Persist VM state across mkosi vm runs

[utezduyar]

I’m using mkosi vm with a ParticleOS image. On first boot, systemd-repart creates an encrypted root filesystem and enrolls it with the TPM.

I’d like to shut down the VM and boot the same machine again.

However, each mkosi vm invocation seems to create a new expanded disk image, a new swtpm state directory, and a new OVMF variable store.

Is there a supported way to make mkosi vm preserve the disk, TPM, and UEFI state across runs, so I can simulate a second boot of the same machine?

Or is systemd-vmspawn better suited for this?

[tt-a1i]

You are not missing a persistence switch for the TPM or firmware state in mkosi vm. The current backends throw those two pieces away on every run.

With the QEMU backend, mkosi creates the swtpm state in a TemporaryDirectory and the OVMF variables in a NamedTemporaryFile (TPM, OVMF variables). Switching mkosi to the vmspawn backend does not fix it: mkosi passes --tpm-state=off and gives vmspawn a temporary NVRAM template (TPM options, NVRAM handling).

The disk itself is different. With Ephemeral=no, mkosi boots the output image directly and locks it rather than copying it (source). So make sure that option is off if you want the repartitioned/encrypted disk to survive.

If all three pieces need to survive the second boot, build the image with mkosi and run the resulting disk with systemd-vmspawn directly:

mkdir -p "$PWD/.vm-state/tpm"

systemd-vmspawn \
  --image="$PWD/image.raw" \
  --tpm=yes \
  --tpm-state="$PWD/.vm-state/tpm" \
  --efi-nvram-state="$PWD/.vm-state/efivars"

systemd-vmspawn persists both paths; it also supports auto, which derives state-file names from the image. The TPM state option is available since systemd 258, while persistent EFI NVRAM state needs systemd 261 (current vmspawn documentation). Do not add --ephemeral, because vmspawn deliberately turns both auto state locations into transient state in that mode.

[utezduyar]

Thank you for your detailed instructions and time. I have created systemd/particleos#184 with that.

For the sake of troubleshooting, I will also note here that I had swtpm installed on the host and it's app armor policy was preventing the mkosi box version of swtpm from running.