Help with some configuration errors

[fv-rm]

Good morning,
I wrote on the official Raspberry forum with bls, who helped me discover dsm as a tool for configuring images.
After studying the documentation for a while and doing some hands-on practice, I managed to understand how it works, but I’m encountering some errors during the configuration phase. In addition, I have a few doubts about certain points, which I will include later.

Let’s start with the command I have currently prepared:

sudo sdm --customize \
--plugin user:"adduser=custom|password=custom" \
--plugin L10n:host \
--plugin disables:piwiz \
--cscript /home/path/script.sh \
--plugin apps:apps=xserver-xorg-legacy \
--plugin apps:apps=x11-xserver-utils \
--plugin apps:apps=xinit \
--plugin apps:apps=chromium-browser \
--plugin apps:apps=unclutter \
--plugin apps:apps=fbi \
--plugin apps:apps=xorg \
--plugin apps:apps=python3-qrcode \
--plugin mkdir:"dir=/etc/raspi-config" \
--plugin copyfile:"from=/path/config.service|to=/etc/systemd/system/" \
--plugin copyfile:"from=/path/config.sh|to=/usr/local/bin/|chmod=644" \
--plugin system:"service-enable=config" \
--expand-root --regen-ssh-host-keys --restart \
file.img

In the logs I get the following error: "apt returned an error; review /etc/sdm/apt.log" but it's empty...

I probably misunderstood the configuration of the different "sudo apt install..." commands. Is it perhaps incorrect to use the apps plugin? Also, how can I add --no-install-recommends?

Finally, I still need to insert these configurations, but I haven’t quite figured out how to do so:

1. sudo dpkg-reconfigure xserver-xorg-legacy > Select Anybody – How can I automate this step?
2. DHCP configuration with Network Manager – should I be using the correct network plugin? Or does network rely on other configurations? In particular, I would need to run these commands:

sudo nmcli connection add type vlan con-name vlan100 ifname eth0.100 dev eth0 id 100  
sudo nmcli connection modify vlan100 ipv4.method auto  
sudo nmcli connection up vlan100  
sudo nmcli connection modify eth0 ipv4.method disabled  
sudo nmcli connection down eth0  

3. Is it possible, while writing an image, to simulate its functionality? At the moment, I have to configure the image, write it to the SD card, and insert it into the Raspberry Pi in order to verify that the result is as expected. Isn’t there a way to debug without having to go through these steps?

[gitbls]

Thanks for the follow-up questions. I'm always happy to help jump-start using sdm.

WRT to your current command line, I encourage you to make a couple of changes:

• Use a pluglist, which is simply a file with plugins listed in it. The HUGE advantage of a pluglist is that you don't need to use those double quotes around the argument strings. You then refer to the pluglist in the command line with --plugin @/path/to/pluglist. For instance, your pluglist would look like:

user:adduser=custom|password=custom
apps:apps=xorg,python3-qrcode, etc etc
mkdir:dir=/etc/raspi-config

• Also, while you're doing that, I would suggest consolidating all those apps plugin invocations into a smaller number. It's mostly personal choice, I suppose, but I believe in consolidation, less clutter in /etc/sdm/history, and easier to read, My personal sdm config script uses 4 apps plugins: core-apps, core-X-apps, noncore-apps, noncore-X-apps. The core apps are my "can't live without them" apps and the noncore apps are ones I want on my "production" systems, but don't care about when doing a quick test. Additionally, I use apps:apps=@bls-core-apps|name=core-apps, and the file bls-core-apps has a list of the apps, one per line.

OK, that's it on the high-level feedback.

"In the logs, I get the following error: "apt returned an error; review /etc/sdm/apt.log" but it's empty..." Where are you looking for /etc/sdm/apt.log? This file will be IN the IMG, not on the host. You can view it by sdm --explore /path/to/img.img, or you can use sdm --extract-log /path/for/files /path/to/img.img (e.g., sdm --extract-log .) and sdm will pull out the apt.log and history files onto the host.

• sdm uses --no-install-recommends on all apt install commands that it does. Thanks for the reminder, though. In my personal plugin I add that to /etc/apt/apt.conf.d. I will add another option to --apt-options to make it easier to do that. Until then, see below re personal plugin.

Re your additional questions:

• There is currently no dpkg support in sdm. You can do this in a personal plugin, assuming that xserver-xorg-legacy's dpkg can be automated (some packages dpkg settings are not automatable). In looking at the xserver-xorg-legacy package it doesn't appear to have much of anything in it (in bookworm). Is it a meta-package that installs other packages? If so, you need to figure out which package actually has the setting you want. If that package has settings you can use debconf-set-selections before installing the package. For an example, see /usr/local/sdm/plugins/apt-cacher-ng.

• At the moment the network plugin does not know how to configure VLANs. I'd suggest creating a personal plugin with these lines in it's Phase 1. See Programming Plugins for some info on building a custom plugin. Basically, just copy plugins/sdm-plugin-template to a new name (fvrm-plugin, for instance) in the sdm/local-plugins directory and have at it. Then add fvrm-plugin to your new pluglist 😉 to use it.

  I'll look into adding vlan support to the network plugin but you shouldn't wait for that, and it will be easy for you to switch to using the network plugin if I can cram it in there.

• Simulating stuff: Yes, that is the sdm way. Although it would be great to have some sort of simulator, that's really dependent on RasPiOS providing something. I can't even comprehend a way to simulate an operating system's consumption of all this without rewriting the OS.

  That said, I will tell you that the more you use sdm the easier it gets to figure out what happened, and if the right things happened. Once you have a basic sdm configuration working, then you're only dealing with smaller changes (e.g., adding a new plugin, app, etc), so it's easier to eyeball the changes by reviewing /etc/sdm/history, /etc/sdm/apt.log, and the resulting configuration itself.

  One thing that sdm does a lot of is logging what it's doing. This was done so that a) the user can see what sdm thinks it did, and if there are problems, I can see what sdm actually did 🤣 So...as you move along through setting up your sdm configuration, if you run into problems where you need another pair of eyeballs on it, be aware I may need to see your /etc/sdm/history file. The only sensitive info in there typically is user and WiFi passwords, which can be easily redacted.

[fv-rm]

Hi @gitbls, thank you for the detailed answer!

I'll try everything asap and let you know!

[gitbls]

Hi @gitbls, thank you for the detailed answer!

I'll try everything asap and let you know!

Excellent! Shout here if you have any questions/issues.

[gitbls]

sdm V14.6 now has a method to add --no-install-recommends into the IMG, in addition to sdm already using --no-install-recommends on all the apt install operations done on your behalf.

--apt-options now also supports the no-install-recommends key that adds the setting via a /etc/apt/apt.conf.d/.conf file.

[fv-rm]

Hi gitbls,

everything is working now, but I’m still running into some errors. I tried fixing them myself, but for some of them I can’t figure out why they’re not working.

I created a custom phase script for the nmcli configuration, mainly because I found it easier to understand and I don’t need arguments for customization right now.

However, it seems the script isn’t being executed for phase 1, where I’ve added my code, and I don’t understand why.

I checked both the history and the apt.log, but there are no errors there. Here’s the script:

#!/bin/bash
function loadparams() {
	source $SDMPT/etc/sdm/sdm-readparams
}

phase=$1
pfx="$(basename $0)"

if [ "$phase" == "0" ]
loadparams
then
	logtoboth "* $pfx Phase 0"
	# CODE HERE
	logtoboth "* $pfx Phase 0 Completed"
	
elif [ "$phase" == "1" ]
then
	logtoboth "* $pfx Phase 1"
	logfreespace "at start of $pfx Phase 1"
	# CODE HERE
	sudo nmcli connection add type vlan con-name vlan1999 ifname eth0.1999 dev eth1999 id 1999
	sudo nmcli connection modify vlan1999 ipv4.method auto
	sudo nmcli connection up vlan1999
	sudo nmcli connection modify "Wired connection 1" ipv4.method disabled
	sudo nmcli connection down "Wired connection 1"
	# ----------
	logfreespace "at end of $pfx Phase 1"
	logtoboth "* $pfx Phase 1 Completed"
else
	logtoboth "* $pfx Custom Phase post-install"
	logfreespace "at start of $pfx Custom Phase post-install"
	# CODE HERE
	# ----------
	logfreespace "at end of $pfx Custom Phase post-install"
	logtoboth "* $pfx Custom Phase post-install Completed"
fi
exit 0

And here’s the history output:

2025-09-30 14:07:29 > Copy Custom Phase Script '/home/path/network-config.sh' to 
2025-09-30 14:07:29   /usr/local/sdm in the IMG
2025-09-30 14:07:29 * Start Phase 0 image customization
2025-09-30 14:07:29 > Run Custom Phase Script '/mnt/sdm/usr/local/sdm/network-config.sh' Phase 0
2025-09-30 14:07:29 * network-config.sh Phase 0
2025-09-30 14:07:29 * network-config.sh Phase 0 Completed
2025-09-30 14:07:56 > Run Custom Phase Script '/usr/local/sdm/network-config.sh' Phase 1
2025-09-30 14:07:57 * network-config.sh Phase 0
2025-09-30 14:07:57 * network-config.sh Phase 0 Completed
2025-09-30 14:27:31 > Run Custom Phase Script '/usr/local/sdm/network-config.sh' post-install
2025-09-30 14:27:31 * network-config.sh Phase 0
2025-09-30 14:27:31 * network-config.sh Phase 0 Completed

I don’t understand why it always reports “Phase 0” and “Phase 0 Completed”, even when it should be phase 1 or post-install.

I also have one more question: Is it possible to disable custom services (kiosk.service and config.service) on the first boot, and only enable them from the second boot onward? Currently, the service starts on the very first boot, but I’d like the first boot to only configure the image (SSH, etc.) and not launch my own services.

[gitbls]

Looks like you have a code error. Why is the line loadparams AFTER the if statement and before the then statement?

What is the result if you move the loadparams statement to BEFORE the if statement?

As far as custom service disabling/enabling, at the moment sdm doesn't provide a way to do this simply, but it seems like a good idea, so I will have a look into this.

In the meantime, I'd suggest that you do something similar to:

• Disable the services during customization
• Write a small script into /etc/sdm/0piboot that will run during sdm FirstBoot and enable the service(s)

For instance, this code snippet in the post-install phase of your custom phase script or personal plugin:

systemctl disable kiosk.service
systemctl disable config.service
cat > /etc/sdm/0piboot/090-enable-services.sh <<EOF
#!/bin/bash
systemctl enable kiosk.service
systemctl enable config.service
EOF

During FirstBoot sdm will:

• Set the correct protection on the script
• Run the script

When I add the mechanism to sdm to do this for you, you can simply pull out those lines and use the new sdm feature, or the above will of course continue working should you not feel motivated to change it.

[fv-rm]

Hi, I edited the script for network configuration, the problem was the loadparams as you suggested!

But now I have an error: Could not create NMClient object; Could not connect: No such file or directory.

I moved the nmcli lines from Phase 1 to Post Install, but without success.

Do you have any idea?

[gitbls]

Oh, my bad for not thinking ahead of you on this! Indeed, you cannot use nmcli in sdm directly because NetworkManager is not running.

BUT, you CAN use nmcli --offline. It's a bit cumbersome though. Here's what sdm's network plugin does:

To create the connection, there is an internal function makenmconn that does:

bash -c "nmcli --offline $nmcmd | tee /etc/NetworkManager/system-connections/$cname.nmconnection >/dev/null"

The bash variable nmcmd is passed to makenmconn, for instance:

makenmconn "$thiscname" $ifname "c add type $thisctype con-name $thiscname ifname $ifname $thisattr"

The 3rd argument becomes nmcmd

Then the function modnmconn is called to make further modifications to the connection.

Hint: $newnm will be 1 on Bookworm and Trixie so you can follow/crib that code.

I'd suggest that you grab those 2 functions and stuff them into your custom phase script, then mimic what the network plugin does to configure your VLAN. If you're adept at bash code, remove the test for $nmcmd and just include those sections where $nmcmd -eq 1 is true. If you're not, LMK and I can gin these up for you later today (USPT).

Lastly, note that sdm runs as root so you never need to use sudo in your custom phase script.

Lastly #2: I'm curious why you're using a custom phase script rather than a plugin? The code is essentially the same, it's really a matter of how it is invoked (--cscript vs --plugin).

[fv-rm]

Thank you for the quick reply!

I’m using a cscript instead of a plugin simply because I find it easier, and I only need to configure this basic VLAN.

I started adding the --offline option, but now I’m getting the error:
sudo: unable to resolve host sdm: temporary failure in name resolution.

Sorry for my limited understanding, but could you please explain with an example how to integrate the script/plugin, similar to how it’s done with the network one? For instance, using vlan1999 and eth0.1999 as an example.

That would really help me understand it better. Thank you so much!

[gitbls]

OK, here's a first-draft vlan plugin. I've done basic testing that it configures the .nmconnection file correctly, but have not done any testing to confirm that the vlan starts correctly....will leave that to you. Please LMK how it goes.

Brief documentation:
`--plugin vlan:"cname=connection-name|devname=device-name|ifname=interface-name|id=id|vlanauto=y|diseth=other-conn"

• cname — VLAN connection name
• devname — VLAN device name
• ifname — VLAN interface name
• id — VLAN ID
• vlanauto — use vlanauto=y to enable autoconnect yes
• diseth — Connection name to set autoconnect no

Example:
--plugin vlan:"cname=vlan1999|devname=eth1999|ifname=eth0.1999|id=1999|vlanauto=y|diseth=Wired connection 1"

Note that sdm does not create a connection named "Wired connection 1"; that's from rpi-imager. So, you probably don't need to disable it, since you can have complete control over the eth0 and wlan0 connections using sdm's network plugin.

Copy the following and save it to /usr/local/sdm/plugins/vlan

#!/bin/bash
#
# This is an sdm plugin for: vlan
#
# The plugin is called three times: for Phase 0, Phase 1, and post-install.
#

function makevlanconn() {
    cname="$1" makeif="$2" nmcmd="$3"

    if [ -f /etc/NetworkManager/system-connections/$cname.nmconnection ]
    then
	logtoboth "% Plugin $pfx: NetworkManager connection $cname already exists; Deleting prior definition"
	rm -f /etc/NetworkManager/system-connections/$cname.nmconnection
    fi
    logtoboth "> Plugin $pfx: Create connection '$cname' on interface '$makeif'"
    # Feed to bash so special character quoting doesn't blow up
    bash -c "nmcli --offline $nmcmd | tee /etc/NetworkManager/system-connections/$cname.nmconnection >/dev/null"
    sts=$?
    [ $sts -ne 0 ] && logtobothex "? Plugin $pfx: nmcli returned error '$sts' on create connection '$cname' with '$nmcmd'"
}

function modnmxconn() {
    cname="$1" cattr="$2" fname="$3"

    [ "$fname" != "" ] && fname="$(basename "$fname")" || fname="$cname"
    fname="${fname%.nmconnection}"
    logtoboth "> Plugin $pfx: Modify connection '$cname' with '$cattr'"
    bash -c "nmcli --offline c modify $cattr </etc/NetworkManager/system-connections/\"$fname\".nmconnection | tee /tmp/\"$fname\".nmconnection >/dev/null"
    sts=$?
    [ $sts -ne 0 ] && logtobothex "? Plugin $pfx: nmcli returned error '$sts' on modify '$cattr'"
    rm -f /etc/NetworkManager/system-connections/"$fname".nmconnection
    mv /tmp/"$fname".nmconnection /etc/NetworkManager/system-connections/"$fname".nmconnection
}

function loadparams() {
    source $SDMPT/etc/sdm/sdm-readparams
}

# $1 is the phase: "0", "1", or "post-install"
# $2 is the argument list: arg1=val1|arg2=val2|arg3=val3| ...
#
# Main code for the Plugin
#
phase=$1
pfx="$(basename $0)"     #For messages
args="$2"
loadparams
vldargs="|cname|devname|ifname|id|vlanauto|diseth|"
rqdargs="|cname|devname|ifname|"                   # |list|of|required|args|or|nullstring|
assetdir="$SDMPT/etc/sdm/assets/$pfx"

if [ "$phase" == "0" ]
then
    #
    # In Phase 0 all references to directories in the image must be preceded by $SDMPT
    #
    logtoboth "* Plugin $pfx: Start Phase 0"
    plugin_getargs $pfx "$args" "$vldargs" "$rqdargs" || exit
    #
    # Print the keys found (example usage). plugin_getargs returns the list of found keys in $foundkeys
    #
    plugin_printkeys
    mkdir -p $assetdir
    logtoboth "* Plugin $pfx: Complete Phase 0"
elif [ "$phase" == "1" ]
then
    #
    # Phase 1 (in nspawn)
    #
    logtoboth "* Plugin $pfx: Start Phase 1"
    plugin_getargs $pfx "$args" "$vldargs" "$rqdargs"
    #logfreespace "at start of Plugin $pfx Phase 1"
    #
    makevlanconn $cname $ifname "c add type vlan con-name $cname ifname $ifname dev $devname id $id"
    cattr="ipv4.method auto"
    [ -v vlanauto ] && cattr="$cattr autoconnect yes" || cattr="$cattr autoconnect no"
    modnmxconn $cname "$cattr"
    if [[ "$diseth" != "" ]] && [[ -f /etc/NetworkManager/system-connections/"$diseth".nmconnection ]]
    then
	modnmxconn "$diseth" "autoconnect no"
    fi
    # 
    #logfreespace "at end of $pfx Phase 1"
elif [ "$phase" == "post-install" ]
then
    #
    # Plugin Post-install edits
    #
    logtoboth "* Plugin $pfx: Start Phase post-install"
    plugin_getargs $pfx "$args" "$vldargs" "$rqdargs"
    #logfreespace "at start of Plugin $pfx Phase post-install"
    #
    # INSERT Your Plugin's post-install code here
    # In Phase post-install all references to directories in the image can be direct
    #
    #logfreespace "at end of $pfx Custom Phase post-install"
    logtoboth "* Plugin $pfx: Complete Phase post-install"
fi

[fv-rm]

Hi, thanks for the script!

The vlan1999.nmconnection file is configured correctly, as you mentioned. However, when the Raspberry Pi starts up, the nmcli connection show command doesn’t list the vlan1999 connection as created.

I found that, in order for the file to be loaded by NetworkManager as a connection, its permissions need to be set to 600. So, after running chmod 600 vlan1999.nmconnection and then executing nmcli connection load, the connection appears correctly in the list.

Do you have any idea how I could implement this step directly in the plugin?

[gitbls]

No, because you didn't provide sufficient information. I'll need the following to sort this:

• /etc/sdm/history from the IMG you customized. You can use sdm --extract-log /path/to/some/dir /path/to/customized.img to extract the log from the customized IMG.
• The output of sudo journalctl -b | grep NetworkManager from the running system

I may need additional details, but let's start with those. You can either post them here, or if you'd prefer, email them to me at the email address on sdm's README page.

[fv-rm]

Hi, thanks for waiting! I’ve solved the VLAN issue — it was enough to add the chmod 600 command in your plugin to make the file readable in terms of permissions by the Network Manager.

chmod 600 /etc/NetworkManager/system-connections/$cname.nmconnection

However, at the moment, through the VLAN plugin with diseth, I can’t find the Wired Connection 1 in /etc/NetworkManager/system-connections/Wired connection 1.nmconnection. In the plugin code the condition is never met:

if [[ "$diseth" != "" ]] && [[ -f /etc/NetworkManager/system-connections/"$diseth".nmconnection ]]
then
     modnmxconn "$diseth" "autoconnect no"
fi

So, when the Raspberry Pi boots up, if I run nmcli connection show, it does appear with the status enabled.

I tried to delete it using the network plugin, but without success, since I couldn’t find a way to remove already existing connections.
Do you have any idea how I could disable the default eth0 connection? I only need to have a single IP address on the VLAN — currently, the Raspberry Pi obtains two (one through the correct VLAN, and another through eth0 as a generic network device).

In the raspberry console, if I run sudo nmcli connection down "Wired connection 1 everything work as expected, without the double ip address.

In addition, I’m trying to disable the getty@tty1 service to disable the tty1 console with the system plugin:

--plugin system:"name=tty|service-disable=getty@tty1"

but despite receiving confirmation that it has been disabled in history log, after the Raspberry boots up, running sudo systemctl status getty@tty1 shows it as enabled and running.
Do you have any idea on how to resolve this need?

[gitbls]

Hi, thanks for waiting! I’ve solved the VLAN issue — it was enough to add the chmod 600 command in your plugin to make the file readable in terms of permissions by the Network Manager.

chmod 600 /etc/NetworkManager/system-connections/$cname.nmconnection

Yea, sorry about that...missed that minor detail 😳

However, at the moment, through the VLAN plugin with diseth, I can’t find the Wired Connection 1 in /etc/NetworkManager/system-connections/Wired connection 1.nmconnection. In the plugin code the condition is never met:

if [[ "$diseth" != "" ]] && [[ -f /etc/NetworkManager/system-connections/"$diseth".nmconnection ]]
then
     modnmxconn "$diseth" "autoconnect no"
fi

So, when the Raspberry Pi boots up, if I run nmcli connection show, it does appear with the status enabled.

You didn't say which version of RasPiOS (Bookworm or Trixie?) you're using, but if it's Trixie, it's this issue. The fix is to update to the latest sdm (V14.7) and use the disables plugin with argument cloudinit.

If you're using Bookworm, or actually, in general, you should fully create your own connection for eth0 rather than letting the system create Wired connection 1 for you. I'm guessing, though, since you haven't provided any logs for me yet.

Something like this should work:

network:ifname=eth0|autoconnect=no

I tried to delete it using the network plugin, but without success, since I couldn’t find a way to remove already existing connections. Do you have any idea how I could disable the default eth0 connection? I only need to have a single IP address on the VLAN — currently, the Raspberry Pi obtains two (one through the correct VLAN, and another through eth0 as a generic network device).

As I suggested, create your own eth0 connection and make it autoconnect no.

In the raspberry console, if I run sudo nmcli connection down "Wired connection 1 everything work as expected, without the double ip address.

In addition, I’m trying to disable the getty@tty1 service to disable the tty1 console with the system plugin:

--plugin system:"name=tty|service-disable=getty@tty1"

but despite receiving confirmation that it has been disabled in history log, after the Raspberry boots up, running sudo systemctl status getty@tty1 shows it as enabled and running. Do you have any idea on how to resolve this need?

Well, right now sdm unconditionally re-enables getty@tty1 when the system first boots, because it comes up that way on a non-sdm-ized system. You're the first person to request this 🫨

Probably the easiest thing to do is to use the runatboot plugin, giving it a script that disables getty@tty1. You've got enough experience with sdm that you should be able to figure it out 👍

[gitbls]

FYI, the next release of sdm will provide a way to disable services at boot (e.g., getty@tty1) using the system plugin:

--plugin system:service-disable-at-boot=getty@tty1