friendmeat

Using live-build and GitHub Actions to build customized Debian live install ISOs

2026-09-12T00:00:00Z

tl;dr: skip to section 5 for instructions

0. Prologue: Why?

At work I've started installing Debian on a bunch of critical shit. My boss doesn't know how any of it works so I need standardized, reproducible, documented builds. My solution up until now was to have a preseed.cfg file that calls a script that configures the system the way I want it. My only instructions were, "copy this to a USB with Debian on it and plug it in." That's stupid.

1. `live-build`

live-build is a bunch of scripts you can install with apt install live-build and interface with via the lb command.

live-build is very much geared toward creating "live" Debian images, i.e. that can be booted straight from RAM instead of installed. For my purposes I don't need that. It's very likely that the large bulk of the build step is a waste of time, in particular the creation of the squashfs file system.

2. "But It Works On My Machine!!!"

I was running live-build on WSL2 running Ubuntu. I figured "It's a Debian-based distro-- it's gotta Just Work, right??"

I think a lot of my issues stemmed from this.

2.1 The Hall of (Debian) Mirrors

The default mirrors for building debian Trixie images with live-build seems to be wrong. I don't know if they decided to just change the apt repository URL structure for the Trixie release but whatever. I don't remember exactly but the mirror for security updates but I think it was using the wrong subdomain. Adding this option fixed it for me:

--parent-mirror-security https://security.debian.org/debian-security/

2.2 Containers to the rescue

live-build was not working on my Ubuntu WSL distro. So I tried instead building a Debian 13 container to run lb config and lb build with my existing configuration. This was my Dockerfile:

FROM debian:trixie
RUN |
	apt update
	apt install live-build
	mkdir /entrypoint.d

COPY <<EOF "/entrypoint.d/entrypoint.sh"
#!/bin/sh
lb clean
lb config
lb build
EOF

WORKDIR /live-build

ENTRYPOINT ["/bin/sh", "-c", "/entrypoint.d/entrypoint.sh"]

And I tested the build like this:

# 1. Build the image
docker build --tag live-build:latest .

# 2. Run the container
# My live-build config files are in the PWD
docker run --rm --cap-add=SYS_ADMIN -v "${PWD}:/live-build" live-build:latest

The --cap-add=SYS_ADMIN flag is necessary to give live-build sufficient permissions to mount volumes within the

2.3 Dev loop hell

My process was:

Tweak a setting in my auto/config script
Start up the build in Docker
Wait for build to succeed or fail
On failure, go back to step 1
On success, test with a VM
Manually shutdown WSL when Hyper-V complains about low memory, then launch the VM in the second before WSL starts itself back up:

wsl.exe --shutdown && Start-VM -VMName Debian13

Install the OS and see if it works.

By the time I was troubleshooting the preseed stage, this whole cycle took like 15-20 minutes. It was a pain in the fucking ass.

5. tl;dr How To Do It

Install live-build

sudo apt update
sudo apt install live-build

Make your config directory

mkdir auto

# Copy example files from live-build
cp /usr/share/doc/live-build/examples/auto/* auto/

Create a GitHub repository and push your config.
Create an access token for your runner so it can update the release with the built ISO
1. GitHub -> Settings -> Developer Settings -> Personal Access Tokens
2. I made a new granular token with read/write permissions to the repository I'm keeping my configuration in.
My GitHub action looks like this:

on:
  push:
    tags: ["*"] # Run for any tag

jobs:
  build:
    runs-on: ubuntu-latest
    container:
      image: debian:trixie
      options: "--privileged"
  
    steps:
    - name: Cache packages
      uses: actions/cache@v6
      with:
        path: cache
        key: "$-build"
        
    - name: Install Dependencies
      run: |
        apt update
        apt install -y \ 
          debian-archive-keyring \
          live-build
          
    - name: Checkout
      uses: actions/checkout@v7
      
    - name: Build
      run: |
        set -eux
        lb config
        lb build
        ls -alh
        
    - name: Update Release
      uses: softprops/action-gh-releases@v3
      token: $ # Fine-grained Access Token
      files: live-image-amd64.iso

6. Conclusion

I think the Debian documentation and bug tracking is stuck in the 90s. You have to search through public email threads for issues similar to yours. The only reason you'd read any Debian docs is if your livelihood depended on it. And I wouldn't trade it for anything, though. Some call it masochism-- I call it job security.

In the process of trying to figure this shit out I encountered an error that apparently no one else but a neuroscientist from Germany encountered. He emailed the live-build devs in 2019 and they apparently never publicly responded. R.I.P that guy.

7. Acknowledgements

The GitHub action workflow is stolen almost entirely from the Forgejo config here: lgrn/live-build
Header image uses a photo by Ruben de Rijcke released under the CC BY-SA 3.0 License.
Debian Logo Copyright (c) 1999 Software in the Public Interest, Inc

i hinking conversation

2026-09-10T00:00:00Z

i hinking conversation
care family-founded communication,
daughter, the screaming Movement
the Massachusetts silence,
"Seriously?
pocket. you've said

weeklies #54 - a screensaver for plato's cave

2026-08-29T00:00:00Z

what i'm reading

velcro city tourist board

Our attention, our very sanity, is the last fungible resource remaining to us, and we’re burning through it in a way that makes our dalliance with hydrocarbons look like a practice run. You can slow down, perhaps, but you can never stop running—because even if you’re not trampled, you’ll be left in the dust which is the true final product of economic efficiency.

-- "Ours it the tragedy of the silent stars"

Paul Raven has been on a tear lately, posting essays and prose-poems every day for a week. I'm eating well.

Have you ever read a critical theory essay about packaging? You should read a critical theory essay about packaging. (Ch. 5, pp. 91-107)

what i'm listening to

Burn - YS

Finally digging in to the Bandcamp Daily blog post from a while back about contemporary trip hop. I like the way they used the Janet Jackson sample here. I keep wanting to sing That's the way love goes!!! but they don't use that part. Infuriating? Machiavellian? Yes.

what i'm watching

Teenage Sex and Death At Camp Miasma (2026), dir. Jane Schoenbrun

I liked that Gillian Anderson fingerbanged a girl and Louise Weard was there. We don't have to talk about the rest.

what i'm playing

the mormon furry VN

ELDER HARTLEY: Adam fell -- specifically -- that men might be.

ELDER SUAREZ: Men are that they might have joy.

Organized religion an impediment to intellectual development, a thin justification for abuse, and a cudgel the elite wield power over the masses minds and bodies. The entire planet suffers because of the cultural and structural influence deployed by religious institutions.

Happy? Ok, now:

I think the 240-character-limit set on people's thought processes has led them to believe that everyone that likes something you like (i.e. Furry) must also mean they think and feel all the things you do and therefore must be the Good Kind of person. The phantasy of a contiguous communal whole (mediated through social media) can withstand a lot of cognitive dissonance-- racism, pedophilia, bestiality-- but it apparently can't withstand the concept of Mormonism. A Furry can be a Mormon. A Furry can be all sorts of things you don't like. People are inconvenient.

The prose is competent enough to make the incredibly mundane slice-of-life compelling, even if you go into it just wanting to hate-read it for a blog post.

Campo Largo has a brilliant moment where its realization as interactive multimedia shines: the lead starts ruminating on free will while failing to proselytize to a bunch of Roman Catholic Latinos. As the protagonist builds his exegesis, cuts in the text and backdrop representing their course through the eponymous town, layers are added to the soundtrack until it sounds like a Philip Glass joint. It was a deftly executed synthesis of text and sound.

I also learned some stuff about Mormons I guess.

Campo Largo on itch.io

what i'm working on

a screensaver in plato's cave

Instead of dealing with the xScreenSaver developer's obsession with corny 3d ants and greybeard hang-ups vis-a-vis version control systems and documentation, I started looking into simpler ways to display text as a screensaver on certain end-user-facing kiosk machines for work.

I've settled on abusing ffmpeg. I've set up a systemd service running xidlehook to start piping dynamically-generated footage from ffmpeg's drawtext filter into a full-screen ffplay instance after 60 seconds without user input. It's maniacal, hacky, and inefficient-- but ffplay even has flags called -exitonkeydown and -exitonmousedown, so it's like they were asking for me to use it this way.

It's a simulacrum of a screensaver. Very allegory of the cave-coded.

And it's easier than hacking the Xorg display server. I'm not scared of C you're scared of C.

something i liked

ohh fuck

i don't have anything for this. uhh. fuck.

take this quiz I took during work hours the other day. I got a 96% or something.

something i hated

fake local news

I got a 'local interest' newsletter from some random media conglomerate trying to edge in on the local news industry. Not that local news is a particularly laudable institution. But I don't need two reptilian-looking motherfuckers both named Ryan

I swear I read somewhere about this exact playbook being used by AI companies to make generated newsletters. I even read through their privacy/content policy to find where they outed themselves as AI slop, but the only mention of AI was the claim that they'd use it 'to give their human editors more time to engage with the local community' 🤢.

a picture:

the humiliating ordeal of editing yourself

Yeah I might as well print and hand-edit my own creative writing with a red pen i bought expressly for that purpose. Why not. Nothing matters.

weeklies #53 - boku no pi pico

2026-08-22T00:00:00Z

what i'm reading

1,800+ pages of self-assigned reading

I received a little over 1,800 pages worth of books for my birthday:

Is Math Real?, Eugenia Chen (336 pages)
The Road, Cormac McCarthy (287 pages)
Tom's Crossing, Mark Z. Danielweski (1200+ pages)

Someone who's good at economics please help. My family is starving. "Spend less on Tom's Crossing." No.

hetero stardew valley fanfic

I'm a sucker for Shane stardewvalley. But no one likes him the way I like him. Case in point: Axis on a Tilt by PickleSoupSlut. I'm reading it at a friend's recommendation, but I don't know how much more I can take it. I do not recognize this man. That's not my Shane. My Shane doesn't have "broad shoulders" and an allure implying hidden depths. He's got a double chin and and an unfilled SSRI prescription. "I could fix him" okay I could negg him into a suicide pact. Do better.

"Meme Images", Adam Denzler

I wrote more about this but it was overly confrontational and basically just personal grievances.

What it boils down to: the piece is advocating for a Retvrn to True Furry Freakdom (cub, diaperfur, feral) and an end to social lolcowification. You can't have both. You can get either get recouped by hacks like Jon Rafman for shock value or you can get the Mastercard at Pride treatment.

The conflict between Normie WASP and Autistic Fetishist is a fundamental cosmic force.

"Meme Images"

what i'm listening to

"No Se Va" - Grupo Frontera

I guess this was a TikTok meme a while ago but this Norteño cover of a 2019 pop song is just fucking transcendental.

what i'm watching

devonwho - hibeams

I guess I'm cheating by putting a music video here.

Not even the Jon Rafman video-collages I watched for context on "Meme Images" could make me sick of rapid clips shows of video detritus set to austere synth music. See also the MV for "Generate Utopia" by death's dynamic shroud & galen tipton. They slay some Paul Virilio-ballistic vision-hypermedia cunt.

what i'm playing

Nubby's Number Factory

This game is fucking pernicious. It's rougelike plinko. It's a total reward center hack. It has to be a CIA op.

what i'm working on

my microcontroller era

As a birthday present to myself I went to my closest Micro Center and got a Raspberry Pi Pico starter kit. My biggest achievement so far is getting demo code to run Alien Invaders on an OLED, but I'm already engaging in some behavior beyond my station: I stole a teleconferencing microphone slated for recycling from work and de-soldered the condenser mic module from inside it. Now I have to figure out what to do with it.

something i liked

new glasses

I think they make my eyes look too close together but that's fine.

something i hated

bricked my kindle

Maybe I shouldn't have started just unzipping old versions of glibc into the root file system. Maybe I should've just been satisfied with running a whole ass Alpine Linux desktop interface. I don't think I can even factory reset it. RIP.

a picture:

boku no pi pico

The Pi Pico isn't pictured here, but here's my biggest "achievement". It's all MicroPython demo code. I didn't even write the driver. I'm a hack.

weeklies #52 - 28

2026-08-08T00:00:00Z

I'm 28. I feel cornered. I have everything I could ever need in my life and I'm still living like a shadow. I'm ashamed to be alive. I'm chopped and unc. I need a septum piercing.

what i'm reading

Sisters of the Vast Dark by Lina Rather

Space nuns jet-set in their slug ships on the margins of a slumbering intergalactic empire. When the ecumenical order at the imperial core tries to bring its strays back into the fold, space nuns are subject to tests of mettle and faith.

A fun novel. I love the space slugs.

what i'm listening to

recession pop(?)

IDK if I buy the 2010s electroclash/recession-rave revival. There's just too much craft and subtlety in tracks these days. Does that make sense? Like I don't think Macbooks from 2009-2013 could even handle the number of tracks in a given electroclash-revival song without crashing the DAW. The inaugural anthem of the 00's, "Boom Boom Pow" by the Black Eyed Peas, is barely even a song. It's a kick and a snare and the black eyed peas spitting some absolute nonsense. You'd probably get sued by your label for trying to put that out these days.

I won't complain too much because I'm in the mood for loud dumb stuff.

what i'm watching

Cure (1997)

My favorite Kiyoshi Kurosawa movie screened at my local indie cinema-- on my birthday no less.

Kiyoshi Kurosawa is a frustratingly 50/50 director to me. Cure is an incredible movie, but I absolutely hated Pulse (2001). Then he won me back with License to Live (1998), which is somehow a comedy with the exact style and tone of his thrillers. But then Charisma (1999) sucked.

I don't think they know how to write, stage, film, color grade, soundtrack, foley and mix movies like Cure anymore. It's just gorgeous and mesmerizing (lol).

what i'm playing

Fire On The Mountain

JERRI: Sorry- this is just a new low for you-- is all.

RIPLEY: How so?

JERRI: Meeting a guy from a hookup app? Inviting said guy to the campsite?

JERRI: Having your meet-cute during work hours, while a group of kids are visiting, all during an active investigation?

That... does sound really bad when it's all laid out like that.

If Fire's exposition feels slow, the rest of the chapter is a roller coaster. Much like the moment-to-moment life of Ripley, the script rubberbands from slapstick to somber, progressing through each misadventure of Campsite 7 at a clip.

Fire is one to watch, not just because it's jumping a formidable shark(-- writing two snarky twinks in the same script; something possibly never attempted before in English-language canon--), but because it's dripping with style and intrigue.

P.S: Ripley is not getting into heaven for being a Radiohead fan. But that's okay because then we'll be there together <3.

Fire On The Mountain 0.1 on itch.io

what i'm working on

kindle jailbreaking

I got a Kindle second-hand. I want it Jailbroken. I'm struggling. I follow all the directions but the logs say the shell scripts can reach the binaries. The binaries are right there. I'm looking at the binaries. Why can't you see the binaries? You don't like my binaries? Is there something wrong with me? Why doesn't anyone love me.

something i liked

gen alpha gamer cashiers

The broccoli-haired brace-face gen alpha cashier at Best Buy complimented my choice in gaming mice and said he the same mouse. We complained about light-weight mice that feel cheap but cost more. "They cut holes in it and then charge more". He was so right.

I'm very happy with the Logitech Hero G502 so far. I will say the little metal weights you have to put in are very lab rat coded. Give the consumer a little task to do in their enclosure. Just a little stimulation for the treatler.

something i hated

30-30-30

I'm trying to get serious about not destroying my eyes before I'm 40 so I've started setting a timer to abide by the 30-30-30 rule. This shit is gay as fuck. I'm trying to get work done. I need to stare at the screen for at least 90 minutes at a time.

a picture:

all the fire is at goodwill

I saw this aesome electric typewriter from the 80s at Goodwill: a Smith-Corona Coronamatic 2500. I wish I had room for junk like this, but unfortunately I would have to sleep on the floor to make room for it.

friendmeat

Using live-build and GitHub Actions to build customized Debian live install ISOs

0. Prologue: Why?

1. live-build

2. "But It Works On My Machine!!!"

2.1 The Hall of (Debian) Mirrors

2.2 Containers to the rescue

2.3 Dev loop hell

5. tl;dr How To Do It

6. Conclusion

7. Acknowledgements

i hinking conversation

weeklies #54 - a screensaver for plato's cave

what i'm reading

velcro city tourist board

what i'm listening to

Burn - YS

what i'm watching

Teenage Sex and Death At Camp Miasma (2026), dir. Jane Schoenbrun

what i'm playing

the mormon furry VN

what i'm working on

a screensaver in plato's cave

something i liked

ohh fuck

something i hated

fake local news

a picture:

the humiliating ordeal of editing yourself

weeklies #53 - boku no pi pico

what i'm reading

1,800+ pages of self-assigned reading

hetero stardew valley fanfic

"Meme Images", Adam Denzler

what i'm listening to

"No Se Va" - Grupo Frontera

what i'm watching

devonwho - hibeams

what i'm playing

Nubby's Number Factory

what i'm working on

my microcontroller era

something i liked

new glasses

something i hated

bricked my kindle

a picture:

boku no pi pico

weeklies #52 - 28

what i'm reading

Sisters of the Vast Dark by Lina Rather

what i'm listening to

recession pop(?)

what i'm watching

Cure (1997)

what i'm playing

Fire On The Mountain

what i'm working on

kindle jailbreaking

something i liked

gen alpha gamer cashiers

something i hated

30-30-30

a picture:

all the fire is at goodwill

1. `live-build`