Preparing a Linux golden image for cloning: host keys, machine-id, logs and net rules

Goal

Strip a Linux system of the per-machine state that must not be shared between clones, before it is captured as a template or golden image.

Prerequisites

Root access on the reference system, and a snapshot of it taken first so it can be restored for the next image build. This is the last step before capture: without host keys and a machine ID the system should not keep running.

Steps

1. Remove the SSH host keys: rm -f /etc/ssh/ssh_host_*. sshd_config(5) lists the default host keys as /etc/ssh/ssh_host_ecdsa_key, /etc/ssh/ssh_host_ed25519_key and /etc/ssh/ssh_host_rsa_key. Make sure the clone recreates them at first boot, or sshd will not start and the clone is unreachable over SSH. RHEL/Fedora generate missing keys through the sshd-keygen@ units when sshd starts, and cloud-init images create them per instance. On Debian/Ubuntu without cloud-init, add a first-boot unit that runs ssh-keygen -A.
2. Empty the machine ID: truncate -s 0 /etc/machine-id. machine-id(5) says that for images "created once and used on multiple machines" the file "should be either missing or an empty file"; an empty file is recommended because it can be bind-mounted over when /etc is read-only. The two behave differently: a missing file (or one containing uninitialized) marks the next boot as a first boot, which runs ConditionFirstBoot= units and unit presets; an empty file does not.
3. Check /var/lib/dbus/machine-id. If it is a regular file rather than a symlink to /etc/machine-id, delete it or replace it with that symlink (ln -sf /etc/machine-id /var/lib/dbus/machine-id). If /etc/machine-id is empty, systemd falls back to this file first, so every clone would inherit the old ID.
4. Clear logs: journalctl --rotate && journalctl --vacuum-time=1s, and truncate rather than delete text logs that daemons expect to exist (truncate -s 0 /var/log/*.log, adjusted per distribution).
5. Remove hardware-bound network state. The 70-persistent-net.rules file only exists on old udev generations; current systemd uses predictable names that are derived from the bus path. Check instead for MAC-pinned configuration: macaddress: matches in netplan (including cloud-init's 50-cloud-init.yaml), HWADDR= in ifcfg files, mac-address= in NetworkManager keyfiles, and MACAddress= in systemd-networkd .network/.link files.
6. If the image uses cloud-init, reset its state so the clone provisions itself again: cloud-init clean --logs --machine-id. --machine-id sets /etc/machine-id to uninitialized and is called "best practice when cloning a golden image". --configs all also removes generated ssh, network and datasource configuration. Add --seed only if the seed data will be supplied again, and check cloud-init clean --help because older releases lack some flags.
7. Power off (poweroff) and capture the disk without booting it again.

Expected result

The captured image boots with no reused machine ID, D-Bus ID or SSH host key, and with no MAC-bound network configuration, and every clone generates its own.

Limits and test basis

The machine ID "must not be exposed in untrusted environments, in particular on the network," so a populated ID in a shared image is a confidentiality issue as well as a cloning bug. Duplicate IDs also mean duplicate DHCP client identifiers where systemd-networkd derives its DUID from the machine ID, which is its default. Verify by booting two clones and comparing /etc/machine-id and ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub.