- cloud-init 安装 openssh-server,装包后(defer)写 sshd_config.d drop-in 关闭密码与 root 登录;不再使用 ssh_pwauth,它会在装包前写出残缺的 sshd_config,使 UsePAM yes 落不下来 - 删除 ansible/containers.yml 与 tasks/container-ssh.yml - 两台空容器已重建,使现场与声明一致 Co-Authored-By: Claude Opus 5.5 <[email protected]>