Enhance UVM installation and configuration for Ubuntu 22.04 root filesystem

- Update README and USAGE documentation to reflect changes in rootfs handling, including the default local build from Ubuntu 22.04 packages.
- Modify the installer to support building the rootfs locally with authenticated packages and to require SHA-256 checksums for prebuilt images.
- Implement checks for setuid permissions on sudo and update the provisioning logic for guest users to ensure proper sudo access.
- Adjust tests to validate the new rootfs building process and ensure that existing functionality is preserved.
- Refactor code to improve clarity and maintainability, including the introduction of constants for Ubuntu release and guest packages.

README.md

@@ -48,8 +48,10 @@ before downloading VM artifacts. Boot operations additionally check that the
 native nftables bridge policy is supported; installing packages alone is not
 a connectivity or isolation test.
 
-Firecracker, the guest kernel, and the Ubuntu rootfs are selected automatically
-for the host architecture. On NVIDIA DGX Spark, UVM uses the ARM64 assets.
+Firecracker and the guest kernel are selected automatically for the host
+architecture. The default rootfs is built locally from Ubuntu 22.04 (Jammy)
+packages with OpenSSH, sudo, and a complete apt/dpkg database. On NVIDIA DGX
+Spark, UVM uses ARM64 assets and packages.
 `arm64` and `amd64` architecture names are normalized to `aarch64` and
 `x86_64`, respectively. Custom `UVM_KERNEL_URL` and `UVM_ROOTFS_URL` overrides
 must point to assets compatible with the host architecture.
@@ -64,21 +66,35 @@ the privileged installer:
 sudo env \
   UVM_FIRECRACKER_SHA256='<sha256-of-firecracker-archive>' \
   UVM_KERNEL_SHA256='<sha256-of-vmlinux>' \
-  UVM_ROOTFS_SHA256='<sha256-of-rootfs>' \
   ./uvm.py install
 ```
 
-Use `--force` to redownload Firecracker and guest assets when replacing an
-image or refreshing artifacts:
+The Ubuntu build uses `debootstrap`, authenticated Ubuntu archive signatures,
+and native packages. UVM installs the builder prerequisites and records the
+built ext4 image's SHA-256 in the integrity manifest. Building requires root
+with mount/PID namespace support and internet access to Ubuntu mirrors.
+
+Use `--force` to refresh downloads and rebuild the Ubuntu template:
 
 ```sh
 sudo env \
   UVM_FIRECRACKER_SHA256='<sha256-of-firecracker-archive>' \
   UVM_KERNEL_SHA256='<sha256-of-vmlinux>' \
-  UVM_ROOTFS_SHA256='<sha256-of-rootfs>' \
   ./uvm.py install --force
 ```
 
+To use a prebuilt ext4 image instead, set both `UVM_ROOTFS_URL` and its trusted
+`UVM_ROOTFS_SHA256`. Leave both unset for the default Ubuntu build.
+
+### Upgrade from the Stripped Bionic Demo Image
+
+Run `install --force` with the updated code and with `UVM_ROOTFS_URL` and
+`UVM_ROOTFS_SHA256` unset, then create a new VM. The replacement template
+includes sudo and the package database that the old demo image lacked.
+Existing VM disks retain their original OS and credentials; installation
+updates the template used for future VMs. Restart a running API server to load
+the updated provisioner before creating VMs through the dashboard.
+
 For local experimentation only, the old unverified quick-start behavior is
 available through an explicit opt-out:
 
@@ -360,13 +376,28 @@ defaults are username `root` and password `root`. A custom image must provide:
 - `sshd`
 - `/etc/passwd`, `/etc/shadow`, and `/etc/ssh/sshd_config`
 - `/etc/group` and `/bin/sh` when creating a new user
+- A root-owned, setuid `/usr/bin/sudo` and `/etc/sudoers` for custom login users
+
+Custom login users receive password-authenticated sudo access. Inside a new VM:
+
+```sh
+sudo -i                 # Enter the same password used for this user's SSH login.
+sudo apt update
+sudo apt install htop
+```
+
+`su -` asks for root's separate password; creating a custom login does not set
+root's password. Use `sudo -i` for an administrative shell. The default Ubuntu
+template retains apt's package metadata and enables `main` and `universe`,
+including updates/security repositories. Guest DNS defaults to `1.1.1.1` and
+`8.8.8.8` in `/etc/resolv.conf`.
 
 Existing accounts retain their UID, groups, home directory, and shell. A new
 user reuses a same-named group if present; otherwise UVM creates one with an
 unused GID. `/etc/gshadow` is updated when present. The default `root` account
 must already exist in the image.
 
-The known public demo key bundled in Firecracker's default bionic image is
+The known public demo key bundled in Firecracker's older Bionic image is
 removed from each private disk. UVM also replaces the conventional RSA, ECDSA,
 and Ed25519 SSH host keys in every private disk so cloned VMs have distinct
 host identities. Never rely on SSH private keys baked into a shared template.
@@ -466,10 +497,10 @@ Host and API settings can be overridden through environment variables:
 | `UVM_BRIDGE` | Linux bridge name; defaults to `uvm0` |
 | `UVM_KNOWN_HOSTS_FILES` | Override local SSH cache files cleaned on deletion; colon-separated absolute paths |
 | `UVM_KERNEL_URL` | Override the host-architecture default guest kernel URL |
-| `UVM_ROOTFS_URL` | Override the host-architecture default guest rootfs URL |
+| `UVM_ROOTFS_URL` | Optional prebuilt ext4 image URL; unset to build Ubuntu 22.04 locally |
 | `UVM_FIRECRACKER_SHA256` | Trusted Firecracker release archive SHA-256 |
 | `UVM_KERNEL_SHA256` | Trusted guest kernel SHA-256 |
-| `UVM_ROOTFS_SHA256` | Trusted guest rootfs SHA-256 |
+| `UVM_ROOTFS_SHA256` | Trusted prebuilt rootfs SHA-256; use with `UVM_ROOTFS_URL` |
 | `UVM_FIRECRACKER_BINARY_SHA256` | Optional trusted local Firecracker binary SHA-256 |
 | `UVM_ALLOW_UNVERIFIED_DOWNLOADS` | Set to `1` only for unverified local development |
 | `UVM_API_TOKEN` | Required for every API server; sent as `X-UVM-Token` |