add services configuration for the ks config.

Author: oliverkurth

docs/ks_config.md

@@ -753,6 +753,21 @@ Used to configure the network.
   }
   ```
 
+### _"services":_ (optional)
+- A dictionary of systemd service names and their desired states.
+- The state must be one of: `enabled`, `disabled`, `masked`.
+- By default, `sshd` is `masked` unless explicitly enabled or disabled. This prevents it from being started automatically by other services via `Wants=` dependencies.
+
+  Example:
+  ```json
+  {
+    "services": {
+      "sshd": "enabled",
+      "docker": "enabled"
+    }
+  }
+  ```
+
 ### _"shadow_password":_ (optional)
 - Contains encrypted root password <encrypted password here>.
 - Short form of:

examples/ova/minimal_ks.yaml

@@ -32,6 +32,9 @@ packagelist_file: packages_minimal.json
 additional_packages:
     - vim
 
+services:
+    sshd: enabled
+
 postinstall:
     # allow ssh root login
     - sed -i "s/\(^PermitRootLogin\)[ ]*no$/\1 yes/g" /etc/ssh/sshd_config

photon_installer/installer.py

@@ -95,6 +95,7 @@ class Installer(object):
         'partition_type',
         'partitions',
         'security',
+        'services',
         'network',
         'no_unmount',
         'no_clean',
@@ -713,6 +714,15 @@ def _check_install_config(self, install_config):
                 if not key.strip():
                     raise InstallerConfigError("Environment variable name cannot be empty or whitespace")
 
+        if 'services' in install_config:
+            services = install_config['services']
+            if not isinstance(services, dict):
+                raise InstallerConfigError("'services' must be a dictionary of service states")
+            allowed_states = ['enabled', 'disabled', 'masked']
+            for service, state in services.items():
+                if state not in allowed_states:
+                    raise InstallerConfigError(f"Invalid state '{state}' for service '{service}'. Allowed states are: {', '.join(allowed_states)}")
+
         # Validate grub password_pbkdf2 format
         if 'grub' in install_config and 'password_pbkdf2' in install_config['grub']:
             password_hash = install_config['grub']['password_pbkdf2']

photon_installer/modules/m_services.py

@@ -0,0 +1,50 @@
+# /*
+# * Copyright © 2026 Broadcom, Inc.
+# * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-only
+# */
+
+import os
+
+import commons
+
+install_phase = commons.POST_INSTALL
+enabled = True
+
+
+def execute(installer):
+    default_services = {}
+
+    # Get user-defined services from config
+    user_services = installer.install_config.get('services', {})
+
+    # Merge configurations, prioritizing user_services
+    services = default_services.copy()
+    services.update(user_services)
+
+    if not services:
+        return
+
+    # Map states to systemctl verbs
+    verb_map = {
+        'enabled': 'enable',
+        'disabled': 'disable',
+        'masked': 'mask'
+    }
+
+    for service, state in services.items():
+        verb = verb_map.get(state)
+        if not verb:
+            installer.logger.warning(f"Invalid state '{state}' for service '{service}'")
+            continue
+
+        if state in ['enabled', 'disabled']:
+            # Check if it's masked first
+            service_link = os.path.join(installer.photon_root, f"etc/systemd/system/{service}.service")
+            if os.path.islink(service_link) and os.readlink(service_link) == "/dev/null":
+                installer.logger.info(f"Unmasking service '{service}' before setting state to '{state}'")
+                installer.cmd.run_in_chroot(installer.photon_root, f"systemctl unmask {service}")
+
+        installer.logger.info(f"Setting service '{service}' to '{state}'")
+        retval = installer.cmd.run_in_chroot(installer.photon_root, f"systemctl {verb} {service}")
+        if retval != 0:
+            raise Exception(f"Failed to set service '{service}' to '{state}' (exit code: {retval})")