Fix Docker APT source to work with both Ubuntu and Debian images (#59)

The cloud-init template hardcoded the Docker APT repo URL for Ubuntu,
which breaks on Debian images (e.g. Debian 13 "trixie"). Replace the
static apt.sources block with a runcmd script that detects the distro
via /etc/os-release and configures the correct Docker repo dynamically.
Also uses dpkg --print-architecture instead of hardcoding amd64.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dropkit/templates/default-cloud-init.yaml

@@ -6,13 +6,6 @@ package_update: true
 package_upgrade: true
 disable_root_opts: no-port-forwarding,no-agent-forwarding,no-X11-forwarding
 
-apt:
-  sources:
-    docker:
-      keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
-      keyserver: https://download.docker.com/linux/ubuntu/gpg
-      source: deb [arch=amd64 signed-by=$KEY_FILE] https://download.docker.com/linux/ubuntu $RELEASE stable
-
 # Install required packages
 packages:
   - ufw
@@ -25,11 +18,6 @@ packages:
   - apt-transport-https
   - ca-certificates
   - gnupg
-  - docker-ce
-  - docker-ce-cli
-  - containerd.io
-  - docker-buildx-plugin
-  - docker-compose-plugin
 
 users:
   - name: {{ username }}
@@ -80,6 +68,16 @@ runcmd:
   - ufw limit ssh
   - ufw --force enable
 
+  # Install Docker from official repo (works on both Ubuntu and Debian)
+  - |
+    . /etc/os-release
+    install -m 0755 -d /etc/apt/keyrings
+    curl -fsSL "https://download.docker.com/linux/$ID/gpg" -o /etc/apt/keyrings/docker.asc
+    chmod a+r /etc/apt/keyrings/docker.asc
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/$ID $(. /etc/os-release && echo "$VERSION_CODENAME") stable" > /etc/apt/sources.list.d/docker.list
+    apt-get update
+    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
   {% if tailscale_enabled %}
   # Install Tailscale via official script (daemon only, authentication handled by dropkit)
   - curl -fsSL https://tailscale.com/install.sh | sh

tests/test_cloudinit.py

@@ -51,3 +51,26 @@ def test_default_template_renders_without_tailscale():
     )
     assert "testuser" in rendered
     assert "tailscale.com/install.sh" not in rendered
+
+
+def test_docker_install_uses_distro_detection():
+    """Verify Docker setup detects distro dynamically instead of hardcoding Ubuntu."""
+    content = _load_default_template()
+    template = Template(content)
+    rendered = template.render(
+        username="testuser",
+        full_name="Test User",
+        email="test@example.com",
+        ssh_keys=["ssh-ed25519 AAAAC3... test@host"],
+        tailscale_enabled=True,
+    )
+    # Must not hardcode Ubuntu — should use /etc/os-release for distro detection
+    assert "download.docker.com/linux/ubuntu" not in rendered
+    assert "/etc/os-release" in rendered
+    assert "download.docker.com/linux/$ID" in rendered
+
+    # Docker packages installed via runcmd, not apt sources
+    assert "apt-get install -y docker-ce" in rendered
+
+    # Architecture detected dynamically, not hardcoded amd64
+    assert "dpkg --print-architecture" in rendered