登入帳號命名政策
SkyLab 寫進新 Linux 機器的登入帳號（cloud-init 的 ciuser）只依一份政策檔驗證：backend/config/username_policy.yaml。後端啟動時載入；申請表單經 GET /api/v1/policies/username 取得同一套規則，並用 POST /api/v1/policies/username/check 即時檢查，所以表單和伺服器不會不一致。檔案無效時後端直接拒絕啟動，而不是放寬規則。
Windows 範本不在範圍內：Proxmox 對 Windows 機器忽略 ciuser，帳號由範本內的 cloudbase-init.conf 固定。
規則
- 名稱必須符合樣式：小寫字母、數字、
_與-，以字母開頭，1 到 32 個字元。 - 平台保留的名稱（
skylab、ansible、provision）不可使用。 - 常見發行版系統帳號的名稱與前綴（
root、daemon、www-data、systemd-…等）不可使用，完整清單見下方。 - 雲端映像的預設帳號（
default_user_warn裡的ubuntu、debian、ec2-user等）可以使用，但會顯示警告。 - 清單載入時會去除重複。
違反規則的名稱在送出申請前就會被表單擋下，建機前後端會再驗一次；警告一律不擋。
政策檔
yaml
# Linux VM login username policy (cloud-init `ciuser`).
#
# Single source of truth: the backend loads this file at import time
# (app/domain/username_policy.py) and the frontend fetches the rules through
# GET /api/v1/policies/username. Do not hard-code a second copy anywhere.
#
# Windows templates are not covered: PVE ignores `ciuser` for Windows guests and
# the account is fixed by cloudbase-init.conf inside the template.
#
# Lists are de-duplicated on load. An invalid file fails startup instead of
# silently loosening rules.
platform_reserved:
- skylab
- ansible
- provision
linux:
pattern: "^[a-z][a-z0-9_-]{0,31}$"
min_length: 1
max_length: 32
reserved_prefixes:
- systemd-
- libvirt
- polkit
- cloud-init
# user ∪ group names found on common distributions
reserved:
# core system accounts
- root
- daemon
- bin
- sys
- sync
- games
- man
- lp
- mail
- news
- uucp
- proxy
- www-data
- backup
- list
- irc
- gnats
- nobody
- nogroup
- nfsnobody
- operator
- halt
- shutdown
- ftp
- adm
# privilege groups
- admin
- sudo
- wheel
- shadow
- staff
- kmem
- mem
- lock
# device groups
- tty
- disk
- dialout
- fax
- voice
- cdrom
- floppy
- tape
- audio
- video
- render
- input
- kvm
- sgx
- plugdev
- netdev
- dip
- lpadmin
- scanner
- sambashare
- utmp
- utempter
- src
- crontab
- users
# common service accounts
- sshd
- _ssh
- ssh_keys
- messagebus
- dbus
- syslog
- ntp
- chrony
- _chrony
- polkitd
- tss
- uuidd
- tcpdump
- avahi
- dnsmasq
- landscape
- pollinate
- fwupd-refresh
- usbmux
- rpc
- rpcuser
- postfix
- apache
- nginx
- mysql
- postgres
- redis
- docker
- lxd
- incus
- libvirt
- libvirt-qemu
- qemu
- systemd-journal
- systemd-network
- systemd-resolve
- systemd-timesync
# Default accounts of distribution cloud images: allowed, but warned about.
default_user_warn:
- ubuntu
- debian
- centos
- cloud-user
- ec2-user
- fedora
- rocky
- almalinux
- arch
- alpine