[vaggeliskls]

Current Behaviour

Releases up to 1.3.0 ship a container image that runs the Windows VM through Vagrant and libvirt. It needs a privileged container with cgroup: host, re-provisions the VM on every start (20 to 40 minutes), and the runner run.cmd processes live in an interactive session. A wrong token, a missing .env or a changed runner count all need a manual RDP session or a full re-provision to recover, and the install log is only visible inside the VM.

Expected Behaviour

Version 2: the VM is dockur/windows driven by docker-compose.yml and two scripts in oem/. No custom image, no Vagrant, no privileged container. Windows is installed once from the evaluation ISO and persisted in storage/; later starts just boot it.

Deployment

• docker-compose.yml runs dockurr/windows, bind-mounts oem/ (install scripts), storage/ (disk + ISO), shared/ (log and markers) and .env as /shared/runner.env, which the VM reads as \host.lan\Data\runner.env. Nothing secret goes into oem/, since dockur bakes that folder into the install ISO.
• .env.example documents every setting with its default. VM sizing (RAM_SIZE, CPU_CORES, DISK_SIZE) applies at the next restart; DISK_SIZE can only grow.

oem/install.ps1

• Installs PowerShell 7, Chocolatey, Git, jq, 7-Zip, Visual Studio 2022 (edition and workloads configurable) and Rtools 4.0, then registers RUNNERS runners as Windows services (default) or as scheduled tasks in the desktop session (RUNNER_MODE=interactive).
• Registers a "GitHub runner setup" scheduled task that re-runs the script at every logon. It checks each toolchain part on the machine and installs only what is missing, and re-registers the runners only when runner.env changed since they were last registered (SHA-256 marker). Fixing .env on the host and restarting the container is therefore enough to recover from a wrong PAT or URL, change the runner count, labels or version. Lowering RUNNERS removes the surplus runners from GitHub. With nothing to do, the task exits without touching shared/.
• A missing .env at docker compose up makes Docker create an empty directory in its place; the script now explains that instead of "Access to the path is denied".
• Logging: the console, C:\OEM\install.log and shared/install.log on the host carry the same text. Native command output (choco, pacman, config.cmd) is routed through Invoke-Native so the transcript records stdout and stderr; a background job appends the transcript to the host copy every 2 seconds, so tail -f shared/install.log is a live feed. install.done or install.failed marks the end.

CI

• lint.yml validates docker compose config, parses install.ps1 and runs PSScriptAnalyzer with the repo settings, plus actionlint. The old image build workflow is removed.

Verified

• Full install on a Linux KVM host with the branch's scripts (first start, runner registration).
• Scheduled-task objects, transcript switching, native output capture, the append-only mirror and the tool detection were exercised in Windows PowerShell 5.1, the version in the VM, without registering anything.

Not covered

• Changing VS_EDITION or VS_WORKLOADS after Visual Studio is installed is not detected by the logon check (any VS 17.x counts as present); it needs a manual run or a wipe of storage/.
• Workflows using the old windows_vagrant_action label should switch to windows_x64 or add the label to GITHUB_RUNNER_LABELS; see "Migrating from 1.x" in the README.