Embedded and edge image evaluation

An x86_64 KVM build can validate a small Linux userspace, but it cannot qualify an embedded board’s boot firmware, kernel, storage, power, radio, or peripheral behavior. Treat the first artifact as a virtual reference unless the selected builder explicitly supports the target device.

Prompt

Create a minimal Debian Trixie headless image for an x86_64 edge gateway.
Include SSH, NetworkManager, Avahi, watchdog, curl, and CA certificates.
Create a locked-password service account named app with a no-login shell and
no supplementary groups. Do not remove documentation or locales unless the
generated plan shows the exact package and filesystem effects. Add boot,
service, account, repeated-boot, and interrupted-first-boot tests.

Recipe shape

{
  "name": "edge-gateway-evaluation",
  "base_image": "debian-trixie",
  "hardware": {
    "platform": "pc",
    "architecture": "x86_64",
    "min_cpu_cores": 2,
    "min_memory_gb": 2,
    "min_storage_gb": 16,
    "nic_count": 1
  },
  "os": {
    "features": ["headless", "ssh"],
    "packages": [
      "network-manager",
      "avahi-daemon",
      "watchdog",
      "curl",
      "ca-certificates"
    ],
    "users": [
      {
        "username": "app",
        "groups": [],
        "shell": "/usr/sbin/nologin"
      }
    ]
  }
}

The hardware block declares requirements; it does not change a PC image into a board-specific image. Use platform: raspberry_pi or the phone/device fields only when the current builder accepts the exact target and documents its limitations.

Verification

In the virtual guest, verify:

• required packages and enabled services;
• the service account’s shell, lock state, groups, and file ownership;
• networking after first and second boot;
• watchdog configuration without deliberately resetting shared infrastructure;
• read/write behavior for any tmpfs or volatile journal request; and
• clean failure when an enrollment dependency is unavailable.

Boot-time and idle-memory measurements from KVM are useful regression baselines, not target-hardware promises.

Device qualification

Before writing an image to physical media, test on the exact board revision:

• bootloader and firmware compatibility;
• kernel, device tree, drivers, and proprietary firmware;
• storage wear, power loss, and filesystem recovery;
• Ethernet, Wi-Fi, Bluetooth, modem, GNSS, and radios as applicable;
• serial, I2C, SPI, GPIO, camera, and accelerator I/O;
• thermal limits, suspend/resume, watchdog reset, and power budget; and
• secure enrollment, key custody, updates, rollback, and decommissioning.

Do not tell an operator to “flash the ISO” unless the artifact format and write procedure are specifically supported for that device.