Skip to content

image-deploy/cleanup-curtin

Should the deployed system remove its /curtin directory once the agent is running

Set to true (the default) to have the image-deploy-cleanup task delete the /curtin (C:\curtin on Windows) directory from the deployed system after the DRP agent has joined and started.

The directory only exists to carry the curtin hooks, the join-up bootstrap scripts, and the optional local cloud-init meta-data/user-data pair into first boot. None of it is needed once the agent is running, and on Windows the directory is written from the deployment OS over NTFS, so it cannot be locked down from Linux - its ACL has to come from the image itself.

Set this to false if you have custom cloud-init/user-data or unattend content that reads from /curtin on later boots. If you do, you are keeping the directory on the deployed system, and on Windows you must set its ACL when you build the image and re-apply it on first boot from inside Windows. See /curtin Permissions.

Regardless of this setting, the same task always removes the leftovers that carry credentials:

  • the join-up bootstrap and control.* scripts in the temporary directories, which hold machine tokens
  • on Windows only, C:\root and C:\usr. Curtin copies its install log and rendered config into the target's /root, and that config contains image-deploy/windows-license-key when it is set. On Linux and ESXi those are real system directories and are left alone.

Objects that Reference image-deploy/cleanup-curtin

Objects used by image-deploy/cleanup-curtin

Not used in current content packs