ilker/maas-samba-ad
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Force IPv4 in the build VM, where apt was losing 31s per large fetch
All checks were successful
build-image / build (push) Successful in 5m41s
Details

Browse Source 
Every apt download over roughly 15 MB inside the build VM took exactly 31
seconds regardless of its size, while a 14.1 MB one took 1 second at 23 MB/s.
A fixed cost that ignores size is a timeout, not a bandwidth limit: QEMU's
user-mode network advertises IPv6 that does not work, so apt's parallel
connections black-holed on it and only fell back to IPv4 when the 30-second
timeout expired.

Patch the build VM's cloud-init seed from bootcmd, which runs in the
init-local stage before SSH is up, so the setting covers upstream's apt calls
as well as ours. The same 28.5 MB fetch went from 31s (914 kB/s) to 3s
(9152 kB/s).

Also fix APT_PROXY, which never worked as documented. A cache cannot see
inside a CONNECT tunnel, so the repositories have to be rewritten to plain
http first, and Debian 13 keeps the real mirror URLs in /etc/apt/mirrors/*.list
behind the mirror+file: method, which rewriting sources.list alone misses.

The README now carries the measurements rather than estimates. The headline is
that the cache barely matters: with it fully warm it saves about three seconds
of a 4m40s build, so a local Debian mirror (138 GB for trixie amd64) would buy
nothing here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
ilkermanap
2026-09-05 23:59:39 +02:00
parent fcc54136ce
commit f6b241b3f7
3 changed files with 74 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
scripts/customize-samba-ad.sh.in
View File

@@ -63,6 +63,19 @@ hostname -f || echo "WARNING: hostname -f does not resolve" >&2
log "holding the cloud-init package"
apt-mark hold cloud-init || true
# If a caching proxy is configured, rewrite the repositories from https to
# plain http: a cache cannot see inside a CONNECT tunnel, so https requests are
# passed through uncached. Package signatures are still verified, so this costs
# nothing in integrity. Debian 13 keeps the real mirror URLs in
# /etc/apt/mirrors/*.list behind the "mirror+file:" method, so rewriting
# sources.list alone would miss them.
if [ -n "${http_proxy:-}" ]; then
log "APT cache in use (${http_proxy}); switching repositories to http"
sed -i 's|https://|http://|g' \
/etc/apt/sources.list /etc/apt/sources.list.d/*.sources \
/etc/apt/sources.list.d/*.list /etc/apt/mirrors/*.list 2>/dev/null || true
fi
apt-get update
$APT install eatmydata || true
use_eatmydata