When an ISO is built in a container whose capability bounding set lacks `CAP_SYS_MODULE`, the build succeeds but the image doesn't boot. A Proxmox LXC with default settings is one such container: it drops sys_module, sys_time, sys_rawio, mac_admin and mac_override.
The initrd it produces contains no kernel modules. `squashfs`, `isofs`, `sr_mod`, `overlay` and `virtio_blk` are all built as modules (=m), so live-boot can't find or mount the boot medium and the system stops at the (initramfs) prompt.
### Root cause
- vyos-1x's postinst runs setcap `cap_sys_module=pe /bin/kmod` and `setcap cap_sys_time=pe /bin/date`.
- The kernel refuses to exec a binary with effective file capabilities that aren't in the caller's bounding set, so modprobe and date fail with `EPERM` inside the build chroot, even as root.
- `mkinitramfs` ignores the modprobe failures and still exits 0, so no module is added and the build doesn't fail.
- `date` is affected the same way, so the hooks that use it (`40-init-geoip-database`, `93-sb-sign-kernel`) get empty values.
- Removing the capability from the container's drop list would avoid this, but it lets the build container load modules into the host kernel which is a bad thing!
## Proposed fix
- A new hook, `00-drop-file-caps.chroot`, records the file capabilities on kmod and date and removes them for the duration of the chroot hooks.
- A new hook, `99-restore-file-caps.chroot`, rebuilds the initramfs itself and fails the build if squashfs is missing. It then sets live-build's initrd.img_has_already_been_regenerated marker so chroot_hacks doesn't rebuild it again with the capabilities restored, and finally puts the original capabilities back. The final image keeps exactly the capabilities vyos-1x intends.
LXC container configuration
```
$ cat /etc/pve/lxc/100.conf
arch: amd64
cores: 6
features: nesting=1,keyctl=1,fuse=1
hostname: build.vyos.net
memory: 8192
nameserver: 192.0.2.1,192.0.2.2
net0: name=eth0,bridge=vmbr0,gw=192.0.2.1,gw6=2001:db8::1,hwaddr=BC:24:11:2E:FF:FF,ip=192.0.2.10/25,ip6=2001:db8::10/64,tag=810,type=veth
ostype: debian
rootfs: ld-nvme-001:subvol-100-disk-0,size=250G
searchdomain: vyos.net
swap: 0
lxc.cgroup2.devices.allow: c 195:* rwm
lxc.cgroup2.devices.allow: c 10:232 rwm
lxc.mount.entry: /dev/kvm dev/kvm none bind,optional,create=file
root@node01:~#
```