“nginx is installed” is an incomplete image test. The package can exist while the unit is disabled, the process is stopped, or nothing answers on the promised port. We wanted one example that a Linux user could inspect and rerun, so we kept the input deliberately boring and made the acceptance test strict.
All four targets completed the runtime contract in this capture. Fedora first exposed a real service-enablement defect, then passed after a second failure isolated its first-boot preset policy. openSUSE needed four separate remaster corrections before it passed on two distinct boots. Its final row uses an explicitly labeled lean retained-VM proof because the screenshot layer stalled; the same package, service, port, HTTP, version, and boot-ID checks still ran before and after reboot. None of the earlier failures is rewritten as a pass.
Same intent
headless + nginx + TCP/80
Build
native distro image pipeline
First boot
package, service, port, HTTP
Restart
same retained VM, new boot ID
Second proof
repeat every nginx check
Production proof · August 10, 2026
Watch nginx survive a VM power-cycle
This continuous 23-second segment is trimmed only at the beginning and end; there are no internal cuts. It identifies the exact anonymous build and VM, checks nginx over HTTP, applies a virtual reset, observes downtime, and checks the service again after the VM returns.
The clip covers the runtime power-cycle, not the full image build. The full anonymous-trial report records the fresh guest session, completed build, Boot Now launch, graceful reboot, and HTTP recovery. The shorter report records the stricter fail-closed power-cycle check shown above.
Captured results
Four runtime passes, one publication caveat
| Target | Observed version | Initial test | Restart result | Release state |
|---|---|---|---|---|
Ubuntu 24.04 Qualified pass | nginx 1.24.0 | 9 / 9 passed | Passed with live-media reset assist | Runtime pass; scanner finding unresolved |
Debian 13 (Trixie) Pass | nginx 1.26.3 | 23 / 23 passed | Passed | Artifact and runtime evidence retained |
Fedora 43 Pass | nginx 1.30.4 | 16 / 16 passed on r4 | Passed | Passed after preset correction |
openSUSE Leap 15.6 Pass | nginx 1.21.5 | Retained VM + deterministic proof passed | Passed | Passed after remaster corrections |
The useful failure
Fedora had the package, but not the service
Fedora r2 installed the signed nginx 1.30.4 RPM. Twelve of sixteen assertions passed. The four that mattered together failed: the unit was disabled, the service was inactive, port 80 was absent, and the local HTTP probe returned no status.
The cause was not Fedora. Our nginx hook first swallowed a failed systemctl enable call and let image construction continue. A stricter r3 hook produced the right wants symlink, but Fedora live media then applied its terminal disable * systemd preset on first boot and removed it. The r4 hook added a service-specific preset ahead of that distro default. All 16 initial assertions then passed, followed by nginx 1.30.4 and HTTP 200 on two distinct boot IDs. That is the kind of defect a package-only assertion misses.
openSUSE needed four different fixes
The first Tumbleweed attempt stopped on expired upstream signing-key metadata; we did not bypass signature verification. Leap then made the failure sequence concrete. Installing qemu-guest-agent did not enable it. Changing the remastered ISO volume label broke the embedded CDLABEL= boot argument. Copying host DNS into the chroot left a resolver address that did not exist in the VM. Finally, an enabled and active nginx returned HTTP 403 because openSUSE’s selected document root was empty.
Leap r8 preserved the source volume label, protected both service enablements with explicit systemd presets, restored the source resolver shape (including the case where no resolver file existed), and wrote a neutral index only when the selected document root had none. The final retained VM reported the nginx 1.21.5 RPM, enabled and active service state, TCP/80, and HTTP 200. After reboot, the kernel boot ID changed and every nginx check passed again.
The openSUSE evidence is deliberately labeled provision-only retained VM. A screenshot-heavy plan stalled in its GUI layer, so we did not claim its assertion count. We kept only the boot-ready deployment record and the deterministic command output from both boots.
Ubuntu needed an honest footnote
Ubuntu passed all nine initial assertions and reported nginx 1.24.0, HTTP 200, and enabled/active state on two different kernel boot IDs. Its live-media shutdown path pauses to request physical media removal. Because the test must keep the same immutable ISO attached, the runner lets shutdown begin and then performs a virtual reset. The evidence calls this a reset assist rather than an ordinary disk-installed reboot.
Reproduce and inspect
The inputs and raw outputs are downloadable
Ubuntu 24.04 recipe
Download JSONDebian Trixie recipe
Download JSONFedora 43 recipe
Download JSONopenSUSE Leap 15.6 recipe
Download JSONDownload any recipe and run openfactory build --recipe <file> --wait, or import it through the browser console. The result files preserve both proof outputs and SHA-256 values without including authentication data.
Run the representative build without signing up
The direct trial creates a temporary guest build from an allowlisted Debian 13 prompt. It covers one target, so the downloadable records above remain the source for the full four-distribution result and retained-VM reboot proof.
What this study does not prove
- It is not an nginx throughput, latency, or resource benchmark.
- It does not rank the distributions or compare their security maintenance.
- It proves behavior for these recipe and repository snapshots on August 9, 2026, not every future package version.
- A live-ISO cold restart is not evidence that arbitrary mutable user data persists.
- A runtime pass does not erase a scanner, signature, or publication-gate failure.
Start with the tested nginx pattern
Run the anonymous Debian build first, then change the service or target in the browser builder. Keep the failed assertions; they are often the most useful part of the result.