From cd6e03049a42203491249003c5a1d164321d6849 Mon Sep 17 00:00:00 2001
From: Malte Poll <1780588+malt3@users.noreply.github.com>
Date: Tue, 28 Nov 2023 10:52:37 +0100
Subject: [PATCH] libvirt: build containerized libvirt as nix container image

---
 .github/workflows/build-libvirt-container.yml |  44 ++++++
 bazel/oci/containers.bzl                      |   2 +-
 bazel/toolchains/container_images.bzl         |   7 +-
 cli/internal/libvirt/BUILD.bazel              |  60 --------
 cli/internal/libvirt/etc/BUILD.bazel          |   8 -
 cli/internal/libvirt/etc/group                |  51 -------
 cli/internal/libvirt/etc/passwd               |  31 ----
 cli/internal/libvirt/libvirtd.conf            |   5 -
 cli/internal/libvirt/nvram/BUILD.bazel        |   8 -
 .../nvram/constellation_vars.production.fd    | Bin 131072 -> 0 bytes
 .../nvram/constellation_vars.testing.fd       | Bin 131072 -> 0 bytes
 cli/internal/libvirt/qemu.conf                |   1 -
 cli/internal/libvirt/start.sh                 |  20 ---
 dev-docs/workflows/qemu.md                    |   2 +-
 flake.nix                                     |   2 +
 .../libvirt => nix/container}/README.md       |  15 +-
 nix/container/libvirtd_base.nix               | 139 ++++++++++++++++++
 terraform/infrastructure/qemu/variables.tf    |   2 +-
 18 files changed, 204 insertions(+), 193 deletions(-)
 create mode 100644 .github/workflows/build-libvirt-container.yml
 delete mode 100644 cli/internal/libvirt/etc/BUILD.bazel
 delete mode 100644 cli/internal/libvirt/etc/group
 delete mode 100644 cli/internal/libvirt/etc/passwd
 delete mode 100644 cli/internal/libvirt/libvirtd.conf
 delete mode 100644 cli/internal/libvirt/nvram/BUILD.bazel
 delete mode 100644 cli/internal/libvirt/nvram/constellation_vars.production.fd
 delete mode 100644 cli/internal/libvirt/nvram/constellation_vars.testing.fd
 delete mode 100644 cli/internal/libvirt/qemu.conf
 delete mode 100755 cli/internal/libvirt/start.sh
 rename {cli/internal/libvirt => nix/container}/README.md (72%)
 create mode 100644 nix/container/libvirtd_base.nix

diff --git a/.github/workflows/build-libvirt-container.yml b/.github/workflows/build-libvirt-container.yml
new file mode 100644
index 000000000..91132fd78
--- /dev/null
+++ b/.github/workflows/build-libvirt-container.yml
@@ -0,0 +1,44 @@
+name: Build libvirtd base container
+
+on:
+  push:
+    branches:
+       - "main"
+    paths:
+      - "flake.nix"
+      - "flake.lock"
+      - "nix/containers/libvirtd_base.nix"
+      - ".github/workflows/build-libvirt-container.yml"
+  workflow_dispatch:
+
+jobs:
+  build-container:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - name: Setup bazel
+        uses: ./.github/actions/setup_bazel_nix
+        with:
+          useCache: "false"
+          nixTools: |
+            crane
+            gzip
+
+      - name: Log in to the Container registry
+        uses: ./.github/actions/container_registry_login
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build container
+        run: |
+          nix build .#libvirtd_base
+          gunzip < result > libvirtd_base.tar
+          crane push libvirtd_base.tar ghcr.io/edgelesssys/constellation/libvirtd-base
+          rm -f libvirtd_base.tar
diff --git a/bazel/oci/containers.bzl b/bazel/oci/containers.bzl
index 8f9e47db1..b83ef8262 100644
--- a/bazel/oci/containers.bzl
+++ b/bazel/oci/containers.bzl
@@ -51,7 +51,7 @@ def containers():
             "identifier": "libvirt",
             "image_name": "libvirt",
             "name": "libvirt",
-            "oci": "//cli/internal/libvirt:constellation_libvirt",
+            "oci": "@libvirtd_base//:libvirtd_base",
             "repotag_file": "//bazel/release:libvirt_tag.txt",
             "used_by": ["config"],
         },
diff --git a/bazel/toolchains/container_images.bzl b/bazel/toolchains/container_images.bzl
index 70c9949dd..feaa27d06 100644
--- a/bazel/toolchains/container_images.bzl
+++ b/bazel/toolchains/container_images.bzl
@@ -1,5 +1,5 @@
 """
-This file contains external container images used by the project.
+This file contains container images that are pulled from container registries.
 """
 
 load("@rules_oci//oci:pull.bzl", "oci_pull")
@@ -14,3 +14,8 @@ def containter_image_deps():
             "linux/arm64",
         ],
     )
+    oci_pull(
+        name = "libvirtd_base",
+        digest = "sha256:f5aca956c8d67059725feb4bf8a7d96da71a51efe84288c74a52fcf6855a13bd",
+        image = "ghcr.io/edgelesssys/constellation/libvirtd-base",
+    )
diff --git a/cli/internal/libvirt/BUILD.bazel b/cli/internal/libvirt/BUILD.bazel
index c41fbfb4e..d89676216 100644
--- a/cli/internal/libvirt/BUILD.bazel
+++ b/cli/internal/libvirt/BUILD.bazel
@@ -1,7 +1,4 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_library")
-load("@rules_oci//oci:defs.bzl", "oci_image")
-load("@rules_pkg//:pkg.bzl", "pkg_tar")
-load("@rules_pkg//pkg:mappings.bzl", "pkg_attributes", "pkg_files", "strip_prefix")
 
 go_library(
     name = "libvirt",
@@ -17,60 +14,3 @@ go_library(
         "@com_github_spf13_afero//:afero",
     ],
 )
-
-pkg_files(
-    name = "etc",
-    srcs = [
-        "//cli/internal/libvirt/etc:passwd_db",
-    ],
-    attributes = pkg_attributes(
-        group = "root",
-        mode = "0644",
-        owner = "root",
-    ),
-    prefix = "etc",
-    strip_prefix = strip_prefix.from_pkg(),
-)
-
-pkg_files(
-    name = "nvram",
-    srcs = [
-        "//cli/internal/libvirt/nvram:nvram_vars",
-    ],
-    prefix = "usr/share/OVMF",
-    strip_prefix = strip_prefix.from_pkg(),
-)
-
-pkg_files(
-    name = "libvirt_conf",
-    srcs = [
-        "libvirtd.conf",
-        "qemu.conf",
-    ],
-    prefix = "/etc/libvirt",
-)
-
-pkg_tar(
-    name = "start",
-    srcs = [
-        "start.sh",
-        ":etc",
-        ":libvirt_conf",
-        ":nvram",
-    ],
-    mode = "0755",
-)
-
-oci_image(
-    name = "constellation_libvirt",
-    architecture = "amd64",
-    entrypoint = ["/start.sh"],
-    os = "linux",
-    tars = [
-        # TODO(malt3): test if libvirt works before merging this change!!!
-        "@libvirt_x86_64-linux//:closure.tar",
-        "@libvirt_x86_64-linux//:bin-linktree.tar",
-        ":start",
-    ],
-    visibility = ["//visibility:public"],
-)
diff --git a/cli/internal/libvirt/etc/BUILD.bazel b/cli/internal/libvirt/etc/BUILD.bazel
deleted file mode 100644
index 12aeaf34a..000000000
--- a/cli/internal/libvirt/etc/BUILD.bazel
+++ /dev/null
@@ -1,8 +0,0 @@
-filegroup(
-    name = "passwd_db",
-    srcs = glob(
-        ["**/*"],
-        exclude = ["BUILD"],
-    ),
-    visibility = ["//visibility:public"],
-)
diff --git a/cli/internal/libvirt/etc/group b/cli/internal/libvirt/etc/group
deleted file mode 100644
index 95c817fb1..000000000
--- a/cli/internal/libvirt/etc/group
+++ /dev/null
@@ -1,51 +0,0 @@
-root:x:0:
-bin:x:1:
-daemon:x:2:
-sys:x:3:
-adm:x:4:
-tty:x:5:
-disk:x:6:
-lp:x:7:
-mem:x:8:
-kmem:x:9:
-wheel:x:10:
-cdrom:x:11:
-mail:x:12:
-man:x:15:
-dialout:x:18:
-floppy:x:19:
-games:x:20:
-tape:x:33:
-video:x:39:
-ftp:x:50:
-lock:x:54:
-audio:x:63:
-users:x:100:
-nobody:x:65534:
-tss:x:59:
-dbus:x:81:
-unbound:x:999:
-utmp:x:22:
-utempter:x:35:
-saslauth:x:76:saslauth
-input:x:104:
-kvm:x:36:qemu
-render:x:105:
-sgx:x:106:
-systemd-journal:x:190:
-systemd-network:x:192:
-systemd-oom:x:997:
-systemd-resolve:x:193:
-polkitd:x:996:
-rtkit:x:172:
-gluster:x:995:
-dnsmasq:x:994:
-rpc:x:32:
-brlapi:x:993:
-rpcuser:x:29:
-qemu:x:107:
-pipewire:x:992:
-geoclue:x:991:
-libvirt:x:990:
-systemd-coredump:x:989:
-systemd-timesync:x:988:
diff --git a/cli/internal/libvirt/etc/passwd b/cli/internal/libvirt/etc/passwd
deleted file mode 100644
index c20d8aad0..000000000
--- a/cli/internal/libvirt/etc/passwd
+++ /dev/null
@@ -1,31 +0,0 @@
-root:x:0:0:root:/root:/bin/bash
-bin:x:1:1:bin:/bin:/sbin/nologin
-daemon:x:2:2:daemon:/sbin:/sbin/nologin
-adm:x:3:4:adm:/var/adm:/sbin/nologin
-lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
-sync:x:5:0:sync:/sbin:/bin/sync
-shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
-halt:x:7:0:halt:/sbin:/sbin/halt
-mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
-operator:x:11:0:operator:/root:/sbin/nologin
-games:x:12:100:games:/usr/games:/sbin/nologin
-ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
-nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
-tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin
-dbus:x:81:81:System message bus:/:/sbin/nologin
-unbound:x:999:999:Unbound DNS resolver:/var/lib/unbound:/sbin/nologin
-saslauth:x:998:76:Saslauthd user:/run/saslauthd:/sbin/nologin
-systemd-network:x:192:192:systemd Network Management:/:/usr/sbin/nologin
-systemd-oom:x:997:997:systemd Userspace OOM Killer:/:/usr/sbin/nologin
-systemd-resolve:x:193:193:systemd Resolver:/:/usr/sbin/nologin
-polkitd:x:996:996:User for polkitd:/:/sbin/nologin
-rtkit:x:172:172:RealtimeKit:/proc:/sbin/nologin
-gluster:x:995:995:GlusterFS daemons:/run/gluster:/sbin/nologin
-dnsmasq:x:994:994:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/usr/sbin/nologin
-rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
-rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
-qemu:x:107:107:qemu user:/:/sbin/nologin
-pipewire:x:993:992:PipeWire System Daemon:/var/run/pipewire:/sbin/nologin
-geoclue:x:992:991:User for geoclue:/var/lib/geoclue:/sbin/nologin
-systemd-coredump:x:989:989:systemd Core Dumper:/:/usr/sbin/nologin
-systemd-timesync:x:988:988:systemd Time Synchronization:/:/usr/sbin/nologin
diff --git a/cli/internal/libvirt/libvirtd.conf b/cli/internal/libvirt/libvirtd.conf
deleted file mode 100644
index 0552fd4af..000000000
--- a/cli/internal/libvirt/libvirtd.conf
+++ /dev/null
@@ -1,5 +0,0 @@
-listen_tls = 0
-listen_tcp = 1
-tcp_port = "16599"
-listen_addr = "localhost"
-auth_tcp = "none"
diff --git a/cli/internal/libvirt/nvram/BUILD.bazel b/cli/internal/libvirt/nvram/BUILD.bazel
deleted file mode 100644
index 5731e5674..000000000
--- a/cli/internal/libvirt/nvram/BUILD.bazel
+++ /dev/null
@@ -1,8 +0,0 @@
-filegroup(
-    name = "nvram_vars",
-    srcs = glob(
-        ["**/*.fd"],
-        exclude = ["BUILD"],
-    ),
-    visibility = ["//visibility:public"],
-)
diff --git a/cli/internal/libvirt/nvram/constellation_vars.production.fd b/cli/internal/libvirt/nvram/constellation_vars.production.fd
deleted file mode 100644
index 7913e23880761b2f4a16992f8b797e92d3656cae..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 131072
zcmeI52_RJ4|G@8<v1W~wqJ~1Dx-+&m*+N2O*J_O^jBF8)NR*|tDO42oL?mrUrPBV=
zqO`vhqEac+&i~wDB$4S?z25Kt`yOw)bMHO(-0%6E@BMzy`Q9_<Vc3@`LHT7{Qed3v
zuH}kGytB+LFpP_pVV<Gw)V5X%HWib4hYoO2iKC*#KkX?<r71gPeTx3JrDG(fpIp4Q
z@IHpkY;8Z6ZKI7TvNNLXBVPUi!U`iWJbs!w`!Emsa+!=_PWNl#&ab;FmMw%;Z6Yhj
zTVN*W%r=M89X0F!oECE+XTWUbMqeT)k@ll)MpkjU3?*x7Nz6&F{zK+!;gRHYJd$fg
zI+=^a#l?@czFtw^lvMf>7vkYpik=$%Mu<e}$Bp4LXv+8~9<mLEEG}p1=1QIF<WIG7
za|!Tuqv|o4{?w5cCSy$uOsEUpf~mAoG&!8wc|AW#QryqY#mUpn*I&oi&DF!ne~b&$
z3m-aAh^9uvRcR=xt7^_1D5R=M!|CcByT9U=ktDgU6(ezD<VcbThDVYFxFSg;EOA&=
zNJ7cejS7)oD{^Ab#e4X?yKll<pt-Cc*I9QDd~0=MWAd~@2fNd{E#u-^=bIWo*3?`(
zW)o@XED4K8Sqbt&ucII3;1_fxpCrUdM*HY%zA7(WbAOS<s$}7n2Ti?342`cDYc7Ae
znCI>3dZ|HyelihWSvR>aO*k7e@~lRNq|m7N<P?v)Ii+R^$7UW@-ZkEYvQhe-#^F;F
zqA7WMu0@7a<@{~T?eVcC&ttG>qM4o4B-i=mmNS;AZ`NO0w_uycx$H~H3rn)+^3{!(
ze)CqOm?!Mzh5EpIt#Y?>C(NCt_GI6=Dl^KcutLWo?iUAc4YaqFbS%Q@jT+NVz6wt0
zujA9iMJ8dSj1W8+=SOWVBTnJMF<ga*-!XbBDf+D*Nr*B`QpViJ&D+Y#lxpPW?dI#`
zkCZ_lwJc*k!v*c&GQ@?#6iJH2q{oicZBp9=LNfH46ZFRHzrNYG0Ut)39!?pAOD^p>
z!<Tx8numnVHe0)5f8;!w+&Hm@`#d|B>`+eAv=L13=Eial3F@w7T&i^ANu3dNHTTT1
z&3C!|!s~{P7vKNnApVC=K+b0Ue)scF3^|5ZHMf@DahBcGa%#`t6U~hU9u0jLov$ra
zdCgGsj<x^XHn9_qr+w^CNi!P?ZhA9MmZ-*z%WRtBx>;@F$n^?AifNJq>nAb<<ahaL
zgl*NF-B7Q6XU)6*`?SjI?hQDZ7tc*~O5N~x>Yn#|XG_;^tUIYDw)}OhqC%#RMuT9>
zGOffn8cpw-23$*YK5DgpPlfTG7tMb4A%Qhhlr)PYGLr=-&_*muuc<jS_<~VQw%nx`
z0ZvP+^$$(8^ApnwN@ZYJZ#E%6ZGNXs;6qP%J^$A>!2~k^tH3g3y%{2~3Sbrf`>aBD
zFF%Or6rl8x8^eyIykG1<rkfpc9NApAI>-c%<gQ1a{&KsQ7jP1|vVxVD+|?TrZa!iS
ztsl$wQ+UL=Y^-SFxESH|`NRe6ocuf(-tPWPZ<;7BOdRAD=S4jMFQ&IEZ742H91##7
zV8(FqW%@Da`&0FqzCKLk9~kJ0iTHTpJXxIH<9VvJ2gBEuYT@MTA51lK@?GfW@8jv@
z;zqSZT?<w}fre|))#$hyjXoar6X+W4yXwR)9<lV7$gG5qY?oQKXPJrKj=nCHj?-wU
z|M2a8MOpoU*kieN3i%2rpVWP@TQY@f4zJMdX|?`JkMcztyq-3M7gf)6p@)hMG#9S!
z_vg3)>sFn9T@|%AB~_*F^`SMD{0|<MQnGgA()Xt}@mQp|{y8K3>~izf)adfou@BPP
zB1@k=zF6LDwZM5oKmDSI@}F9{-(4${$Ps%ud}V^qp-dUGhP>L%?<G&%IDX+;ec9OB
z<mV&e$PEdv;+~wG_Ca5)f4{H;Mr%FqKBBCA`dXFpRFtH&sP^45@kwp+{9`==4cm&%
zkKWB)q-3A{LHKI0R!yqg#J@%<rG4~u*#0zc?TZ$5@ujD^8fxbKwI%T43zxOW_XO)i
z1;>O}TV~a73E^d|9?;&eh$NXKQYN@455F=Gi9(9h96+L=ekazY)8PD3|6=;&%nR=Q
zug<z<vpeLkgR%2)sm==|xF~`{1u!ct0CUFlF<rbLY9kpD3Q<fnE<)^xlSpk8Zk&uZ
zU-UK%=3DAN2(uSERylp^a2vjf6XX_T;j@V=hEZ&AD||+}dAeD&iHE<x&xEmKU3@*q
zc(HYv=&p|SS;!!cj`i_nx(2xT`;A3vfpi?HF49}1v`AOyA!WcvqyKRAF(@nU$is&!
z%FWG7B2lbyOWcCJk8?#&>A2D2#fy8o5$aL(eFy(;k1shA!Mql=;<d#3L0spRCVfy^
zD=l~<{mRRF%lTQ)w;u>tl89xG&J3LSB=}H~=7Jd^qOL6uTwigyAAOTGB<M(S`3iei
z!AiTcQW^8OEAO1X%qX8~LO=9$&Q<(%>FdJcAl?k+*3>&{wowg{=ks*seKs$A+?ptI
zBWYM|-TGk#N`eU{Z6imChP=5Ey5mY<5%<~PXCjGfH=k&|&kXYv3AuLM;GWuyr12uP
zb8T-9;!bMj-Kn=PeeowgsaK0^|4NG<o*8pt=O_EHYYg`RYr-O4g^Sk;#l=pFiF#UH
zenh`EcXZUcRST47hE92JnH_O<wDjRB%lnwv+Z3(ij`<H%4`i&k;wB|9xNdi7=JCjw
z>Erf}6*?sm!~B#mreyrVx<@CgYAz~9y;!gJVpLqBq3*<pA?`Qd={vYx5GwhEtu=2B
znE2<e5g#pdb%Lu#n+q&Z4D_~qmc$6zBl0GO`?A4_Tq}u)VIOcxwx)*D?P-i5YBxQe
zRdQYOTrXI0$x|*kcW+|}dAp(Gt}@;evXL)8y{ZqUJ082adxxBa$@$|qO`iUtZKq!F
z$UI<wz9U)ADsN4&Ol7L>umRE5J_UaZsf&c>tN9jhbez~2{B(PP^qlRIg)yfd4{15D
zQJy(2t$NM-*x*ek8N!D$q^aB+-=3Gq!)}x{l}d;PEL2M$av<5UX?Ff8yXhKN=~2hF
z_SRRNN^$(6uV{)qz=Z;-8xypW3^Gb?Ulw+EW4fZJDhM4{kSsfHYOz*l_b%Oc8te2&
z5_yS)qfhq{WOaU--lmVz5-A^=&n7dAMkwa#*0`pwGtJzPJS51n(55$e2DJrt%0sv=
zBf*~K`FcFd+u`Y+_U!3yAWwIU?df;}Z3)3KzHW~S9<kz=cnvy^w|k9IpS=d*#k!7>
zsJa3E9!y^ba(0BlXm@ZloHm{|PK~BUXF0g`U3Fp?kBIsuqK-i$JC;+H|17E<!`qd)
z*pF(_Zsd^frdn|7<n9R`-d;0?zq;<!n<PdFCVPaTs`?_Aa>07(bDm{~Pf??8y}26K
zG%i0UGk0{Tb1-*X^)zjYI@PDTtZre|=2DG-$Fa0~2|l%VH4pe3CXJjG<2YR9*j=L?
z?r&x&ZuNc2yYpPp(1}*+p|uqaibXNftwraC^E0yy*BtjwnxtECAwzo(*8;N!#xVJj
zvo+d2=?@TCUnRBw()|<tAD)<{_*^jvkDH~$zff+am7}CesfUbJaf5Nw7N_{-9{he&
z=KQhUTKQh^n*o>9=Xgph&n_?7JUou+eL&%shWJVIO2xb)`b6EeDi6+FTwI@RJ^jt>
zev}xu{rZEl3aY%M7B|cs@qQ|q?d0^4lhgjDliM|lYy2w7vW-C(6W?t$Pk9h(v&ZV^
zIJxUBwii~{Z=db#aYbu=;;b9xDTB&z+jb{sj+@~o>Bi|s(FWh;<dFKJ0Y1{%cK3#B
zjHauy+}ljHJ45bmI&O+jWA7vPHkmW`)=SwvIyQ-qp^Ikh2tMIm@M8Srl1Y{#-pbmd
z;(o1J9+#)?R5OcB;#PQ0GfZ>}u524O#$aJ{Y3<0u+cK+T@9^Ike8yBjWB!8ph9Ng7
ziCKdNW~LTB)S+txmK~pY`dAI6^oeA}?voxboOj=|_O!t5cRmemUH|9wRm}~d(SCL(
zEM@)FW;SKS+McD{=H-9(Hm<t7Ic!y4V@tnSz7N{xWPHP|3ZEWzsjAkZx#dUHzS@0J
zGBZspYj5fay~~MF^Q>jsRz4|~F-m0S`%TwP(@C3GyG^M;Y>i*6?8wIQzx~F~o18P-
zvEe>hG^>LDadS)3@`K?sR?Ih&O4y#?Un@e%gM0DeHKxuX2aoffDP9tzMiw@4UXuLy
z{KxWXn&(Dm+J#EDYTYdqnfbo5Y#-Nht_e@}-SVzs$ZGx_ait|dirc+no!#6~L&l$d
zKKjAM8Uw#sm#>yD$&r+bG_=1wcT2=R_dTBKuS#mQM?6&DE)c-eGRQXhT9C>W?jcVv
zuOMy77JbQmzc@_A<q%KmaM`kVL7oro2l8krujx<zEA!T?(Z%o9Z_#-+$lzsp?Cgb;
zbI27wgOmgoRLwKGa@|FM{%X$+jbTbYGi&u6_!gPi6^AX0Xq27QEPeb`QQ|t`6$a~~
zAMd3mAKi4})P~GC&XwsdeAFWWqKp5~YBDHF+n9F2ZYfiB7v<98OlN6_u<ipMoenoJ
z0&Tw@@bHKtH}ID22KXw<SZ;vwl^ggM4|p``G&)^Poju?|yQ;)49ue_N{K4k{?`MC|
zWe`WTF)%ddc*L`V&(rjb0sjIM!OYT_aGn4`eUi0nm1H>Yv$cQpEATreC~$h3fm8Y^
z$<av_ua(n3m>H+)E=`<NWc}$;$(1c-nS)}(bz^5cEc2irjyF2@d{K$4c}i?(+Z64D
z)${^|sd)hho}V)vI!!99CNf1PXt9}K{*e}u3dxF+_sTnFjGOcNL-Cy;t~+fF0z;Cn
zFDsN1e|)esL?`6Iu#t-A-oLP&EBz>JeOPJZl!D;#wYLkL<IIkY^LgkoLgJiiCZFbY
zd&b;~&}YXfR(y5S^Oa&;_?(z7100?dC<osVbaIcK^=WQyOn7m$yZIvf{&EyKx$?Ld
z){C%m3w8Uz4SdfR?A=bf&UOZY$Qk(J{W}LRXvD+KI)@Mce2j|-m%cr|@KE?-t7%R0
znljV3DTIhneU^3^7>VZ|)8{`D>9aZhx;f4Jy4<GNA=iG6&-h;%7^(B=wc&r2zX=q~
z74@)JA7w}nR1AI5Usq9Y$h2&)h;dUL#BG`$+pF!A>=&6mCpYr;(q+0ltM|*iA{R9c
zo-^d7MdG`CHc@&brKv{>@@7b!D&4(tgRFGo9g&ZVw{GxTv*P@bBbG(n7DD&!wx&Bh
z6RP!+zojEGQ0HuU#<UY=ds6z#@L8`ua;Bt6S<6^?82#e{S%!J)*)Tn|j~YA!<5p93
zO82G62Pj@VN6u)ObEQthdP$MRfr|cDc#j?Szkhe=>ZRA84Qd`MA-Qnu-}B@1hu5Bo
zy7}zMan;CNTa!VfUwUldy?Ck7w=wVVz3AneRAfz6l^aE-HG0GxSZhNM*tQ^Y!K4g%
zvCL<=Hz;`*Zt6IsM_t)q>byp7u)j>amXYw3oi+KXYU+F6AGFF+iD<~=UUYU#VR8MC
zDf4TLtc6$EhVM(0+*A;K*<*6z@B?G#uC`d7a5^D!p6<5hF+x?zS3Lu24l)kNM!)C1
z((=&k%I#d0#a2V*>6&LeEqymc=f6~US|IhhU}A)Y?N0jW*6l0b=|w9Jve_1SerD=h
ze3P}rPNO9Gv1b)(bk`4_&81zNRK0xGq{-TcjU;_-9?Hw@y%kbN=26OcGc?igBqmfT
zwX#}RUD27mXu!@Fmle~~9W))^j$2<?73A}_*fct3eM?mym%($l69+TG7?J_JYg1qE
zEOA(7j~oCo7U_5y#&QQe{Ue7ClF;W&zl=t{J+=nPWtb@cxd~IOFgMHv#T|UnRu5yM
zKYtWi_r{#in8_0zBd+44e94aT1seiONBSh|r~58?K6^@Bnm#Jq50%Npyf8ELuPdv}
zuVeq{@~@IGIzmAo@7klc?grd4-hbnOnyiS+5*Jj4FDjE5*R|(pYa?VF{#6NI9vF;v
z2?kX)eu)i^-X_UpQ@KeBB9m-UdETfrCMwkgeGf(wPsaj@+^F1181I+Ge6>fsqafrI
z)A4!AB~c-^YB836j^R7e46{bjoc4PX<@D7?BRld+RvMX9W?33+netce7!lKV#z;B_
zsxJeziYKOvzWF05y)YlNHAgZNOnr%K+uAwwbsq_oR|*MiU`%(I(ja8I_u`hl<L~nd
zepxaVqoI6XB?2HT>H7P-dHMKLd(6eo^qaONXw(hqn*{3n(vojp{r~%9r;h*suI3Nb
zj%8~&vuVWak^k7Has6DIM(?T8?bBP(8MaO9F;`Dl{)5NBru7LMY+CP#z^3)ihJEHc
zY#QM`|8tv0X7yM5^1z(-(^T2=cinat&bDbi=IVOIZ}<*2txxD+(|Sh)Hm!Fy>@(kC
z(}*$b57;ycCvgH!ZJHWe{;pd>KvrVgv>tP@GySG5*t9;ugH7ul5!kfe*|5)ihfPD1
zDSpVNakK8#cYKvoyVf~5gk2Y6O9;tIY`fNDE_SBhv<17?CwQ=Hy(0p<);k;aneVV`
z#4Ldy>8o+`{M@*j2D=Vjw;fX%KF8I1%+>XZ-|!vmTA$FtuJw)x>{{<^*k``Ot`YBA
zf6T7&{?yo-Cc6$@x1BG9+5NR1b9KGqH+%=X)+cnZYrP`^yVg4!_8AVxhQz!MVvfiU
z+BLqP8DAU6u0z)?AtWoY?OKny*qMIQ7VKJ|;K8o-jtJ~p?`+s-IJ9djC_jNS=Gu6d
zVg(bulsO(@@;7u!h*@t&7#*93O+j-BZ82lCZ_u%4jlSuld2z;Q=Gt_0Et=lJQGZRL
z&wJ^!N;E_z8(}t>C7LJK^)8&uza!=c63dzNULRW|y(RjcCR=)x`HRF^UB3T5v@z{(
zZ`m(Ei2L+CFOi5z5>s2cucyME=h=1cAcnQe-r2SNqF$eO`lGLtzfmSyS%dY5Vf;un
zR8UJWP)qorKQu>@R{}eCq%id9TQ&3SCzEUTxJhoK@JL{?*(!z-fn<Ya-mwRp=MSfa
zw^7iX)4uCRv{g^_vqtyyLUSUSXzr;$%EM{hh;|`fn|J4Bfo5Ggp_1maW{7%WrfAO_
zb4NMdyb(5*{`SR90OclHuY1{D%W~(i4cPNo>%;d^@>=>$J#t<1R{Y$R*|tb7U!<YF
z=#QAoYRHnCkdrfgA?Di-?LkI;RGK$>y4q=Skp!{Jx@4k47>R^JJR~kM>Nt={OF3;f
zVsfTjulFHlyP|gOewSe#M_BV3h&yp!CxSqC?i|;NMCnx)w9pPpWMOe)gJCDyT?-$H
zL>7?1tc;FV9esCIEJYAYRMb9h)-Ezf&n>}cA^P+zGe>-Ws??l3i-hhN_aJk-HukDJ
z9j*HPBsrBSzXzHA`L_RNa}a9tT}s4B-3cAq-)r6fSsnVBwdbVngf6b_q3*vz7ys$H
z5$)R4L*3eS`oFYY5kwM20!y7aGkQ*;sZo@T+m)kHCJ#Fw3RK^Y)T?FXR4-njf_k>A
zz1pbH{_UHMO-R@&aUZ_mn+1K3J@^UaIQOGhdSLgjex`l`9ZvL$cqX|}tM#l`|C`Sw
zLQfXyNA!-{(3&;h*IyIqmF559GuolV+lKqw<hXe191UA@v4pS8j@9WVw|BZ(W00RW
zULtci4k5;0gs<(c_wB!-`#cgvS#)OH*qDZ4#FN6=c!`s;JAQfAQTD)&vis&h$b1@o
zy374r`h`E@_&87vPV5)KBj(@4<0t4kQK$dLabHod?eLHLkss8|ugpKkW8WqJ9tK}k
zg45?|MGtlOMSZ0oX{Yasqx{>(_e6ZNr<hvL@y+(%vGby9zLkjhrZ@U@_YLea+r1j$
zd5CU06~#9VP@K&eeVc*4nW23uS|3{%MTw`NKVuXtHesDJ>xhfu=vUQLbY=JW7S}Lx
ze<GyT)`nq3Z)y5&z6h~22eakE4+mSSI23TAcLWb&%2jW&e;My3q1Y+mi?#aveLKN~
zSZAQOa@(2EQ4SLNsB{t`EEe%gbzih4ez{IXG(6D0C;IC>8oX==C3NyuY4cpSDoc;c
z`>$}`cl>^R=)14*J!KNL=j0u&3d)D0PZ~waR8zOYY_n+G#w_hm@68Y!FIMC>7`?j)
zMlo|Yq(R=Dac3e1&0xi1F^tfarRal}M($jKo!DoEB#|J59uUnTLTpjuL@uJPL|a?r
z%yBfV!t`?vYTXpQ7dPArt+PPf+Z4$Y$Z9_f^K*9cSD~rUaXMP-9Q`v+puJz$`Li?P
zradI0Unhbd+V1xt)`nP!?!aKJ7V-7!c*HeCYC<>Yel1!O={{QR{Y?9^ND_>ao$(q*
zWdY=crTP`B$xRQ0#RI-tAgSv*c~cB%()eIv)i^#u@##!oS6>e|hBwvD&Ch>6THoE9
zCW0<UXL$vA^q4Ll0bZRe!wL>CaCLX{bo2A0S_S)|^$`51MqbWSY3x;21!eV_-srfe
zCu_ynuNR=B(}{KR=ybH&swxdvLy1@y39XRSx%=gke!o}Lz7~XC6<q0JFRRM9%5~~h
zt^bKj19yb|kyEkZyxfW+_qO1QR;Ey>&;AgR58-hYZ$u{wkB~?R)!n#bWX+QKjB0UL
zr3>n55)5y7z1^>v_w5Jx{V^(kbExTVOligQpqK7x^X90YX&X>~ajd&dzy*ndhI7$g
z8~?iNxono;<z4!Z%?(#(rNq<e53;kzZM!G9U2xdsi|a~B`GuMKydI(sbvInMttb@R
zVE1VK{=?I=`LwAPJ9nf_V94e4`!Hz3y20BA?yC?!(XzW)RV*dNDU(SHW(wY^Oi5m%
zy7{h0;Vs&21$|QE)zeqcRX%jWVoYDn;%&&9WLVR0)y1<P#x>6RGwWrDg6g*R<&m^;
ztu8AZwOvY8@VayG)8J2MpS`ia6J)6pck$~bUB6iHwTH#xRj(gfsz0syw7|zX+y?P)
zqO30ucHZ(xaQULW8Jp#eXKLy-YRrhSS$cB!sr}x5F}PsqCVOp{d5eas_>W9T8hT7P
zu2kCo(i!ntuO~krN)fmhXI<bHmo(pscU`>BlG6T@&zmG#D$<V)k8xq}dxcgyD}=`3
zzOI$|+OxO|J(TZk;!(hrH%hqQS;oAVVv#Uc>B)O>+s6(%TFx5YH!B5l<ObFr4G%c8
zF*Jzcz4AfK!)VIU7TM`(^iy`5UJXmEwJV8yRQ+%t9&e;SqvEf`t#L9h_O6m`E-S27
zvT;tInEW>65r2k7oo-IXp<#L9nQ~*Psup!Rv)3%!s$^>wPK(|hcbKDhY{c{x!c6qG
z4h!+FkP|;j*eK55EB5U}h_OgM`gHf7zh%7Hz2kv(zJej#7pDPCj{A+oi2r1-b^pi5
zG+q1iX!QK^U~r;WgdVKzfyFNx7yPu!aZ)#;o&QBK&|lKd9pRQAc}>C57?{u#cu(=4
zy*nq^!Fvh>p@&4Uf!KOiz2YE%%HjMTPWudG)|i{KJ_E$4KPxezyZ>D=YVAJbDny+i
zM$MW-*4YUqTAb5PD0+Ik`S~9Xg>p2`Ao@BGqyDaT`r(El;#YmeZi(mV-x#CjG$u<7
z!2Y{pvVFJ7_r_0&2?LOT01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f
z00e*l5C8(di-7Vd`>h_Ke;B8iyJ4TwhHOyTqvG0%gsBoi|3i9|ewSQuUmySkfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
z0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx
U0zd!=00AHX1b_e#__+lB5BxLC?*IS*

diff --git a/cli/internal/libvirt/nvram/constellation_vars.testing.fd b/cli/internal/libvirt/nvram/constellation_vars.testing.fd
deleted file mode 100644
index 95ea75dca87677a6a5744c8bc310f536f9ca555a..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 131072
zcmeI52|x{9`@rXRZ>v%%k&3IND4K4YkoHZhR#{usO`G<VD5;bP35B9~6Oo8Y5wc{-
zF6%24l@O7={%3C8B&F-a>;3-UGuJeCX3m^>&hI?)Jm)-f?tx)nFG+GQ+f#!RO?NJn
zG31<SVToaEj0AHH?2OvmD3}o@`W_u%qY_62h(8@msC-LqcuJb?)+OVG%}<1^DY}ng
zGuk@N<=SduGR%Z%`<Rn^@W9cdFnq;S73N_M^yLy6!<_EdCZ1h;MKG5StJy%7TVaWr
zpfg(?%D301{53VMaM$2ja?SokN@6*HwplqPnG%#7qtdt&-h;&EXyDQ0Ogx$`K9kHw
zVq@dR+TO(1x1^T8#Q8Y5$Hp4PzU3p42C!rJG(|al3<uekLKc#=a&x5`IR#R!-CTnF
z-KaXgzJXL(OA`eXeG}?@w=k;W7)42(+I2lQNkk~X&Be*f%|B4f-_6y-DR8`tuQxt?
z2%n;|BCe!}78ND68AJG#)D&@=O6TtHxMeg+vU|Zu>=-$k#E;?8Bp$YC5(!Hl5fh$N
z`gHy1Xz%!436(26{NCR;;Ve*FI)Lqry9d7IQFHUgsYMR<r?guqB(}{nHEvK-TQhzG
zY4}WG%f~rM(tK}XAMe7?X^Au@C5puQ>8ib|Dqnqnf$++W1D78(^&T~RMXiE`^raGx
zcc<z_hXw~oM0w}jWWPA^Ot|bB)hrRdF)KEvdEDJqZkBX(#$mag>L!%+;_p=tpPU#=
z*|Yarba>6Kzm3^FKDF-g80M91W-mI~bso9(v{m}sl#6RUw|Z3OUfejpG<Ocy6Ls;o
z@AykNB43`X55CtXc{^|7oSDjv`zveAC}Sdv9E;gs6y6##-A=@@7^gL>PCfA|ENPII
zUke+Vgpsns@i3el)wP5Wg$>7Wc@A#JSR+#GI~@`qWrT=?g`b;`wY4eL(9Orq-zg9&
zgD$FB`aHS|+QB7=3kOm}D8iE)93QodZsiHj(s`YvGycH!P5w>z2;#I9WhgGPr1u10
z>m8~d5;n_hP5goAxe|Gaf=%~1b}Za3m!W3Mo8-fe<sIVHUQWMw!;K?-TIiL$(?>Vm
zWe-^VWVpJ}fyRUQBCViZn{)@<&p$496t8*RR({8M<c8Lhd;gwfVa)S*`1{y=O}-n~
z4Akz}1kPy}JnnePZ~94b-=>0_KE5YPmEtC3x9GWUQl2E6GCEWyLu5$(Bs!1u&H&ZO
zEo!rx>NW4Iem`ixM%9yhgHP;P!A^BbU-x(V-Vgg`iPx=vaza^f*_#BJ(b;~gO}wp3
zHIm<|w!Ci{d@b4ei1mTJSB>|+cpXq59$c$8R;?r|dn4~e#Ze0~Yikb;J7-v%D|zun
zkkgV!x`&MH0|Yff)9D!2mrcmenAc?!xX=?`&;6}UFv0Y}DliOLUxo;*0$7FrKC95v
z%MT?Q1!(!ij$vhKA3_|+G_x{C+1F22g__{e?DfdgU+VDkJWf29;~8nm-Mt~<=A%|C
z4q(`R3WpGzt+k>ME=V|iE+HO!rvMMSk9(l6kD>rRkT}RG#EDu0-o8Grio<bn;s}q>
zU^BXlzi)u=yg;h1ufLx!@(*-$#UxyvI8PR$^?IIa<3aa#rCK`q2ZmA2oc!mz1^Rh8
zxwuiSP}73ZPEf>EY05NQS&^oW+6gq(j$IXE7mr%<TVx)K%XY{-vUiz@){d?=m4+)S
zqV~i0+Z7e{g$YOV>__L1KGFE(qy0iXw%MF~x2M(xj(wcZ-{k$YX>swR87{O4!66m{
z9}W0x!r-+lPra#$*_W0s|K!b~)i<~wJS?Z=?8e3K8?|s)rn&w#ZSk397OSYSRc#6n
zGTNidpEX>ldTs6LJaK?-@k8m)ZS3!_RS54Ad?>X%$?s6Mgjv&`x=kNMj#nQ$cdfoc
zp>E^zQHkWHq*sZJC#HVX6&y4mve0mi*WJgI<xk%zQJxBr#xAIPzf@>)yEM0gN3cPA
ziN%q-c?-r)&;2;?N|;7%y4$4lW5#BD@^{$wbkCX>ttvuGPO&xB&ON_5_`(a9HOKab
zX~l%aEq-K`Q@=T!lfG(jN4p}LWPwPT-~t@navUTIDOznXiGtdlShq%l^C#U4nNzaQ
zxevNB^Oo)I@bd=~=HjAV7YMUac!%>~)>shcjOk+9_yAN#68sb*n^>Hm*byR;+9~Wf
z8Ew95ZRpRl(tQv)UGV4)^DR=gT$3hBdgkD>h$}`=Y;kLRTBb#&S*(diV4&Yb1qBy>
zukqeYT_&2V3V!qH#8Cx5e_z)im%so8q!viWk?JD7MM{fwbuLl{d>s0RtBglUaYqg=
zR8V$yP7;Y?gInR2%zd0KR<H9$At52X-3Ya)`oBY9kH?oBjbL7jiGL%UGL-G?*vTKq
zt`X<0&b<7x-fCXX^KFGe3zM<jaoNE$8p941t9ecf7jSKT;QETq{m9!KvCy)Ts`%-y
zyf^I6h-S@Yzj5c(C3=;S3GL9+*;nv4<!_2gLOHYK+S2bR+r>0RpWUM^?YC)uLt8R`
zb?S(^Cn+Ne#_}eaw9AeW2!C50vHfyzG5eXYXZ*=)HXU!f?;GjGAAaqa{ypVssp|Z7
zbL?&oWlw$0xkG1vX2@qQ(N_!X&S%6*WyhV{@p*dWHM;xY)sa!J77Nw!B_>Rci+TE}
zs!X>oZ(PjUm7a1lBJ@63<wl(uCw{ob>OLm;E=}W@WBvoB!mRkqZlXNHp6rguJ{BEk
zK4G5%-$~&(-_J?oOVtlPd3>U#_JT~zixiy~V-k}Mv?oQ0x!-)R>)>{duk<sv#^QC*
zq`!8K`edoC6;?COg2z)P*vINwDm{EJ|JykBOZvz2tc9aSe8efaYN}4Rr_#lgZ+bkt
z!FJIrh4<=3FUhdHea)rhZ3d1zD>#pjjDGp~Rec!E@#xLn+a-lf&K|pI@^q1=y-LAj
zi=YGfj$}#eJ*&ecZlr6E7#wTkSMWEV3V%etvVX~X$4Sj$Pq!6_&)z0d6nC;gthI2x
zwC{wBN2@<1gl#xMA9yHBoXWob-C5y1San59xv)UceC15B!i|nCv+_^co2y=-#T?zz
zS6k7D;`mit(G+=ra|NQ+6E#xxvr2DY8tCrk>x!PLP;`8>NX0Qz%QafNcWS>^U8^fg
zq$L&{tv!2?kMb*YHhdBnPW$-!%tqhhQ8Ih9YhBaVnr5%tC>Cl}WZRcKL)(M9<RM&_
zA#d;UeA}Pp?DTX`d-rtJ$kQEVdOFTvJ3?@btH+~)N5%gZuR+7{4zDrhi`O8$Sob~>
zRXZrq!`GjVoE>2>IvkuLuBfg!L0M6m#&B>QyDG#k9u@OjL>-TMb_}O1{Y6xJx{s@G
zNC4Hc!^k1uO|@jz$=%~UysdUT_oF8#-=@+_v5{qTC8Za6lyf#qo^vcce3BY->+O}q
zmI?X0vh&78IES&fKbopZQK9-hs(3QLW>dLpP(y;^y(GW7yK04j2C1?$;~b^rkKQ%h
z?*4X~%ohKroI5IuhflIriKx5UBvTwG-d0>G#qFD8u=<!!>SXP!=dv_svw4~|(ML$j
z&QfjvtUH(|rAG9?#rwwxJv=^B=DAELo;Y(X_k79a){Y|b<sK5&B~8XHo1IoH^WYB9
zo4sh8joiJkw}UUL%=QwOn^jf1Nh;CTr*QNwRiP6WH)Qq{(<W)Jk$-UdLP&kCjrrSI
z11NEB2Xu$#6x4W&hBVC>^}&eDbaJ}L$!UJq$?Y7&roK|7Vtwd^<o8=F(jG+E?zR3k
zPVRcE-MLlu+h#d?T-HcQo>^U$Hnak_>u_=wxEXGeX`E>otN%kz4yiBd;3J*waBsNk
zIGPf}z0F{{GvwaPaZ`LMb04|4DXh7-KJxC>u?c^QSTJpS*m0kN7wS_=CtLCR$Y}})
z1+?XOTr%3BY?hG9KKi+$L9$cWjrIxS_2<7XuahmhEwL)$4tMpi)22MC^E_8HiB(gQ
zbA}GdPA`6_MN<u~I5y+d(OOD*qsZ0WCp=y_@4jc_Wr<JU@id|><uCJ<ubU!b1MH7m
zjSNtp(UO&5cZPDCll$4b#79-HBUkQeZXJ-o^-;4@!hf-K(bFR?HIFnD-SVUAUhTdh
zlAWQEvoHO)&ZXp-xi%8*%Nt8143mBH1I)EEv@+(_Z5>-6xH=$Vq-=B5-vR1#r|g>L
z*mR#PkaLy0;dN{3vV)7K#m_SoP1=?}NF!>j2Yblj)uztj2aj={E?F3-Ode?Byl`W~
z*-uqd)hfqj+ee7EY1}R1pYh>F#eTMBY!e&z-}0%Yk5v0R>T+w4D7*XBwf1wyh^e1>
zKJLMVTK#~Tm#$PT+$AC!Z7}`PoXt`D-S>K_yeh5J9Q9CT8&42N>rlIm*Fxnlvx_~w
z6i?cmEAW#2eo3Uf%OQ?*sgV`$L%kkOAHtz3w|WryeD<wZ<4WGAY}R@<RR3jF!mRmI
zc9F084IRtlSu@x0@^u#;+N-_Qsw2kw&8X9H;96i}UlO@As(Iw(*W$-c7ALPA7_YxJ
zwqYN2<B<*LPOi(I?R+ECg^OAiBoMMlqeZ_sV|~Us`z5|gJ1G}KvYo{pB71gtv^w3u
zD75{y!^0tf+`v1g8{oQH!EghVZ`{DYxWl7HQ>4+9RhS(fw5vqy;!#n*#UFeL@P6?J
z-8ykpTYUp#mU}$gxx7qI>vMaW@Mf3CE#?T~)g{@u)`%?Te70uMfP#Rdyga9->N{ng
z6d9L#^^IKSM>FGe?Ip>Ri)}tXF1@_DB711UV(o-k4of{~hgTR@K3`Be(jqM(qFqlj
zX%($tw9%fR!snHy!>5Wy)<&mEgoc>$=9jhdUlqAp`ay2{v<b7{d@Q*W%66x{iAOB;
z`qCm%p@xIy;acGjM##!ket2OwNBnVQN@RJnUO||8-R%PBM6;t4{2qFY60TIr=2E*p
zoj&Jk#Is`*Ypy5e`D5c;xSV`l20Jts$c0t&I=Lsz{5&TwZgEMhyTyX(gCr@El2wT>
zY!+ZumMYVO*Ks}f+_#N%o#_mMku&he2X%E|P>+Y5aSoUIa*T}#m%ckT|Ip$P>!~f$
zY7*vKM~CxM{g!m=7zyPa)#WaW_S>}Lx`m?8b;%70V%L6+&-h>I7^!gSwBzTi-UjpL
z33yCb8Dl^TmWg;VNLxlnY-+A|)C403A={RQ>B>7q21Mu1&WpaiWT`gCssj?Q$i*$g
zW{bVFOn$%LHbzHQoLW|}XPWTI^4;s#jTBG5!~ZE{%esKo@n_4*tcuw!`R?0q$#i<g
zSLZE#ON)Pq)|slTsmIOsrVWzdvRPGjy0lnM!&q(v?UUz7x<&e#NFC)*svJWSS5dXf
z_oqn*$y}%;XSL40{6y7eVX<Z5)j^jzj~))Ze|Pw*CD)$~eXSrYGGF2Ec`Ndz>Q2Yp
zeAakODLT*2Wazk;9_u(STx|Al-gEd~?6M8=BTbd$n)#<Td&Cv4v84rV^^EqMoFy%o
z{VcDVvgh1QEr-mQ%j-;?S4$2Hlvtr*I8bj#ZGO74%DxW=t#jm~nzGp!oY`DdQZJ@A
zuh!6J;7Ys2`!hr~6vSTgn3612s4!=h<+7wxNzrq)x4s_FSF`boS5WOidf~{}51f}<
zADUghohKh+JzScmcG}Cze_d?;OBE+i(KiK?qAcxp(8jfGTmD`rR%WQ}*66b{(%<15
zY=n0hrb;WE8C|QLGHe!`W?kx|WiuyF(L8J@;&1y<T5{j5@F!%Bu~~12CmWo=_-=?U
ze>6}<#+kfe@QxRkWHK`y)EwVUNGYlb^?O%h8XK3=TC;~u|GC@ogISSuks!`B>2G$F
zIxL-z901W5>3kW+a0k8pkwgbcXgxh3tC?%Bo&LrOOn|#`qMkM8hPj})gFo8pV7}-R
zh$8Dgm=o$Vd7)#(RjlMM(wRSRQ*gPg-$va`{{_!y=_O|9qPzo8p1znjW`_Q{GV=U3
z_Kz<AW*LZ%P|)gAcjVUHpj*ZVstc7z^1Cc_L3#M2Jc)i?M~e1#LPn`?a`^hdFtkfB
zsHqJ|ZgTW7*+@2(oIIL;vK`9L2j%9Aay3EU!;r-0STK<q<vSVU{5qR&_K0^Bgq(s}
zeoxtiuL`aV!7?l9{*%lw8x+myxF?ZMe|03=nO5Y6p~;OLEB(!S=kvz%o4z+j($P_Q
z>8Mt`Fm3cL5J~Bc`Jt@^l9^!YPh8vH!J)tV2&1&3NML<qnuA^wpXt5}oA;^T=j8o5
zXDX(M(tWcK02zyRV4$0~Um&&DRLn$wXj_VU-LQO@Kz)B&^4+Wdf1m8q@&Dh&{HfA0
zYz=ERjTk-hAKNsxUu)B7y%oA+cndniv}wJj>g~#Z@EF*%eqn=6>l+c+w7%Ie&-{Q*
zBfRH-Zqvw&_G*6~nALWg5>x)}+pf%+Hm%oG-LLoq-@&H!3mt4)--y7b_05KP<_ByV
z(TDvBn?_+JPQa>7Q)bHFeM<<)SeQ1g*Hp|ze`pIftzYn9)A~jPHmz?q%rie=)6igw
zpR#G}jC=JTUuD&<bqx+-mW9|7LNXSnUF$U!GtnQ~f?ewuJlM6q5rJLnn+@~K57;$g
zl)%rl)z~?HZCp*2S%&W0&Y=un;%dF7>VCx^_zrfhU+7@h`bGqHt#3BWGe2P0h<B|&
zXV*A?X>3i6S%&W0t{1}0_FAv0x?k}JzJp!s7dqIrz7c_4>zfVp42yk3Vq6C?M&u{$
z8rQFkuT5Z<q5GB)lCd!DTCb^?iT=<Q>{`Fz!LId<2<%$lY?x<Qv}^JxJ%Kasnz~EL
zXcL{Z*&dP7)mo**s5e85hRwzF&{#q{%oy$KckbDsZ@Oq)oG}`?W{$2!!#h}NuZ`~a
zUb>7N4N%U8m@Q_7#>sWR3oGOAi1C5MbS8b5#|}wvg?^{WlpZDiYGJJ`KYky@@f~k(
znJ++y`}999k%&nWLtA>zr@|cP*?sIFhIPo^)wKPpTwitup|4ZElP8*4gYm&IZloIW
zs3z#BCj8I`jgjOO#wyE-BA&iew#aRqQoGkpWGjV37#o=@Zy+2@)?ezAaPaj!DaFO@
z6g1|v|MC%a)m!;&&^^7;m`GnV_B0TsVYO^Ty%4X>d-AeGqb{9LPV*QeM7=RnwC97l
zqm*tw2pdCx`{TxgQWLe;Gw<$sxwBXY%yF#si}zFZv<@&TyRLR?#hm52c1SLNq@n)k
zLyToLV8~6#$(p_p<86ocBBL(K%?CYQ9W>cUyx1jeGEpFmL_#4R5*ryc97v=ktkxSb
zI8(CE`w*jDQN8xO%ZSb+jByRbomejuL7*phmdiw<^eGFPXa_CifkMOv!;W{j7A_Kr
z%p;6h8y>4U^8Sio8ZVYCqj}7%Lu8hoTY}GgwDvADOMHH*)T}&<gzgykB6Ei}_NhCa
zwff^ES(Pcj7n%O~y8mu<5Nh*7O2kUp2^~7nXW9Q*9r~4}XQk|fF0SdN?7u@7|LL+3
z_1e-)**bLkzqDQvL=r_9OP?_#c6O1eVT`TY<s&gB54#=;RNl^|Ps_@xUc5jV^=?=D
zv{7ID+jlFQkg!YQetf}qGx`yG@C(SX?nf{8!tP)FO#K2ntmqZ-OtPU`>s_z@H=jv_
zp3FahXdSnsIct8by~f`s%m2k^v{Q+<N(I{Pa`DnS61n<9DOZI(qtQ+7Xmm6BAiu7^
zL}sxcLiE1~U)xjfJAOm=r6-7zXickLpMhb-lfqhmiIu!Ne|grK_mIxK`{zK&d<v~S
z<^Ch>!k=+`ET{%6_KV;V_iy6y3v`_*(|=>Xuei^8_{aUoPip2j=AY%h@4|l%gKrAK
z>hl!eOBsGsTj^)&>4)Md|F-@;5#Q`Brq+9Wv*UN{oambGEku0N2dzDQ12fMKuSR$t
zqM1%b@lAacXER3MrlD_UXrGGa$JRzsVm<URMzLZO#yPXjxG0W(RZT@#_Ka__jUW#q
zLTc^p7)G>~%y)A|31&E$EgSf7n3cRk0V{e(@F0d<^(Fh)@m>;&of5uSqu<}R6HJJC
z2Kvgkg9#0#AfZ*hiwI${h+nGvqb>2vbt<Caf%d)7r|)R+((ROpDO<!X^4w~yJT4u$
z%zE4L$MvEAw!)9(NtB+IceL^-9gfxvim0iY_Eob@0*UK$G(UeZLu|Ymk=roz?jj7u
z%-xU%`E<pdi5N7U5sSqzLRXfc6-|xYH3d7d&j?8(K?pq{s)L`{qJ<T?h_VuOZMkc<
zqd^U(yX&CFO@VufQr2jm1>)YONS<Iu{b5*uvs0kFqC5?!p}Ee{p9wr2?Ygd?oe?+f
zWg*&i+~}e0c@JW4i23LabjEBE-_DLlTth6+&<%QCi>5@ng=Tv{)-f%Tuy*Q@#`-J1
zuh|tmBiL6Sth};V+~AuDl9qLwY)DUEQ5+ve%o@kVD`f8L@9OX2M)#rGy9ET!L-V`)
zDDtDr(OFJj4jo??k09@^nPGVc>$|$UdAS7yP_4rP(0m91R6}oPBSjfpnlT9-?{HmT
zA9UQyi!oy?)dppWrkm}YeU3&WCdos8)oDs-&UjUvm@S@$fOhTTQU4M-`<n{(^l}H4
zF^yv5bl09)pcSfgK0$}A?8y0#X4$Vc&)Lf_9~%@QDCn$j_jH@#h~&D~P3PAiPaAD4
z=+ox0SG+;NNF(>^lvS@R*ISNxreI16rR7taE4SJ$sy3PV*gWygmCSn2YwH>=P1Cm&
z#x=JrKbT`9cxD(?w&>bXtIq+7+PR{OgvWop!e(cAetcu2?Ue}=kIcJxDAg+G?Srr|
zpAF~LH;A1{qC5UAe5z%stkuwEHjl@wO(h#Q)TA3dq%Nsdm+;qKbeLSAZ5nG;RbH6e
zTA0?l%(<lguG4~R8LMu27YQ~O=(uO54&Ud}a+%a}XSaFC<D!{tJTZUWjs5t3=ZrF0
z2f^(f6C-Kj8r|kLDwTRCEI;e)rWE7Jq?KZhxeKMDwthRA>sM2~_A*U87hS_K(QYn#
z**x>GWYzeGJH|D%2W&qOa(x@;?Y*lS;$LE($wjWYrg{qk8$9ZdSFC9qXLc^1U$sSA
zBBD$wU2OO6jR7A9?0c8(X0XWLyu4t>&V8*1g=amFAHv~otiR|^_&Rro+7U8-JLfv(
z#LJCIX!r}So>+OLgttxk^Y#jBdgI>lN>cJXc58!LuD;VB@4uzyhV}K}>+2qf+>rbD
zwyh+1{f3tP`vMJO4_&y}=DaJPvl(;S#g|Q!xtQ%HG(qbVeTcyGX$7ZuJjgTSB<(tK
zaUR$5;{0v5D+*;&s;<aWhYJj`+BK+onoZTgK&9!r$~CLPU(Rlc$g<$L6`c0YXZ8vf
z->(rvR|pf)*BmUwdqP%xC}E#if2Y{L{~-Dy`DpFwJO4;uvuC3N>w5h{xGq+Mmn^p#
ziQfK+KFj`(_h-7d<x$W1*TG;#uLwO@(+i8=)F=35g=3{`L_PnD;-9~zo;yP=Kl6%$
zrT#CWC-9EqKYMRZu!DCL2tqFl!3N^$-Svuv;3<o34_4a@WJZ6RwKfC9r@tsMp}YTG
z@oCL|V=6?MAU@3)Ki1U<C2E}2MksoEd-(aE4uc~9+<(0hZ5@bD|4=>sbj7ezFU0fo
zZ;Vf~8jmG9VE<k5*#4iDAB~+NcMA&;00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBI
zKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBI
zKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBI
zKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBI
zKmZ5;0U!VbfB+Bx0zlx85|A4+eTzrLBIC>|H|%qU*gE;W@~&-2q8fhmpVFh{j|vAj
z2LeC<2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
z00KY&2mk>f00e*l5C8%|00;m9AOHk_01yBIKmZ5;0U!VbfB+Bx0zd!=00AHX1b_e#
c00KY&2mk>f00e*l5C8%|00;nqUq;~n0EU{`I{*Lx

diff --git a/cli/internal/libvirt/qemu.conf b/cli/internal/libvirt/qemu.conf
deleted file mode 100644
index f376e82f4..000000000
--- a/cli/internal/libvirt/qemu.conf
+++ /dev/null
@@ -1 +0,0 @@
-cgroup_controllers = []
diff --git a/cli/internal/libvirt/start.sh b/cli/internal/libvirt/start.sh
deleted file mode 100755
index 6e84e0c39..000000000
--- a/cli/internal/libvirt/start.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-shopt -s inherit_errexit
-
-# ensure library cache is up to date
-ldconfig
-
-chown -R tss:root /var/lib/swtpm-localca
-
-# Assign qemu the GID of the host system's 'kvm' group to avoid permission issues for environments defaulting to 660 for /dev/kvm (e.g. Debian-based distros)
-KVM_HOST_GID="$(stat -c '%g' /dev/kvm)"
-groupadd -o -g "${KVM_HOST_GID}" host-kvm
-usermod -a -G host-kvm qemu
-
-# Start libvirt daemon
-libvirtd --daemon --listen
-virtlogd --daemon
-
-sleep infinity
diff --git a/dev-docs/workflows/qemu.md b/dev-docs/workflows/qemu.md
index d3dac6fbf..3f294cc8b 100644
--- a/dev-docs/workflows/qemu.md
+++ b/dev-docs/workflows/qemu.md
@@ -11,7 +11,7 @@ You may either use [your local libvirt setup](#local-libvirt-setup) if it meets
 ## Containerized libvirt
 
 Constellation will automatically deploy a containerized libvirt instance, if no connection URI is defined in the Constellation config file.
-Follow the steps in our [libvirt readme](../../cli/internal/libvirt/README.md) if you wish to build your own image.
+Follow the steps in our [libvirt readme](../../nix/container/README.md) if you wish to build your own image.
 
 ## Local libvirt setup
 
diff --git a/flake.nix b/flake.nix
index 20d68570d..681ea120e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -49,6 +49,8 @@
 
       packages.libvirt = callPackage ./nix/cc/libvirt.nix { pkgs = pkgsUnstable; pkgsLinux = import nixpkgsUnstable { system = "x86_64-linux"; }; };
 
+      packages.libvirtd_base = callPackage ./nix/container/libvirtd_base.nix { pkgs = pkgsUnstable; pkgsLinux = import nixpkgsUnstable { system = "x86_64-linux"; }; };
+
       packages.awscli2 = pkgsUnstable.awscli2;
 
       packages.bazel_6 = pkgsUnstable.bazel_6;
diff --git a/cli/internal/libvirt/README.md b/nix/container/README.md
similarity index 72%
rename from cli/internal/libvirt/README.md
rename to nix/container/README.md
index 8eaf8a541..cbbc61f7d 100644
--- a/cli/internal/libvirt/README.md
+++ b/nix/container/README.md
@@ -11,14 +11,19 @@ Connecting to the libvirt daemon running in the container and manage the deploym
 virsh -c "qemu+tcp://localhost:16599/system"
 ```
 
-## Docker image
+## Container image
 
-Build the image:
+Update the base image (`ghcr.io/edgelesssys/constellation/libvirtd-base`):
+
+```shell
+nix build .#libvirtd_base
+cat result | gunzip > libvirtd_base.tar
+crane push libvirtd_base.tar ghcr.io/edgelesssys/constellation/libvirtd-base
+```
+
+Push the final image to your own registry (`ghcr.io/<USERNAME>/constellation/libvirtd`):
 
 ```shell
-bazel build //cli/internal/libvirt:constellation_libvirt
-bazel build //bazel/release:libvirt_sum
-bazel build //bazel/release:libvirt_tar
 bazel run //bazel/release:libvirt_push
 ```
 
diff --git a/nix/container/libvirtd_base.nix b/nix/container/libvirtd_base.nix
new file mode 100644
index 000000000..5ebaf3e91
--- /dev/null
+++ b/nix/container/libvirtd_base.nix
@@ -0,0 +1,139 @@
+{ pkgs
+, pkgsLinux
+, stdenv
+}:
+let
+  passwd = pkgs.writeTextDir "etc/passwd" ''
+    root:x:0:0:root:/root:/bin/sh
+    bin:x:1:1:bin:/bin:/sbin/nologin
+    daemon:x:2:2:daemon:/sbin:/sbin/nologin
+    adm:x:3:4:adm:/var/adm:/sbin/nologin
+    lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
+    sync:x:5:0:sync:/sbin:/bin/sync
+    shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
+    halt:x:7:0:halt:/sbin:/sbin/halt
+    nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
+    tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin
+    saslauth:x:998:76:Saslauthd user:/run/saslauthd:/sbin/nologin
+    polkitd:x:996:996:User for polkitd:/:/sbin/nologin
+    dnsmasq:x:994:994:Dnsmasq DHCP and DNS server:/var/lib/dnsmasq:/usr/sbin/nologin
+    rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/sbin/nologin
+    rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
+    qemu:x:107:107:qemu user:/:/sbin/nologin
+  '';
+  group = pkgs.writeTextDir "etc/group" ''
+    root:x:0:
+    bin:x:1:
+    daemon:x:2:
+    sys:x:3:
+    adm:x:4:
+    tty:x:5:
+    disk:x:6:
+    lp:x:7:
+    mem:x:8:
+    kmem:x:9:
+    wheel:x:10:
+    lock:x:54:
+    users:x:100:
+    nobody:x:65534:
+    tss:x:59:
+    utmp:x:22:
+    utempter:x:35:
+    saslauth:x:76:saslauth
+    input:x:104:
+    kvm:x:36:qemu
+    sgx:x:106:
+    polkitd:x:996:
+    dnsmasq:x:994:
+    rpc:x:32:
+    rpcuser:x:29:
+    qemu:x:107:
+    libvirt:x:990:
+  '';
+  libvirtdConf = pkgs.writeTextDir "etc/libvirt/libvirtd.conf" ''
+    listen_tls = 0
+    listen_tcp = 1
+    tcp_port = "16599"
+    listen_addr = "localhost"
+    auth_tcp = "none"
+  '';
+  qemuConf = pkgs.writeTextDir "var/lib/libvirt/qemu.conf" ''
+    cgroup_controllers = []
+  '';
+  startScript = pkgsLinux.writeShellApplication {
+    name = "start.sh";
+    runtimeInputs = with pkgsLinux; [
+      shadow
+      coreutils
+      libvirt
+      qemu
+      swtpm
+    ];
+    text = ''
+      set -euo pipefail
+      shopt -s inherit_errexit
+
+      # Assign qemu the GID of the host system's 'kvm' group to avoid permission issues for environments defaulting to 660 for /dev/kvm (e.g. Debian-based distros)
+      KVM_HOST_GID="$(stat -c '%g' /dev/kvm)"
+
+      groupadd -o -g "''${KVM_HOST_GID}" host-kvm || true
+      usermod -a -G host-kvm qemu || true
+
+      # Start libvirt daemon
+      libvirtd -f /etc/libvirt/libvirtd.conf --daemon --listen
+      virtlogd --daemon
+
+      sleep infinity
+    '';
+  };
+  ovmf = stdenv.mkDerivation {
+    name = "OVMF";
+    postInstall = ''
+      mkdir -p $out/usr/share/
+      ln -s ${pkgsLinux.OVMFFull.fd}/FV  $out/usr/share/OVMF
+    '';
+    propagatedBuildInputs = with pkgsLinux; [
+      OVMF
+    ];
+    dontUnpack = true;
+  };
+in
+pkgs.dockerTools.buildImage {
+  name = "ghcr.io/edgelesssys/constellation/libvirtd-base";
+  copyToRoot = with pkgsLinux.dockerTools; [
+    passwd
+    group
+    libvirtdConf
+    qemuConf
+    ovmf
+    startScript
+    usrBinEnv
+    caCertificates
+    pkgsLinux.busybox
+  ];
+  config = {
+    Cmd = [ "/bin/start.sh" ];
+  };
+  runAsRoot = ''
+    #!${pkgs.runtimeShell}
+    mkdir -p /tmp
+    mkdir -p /run
+    mkdir -p /var/lock
+    mkdir -p /var/log/libvirt
+    mkdir -p /var/lib/swtpm-localca
+    mkdir -p /var/lib/libvirt/boot
+    mkdir -p /var/lib/libvirt/dnsmasq
+    mkdir -p /var/lib/libvirt/filesystems
+    mkdir -p /var/lib/libvirt/images
+    mkdir -p /var/lib/libvirt/libxl
+    mkdir -p /var/lib/libvirt/lxc
+    mkdir -p /var/lib/libvirt/network
+    mkdir -p /var/lib/libvirt/qemu
+    mkdir -p /var/lib/libvirt/swtpm
+
+    chmod 1777 /tmp
+    chown -R tss:root /var/lib/swtpm-localca
+    chown -R qemu:qemu /var/lib/libvirt/qemu
+    chown -R root:libvirt /var/log/libvirt/
+  '';
+}
diff --git a/terraform/infrastructure/qemu/variables.tf b/terraform/infrastructure/qemu/variables.tf
index 80b293352..bd5b79afa 100644
--- a/terraform/infrastructure/qemu/variables.tf
+++ b/terraform/infrastructure/qemu/variables.tf
@@ -67,7 +67,7 @@ variable "image_format" {
 }
 variable "firmware" {
   type        = string
-  default     = "/usr/share/OVMF/OVMF_CODE.secboot.fd"
+  default     = "/usr/share/OVMF/OVMF_CODE.fd"
   description = "path to UEFI firmware file. Use \"OVMF_CODE_4M.ms.fd\" on Ubuntu and \"OVMF_CODE.fd\" or \"OVMF_CODE.secboot.fd\" on Fedora."
 }