private clouds, amd64; arm64 later. Accounts come from cloud-init: your SSH key, no password.
Providers, in order
| Order | Provider | Why | Format |
|---|---|---|---|
| 1 | OVHcloud, Scaleway | European, sovereign. | qcow2 + cloud-init. OVHcloud: make byol, make byoi. |
| 2 | Hetzner | Low cost: tests, CI, microVMs. | to be confirmed |
| 3 | Google Cloud | Large scale and confidential computing: TDX, H100 in confidential mode. | disk.raw in a tar.gz |
| later | AWS, Azure, OpenStack | On demand. | AMI, fixed-size VHD, qcow2 |
All formats come from one raw disk, built like the qcow2 VM image.
Variants
- CPU: the default.
- NVIDIA: driver installed. See GPUs.
- Confidential: measured boot and published measurements, on Google Cloud first. See Confidential computing and attestation.
What every cloud image does
- Takes the SSH key from the provider through cloud-init.
- Keeps password login off.
- Grows the root disk to the size you chose.
- Logs to the serial console.
How to verify
Each image is tested in QEMU with a local cloud-init source before it ships. The OVHcloud images: SSH key and host name taken from the config drive, password and root login refused over SSH (tested 2026-10-11).
on the instance planned
$ cloud-init status --wait status: done $ sudo passwd --status root
How to undo
Delete the instance and its disk from the provider console.