From 22fe474f3cf220a5d1accb640dabe7840bd3cbbd Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Wed, 1 Apr 2026 13:13:40 +0200
Subject: [PATCH 1/6] New stage (warden-specific) to clean up all
 custom/optional systemd services

---
 .../lib/bosh/stemcell/stage_collection.rb     |  1 +
 .../bosh/stemcell/stage_collection_spec.rb    |  1 +
 .../stages/base_systemd_clean/apply.sh        | 25 +++++++++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100755 stemcell_builder/stages/base_systemd_clean/apply.sh

diff --git a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
index ef3076d3d4..1c50b7373a 100644
--- a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
+++ b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
@@ -202,6 +202,7 @@ def warden_stages
       [
         :system_parameters,
         :base_warden,
+        :base_systemd_clean,
         :bosh_clean,
         :bosh_harden,
         :bosh_clean_ssh,
diff --git a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
index 048d0451ca..7d96369060 100644
--- a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
+++ b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
@@ -309,6 +309,7 @@ module Bosh::Stemcell
           [
             :system_parameters,
             :base_warden,
+            :base_systemd_clean,
             :bosh_clean,
             :bosh_harden,
             :bosh_clean_ssh,
diff --git a/stemcell_builder/stages/base_systemd_clean/apply.sh b/stemcell_builder/stages/base_systemd_clean/apply.sh
new file mode 100755
index 0000000000..be1e293d9f
--- /dev/null
+++ b/stemcell_builder/stages/base_systemd_clean/apply.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -e
+
+base_dir=$(readlink -nf $(dirname $0)/../..)
+source $base_dir/lib/prelude_apply.bash
+
+# only load minimal set of systemd units / services
+# https://github.com/asg1612/docker-systemd/blob/master/Dockerfile
+run_in_chroot "${chroot}" "
+find /etc/systemd/system /lib/systemd/system \
+  -path '*.wants/*' \
+  -not -name '*firstboot*' \
+  -not -name '*bosh-agent*' \
+  -not -name 'cron*' \
+  -not -name '*dbus*' \
+  -not -name '*journald*' \
+  -not -name '*logrotate*' \
+  -not -name '*runit*' \
+  -not -name '*ssh*' \
+  -not -name '*systemd-user-sessions*' \
+  -not -name '*systemd-tmpfiles*' \
+  -print \
+  -exec rm -f {} \\;
+"

From 0319bcce8e7185bda23a994a9c0b9fdecc390a40 Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Wed, 1 Apr 2026 22:05:22 +0200
Subject: [PATCH 2/6] Fixes

---
 stemcell_builder/stages/base_systemd_clean/apply.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/stemcell_builder/stages/base_systemd_clean/apply.sh b/stemcell_builder/stages/base_systemd_clean/apply.sh
index be1e293d9f..7ff15c0aad 100755
--- a/stemcell_builder/stages/base_systemd_clean/apply.sh
+++ b/stemcell_builder/stages/base_systemd_clean/apply.sh
@@ -13,6 +13,7 @@ find /etc/systemd/system /lib/systemd/system \
   -not -name '*firstboot*' \
   -not -name '*bosh-agent*' \
   -not -name 'cron*' \
+  -not -name 'monit*' \
   -not -name '*dbus*' \
   -not -name '*journald*' \
   -not -name '*logrotate*' \

From 216b4a65f7f7c17b674bb145d427ced13d26a2d5 Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Thu, 2 Apr 2026 11:12:35 +0200
Subject: [PATCH 3/6] Move from allowlist to masklist of services

---
 .../lib/bosh/stemcell/stage_collection.rb     |  1 -
 .../bosh/stemcell/stage_collection_spec.rb    |  1 -
 .../stages/base_systemd_clean/apply.sh        | 26 -------------------
 stemcell_builder/stages/base_warden/apply.sh  |  9 +++++--
 4 files changed, 7 insertions(+), 30 deletions(-)
 delete mode 100755 stemcell_builder/stages/base_systemd_clean/apply.sh

diff --git a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
index 1c50b7373a..40ce0abdde 100644
--- a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
+++ b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
@@ -249,7 +249,6 @@ def ubuntu_os_stages
         :base_apt,
         :base_ubuntu_build_essential,
         :base_ubuntu_packages,
-        :bosh_systemd_resolved,
         :base_file_permission,
         :base_ssh,
         :bosh_sysstat,
diff --git a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
index 7d96369060..ed5db2a4bf 100644
--- a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
+++ b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
@@ -27,7 +27,6 @@ module Bosh::Stemcell
             :base_apt,
             :base_ubuntu_build_essential,
             :base_ubuntu_packages,
-            :bosh_systemd_resolved,
             :base_file_permission,
             :base_ssh,
             :bosh_sysstat,
diff --git a/stemcell_builder/stages/base_systemd_clean/apply.sh b/stemcell_builder/stages/base_systemd_clean/apply.sh
deleted file mode 100755
index 7ff15c0aad..0000000000
--- a/stemcell_builder/stages/base_systemd_clean/apply.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-base_dir=$(readlink -nf $(dirname $0)/../..)
-source $base_dir/lib/prelude_apply.bash
-
-# only load minimal set of systemd units / services
-# https://github.com/asg1612/docker-systemd/blob/master/Dockerfile
-run_in_chroot "${chroot}" "
-find /etc/systemd/system /lib/systemd/system \
-  -path '*.wants/*' \
-  -not -name '*firstboot*' \
-  -not -name '*bosh-agent*' \
-  -not -name 'cron*' \
-  -not -name 'monit*' \
-  -not -name '*dbus*' \
-  -not -name '*journald*' \
-  -not -name '*logrotate*' \
-  -not -name '*runit*' \
-  -not -name '*ssh*' \
-  -not -name '*systemd-user-sessions*' \
-  -not -name '*systemd-tmpfiles*' \
-  -print \
-  -exec rm -f {} \\;
-"
diff --git a/stemcell_builder/stages/base_warden/apply.sh b/stemcell_builder/stages/base_warden/apply.sh
index a576d0b22f..889e61ea54 100755
--- a/stemcell_builder/stages/base_warden/apply.sh
+++ b/stemcell_builder/stages/base_warden/apply.sh
@@ -73,5 +73,10 @@ for service in "${rosetta_services[@]}"; do
   cp "$assets_dir/rosetta-compat.conf" "$chroot/etc/systemd/system/${service}.service.d/rosetta-compat.conf"
 done
 
-# Mask systemd-binfmt.service which fails under Rosetta emulation
-run_in_chroot "$chroot" "systemctl mask systemd-binfmt.service"
+# Some services are not compatible with running in a container,
+# so we mask them to prevent systemd from trying to start them and fail.
+services_to_mask=(
+  systemd-binfmt
+)
+services_to_mask_units=("${services_to_mask[@]%.service}")
+run_in_chroot "$chroot" "systemctl mask ${services_to_mask_units[*]/%/.service}"

From 5b043ec6d20497ae430637dd70202d47e9aabc5e Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Thu, 2 Apr 2026 11:20:53 +0200
Subject: [PATCH 4/6] Move from allowlist to masklist of services; output

---
 stemcell_builder/stages/base_warden/apply.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/stemcell_builder/stages/base_warden/apply.sh b/stemcell_builder/stages/base_warden/apply.sh
index 889e61ea54..c298a24d2c 100755
--- a/stemcell_builder/stages/base_warden/apply.sh
+++ b/stemcell_builder/stages/base_warden/apply.sh
@@ -75,8 +75,13 @@ done
 
 # Some services are not compatible with running in a container,
 # so we mask them to prevent systemd from trying to start them and fail.
-services_to_mask=(
+masked_services=(
   systemd-binfmt
 )
-services_to_mask_units=("${services_to_mask[@]%.service}")
-run_in_chroot "$chroot" "systemctl mask ${services_to_mask_units[*]/%/.service}"
+masked_service_units="${masked_services[*]/%/.service}"
+
+echo "base_warden: masking service units: ${masked_service_units}"
+run_in_chroot "$chroot" "systemctl mask ${masked_service_units}"
+
+echo "base_warden: service units kept (not masked):"
+run_in_chroot "$chroot" "systemctl list-unit-files --state=enabled,static --type=service --no-legend | awk '{print \$1}'"

From d3f1cd9c1389c6de50f20ca574486d53f27c4f35 Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Thu, 2 Apr 2026 11:33:38 +0200
Subject: [PATCH 5/6] Fix

---
 bosh-stemcell/lib/bosh/stemcell/stage_collection.rb       | 1 +
 bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb | 1 +
 2 files changed, 2 insertions(+)

diff --git a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
index 40ce0abdde..1c50b7373a 100644
--- a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
+++ b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
@@ -249,6 +249,7 @@ def ubuntu_os_stages
         :base_apt,
         :base_ubuntu_build_essential,
         :base_ubuntu_packages,
+        :bosh_systemd_resolved,
         :base_file_permission,
         :base_ssh,
         :bosh_sysstat,
diff --git a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
index ed5db2a4bf..7d96369060 100644
--- a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
+++ b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
@@ -27,6 +27,7 @@ module Bosh::Stemcell
             :base_apt,
             :base_ubuntu_build_essential,
             :base_ubuntu_packages,
+            :bosh_systemd_resolved,
             :base_file_permission,
             :base_ssh,
             :bosh_sysstat,

From f5d310b41888521382202fc198d4a77f066eb97a Mon Sep 17 00:00:00 2001
From: Mike Yeromko <mykhailo.yeromko@sap.com>
Date: Thu, 2 Apr 2026 11:34:19 +0200
Subject: [PATCH 6/6] Fix

---
 bosh-stemcell/lib/bosh/stemcell/stage_collection.rb       | 1 -
 bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb | 1 -
 2 files changed, 2 deletions(-)

diff --git a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
index 1c50b7373a..ef3076d3d4 100644
--- a/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
+++ b/bosh-stemcell/lib/bosh/stemcell/stage_collection.rb
@@ -202,7 +202,6 @@ def warden_stages
       [
         :system_parameters,
         :base_warden,
-        :base_systemd_clean,
         :bosh_clean,
         :bosh_harden,
         :bosh_clean_ssh,
diff --git a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
index 7d96369060..048d0451ca 100644
--- a/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
+++ b/bosh-stemcell/spec/bosh/stemcell/stage_collection_spec.rb
@@ -309,7 +309,6 @@ module Bosh::Stemcell
           [
             :system_parameters,
             :base_warden,
-            :base_systemd_clean,
             :bosh_clean,
             :bosh_harden,
             :bosh_clean_ssh,