First Boot and Remote Access

# at the monitor, in a terminal on the board, once
ip -4 addr show eth0
systemctl is-active ssh

$ ip -4 addr show eth0   # measured on the bench — yours will vary
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    inet 192.168.1.137/24 brd 192.168.1.255 scope global dynamic noprefixroute eth0
       valid_lft 84903sec preferred_lft 84903sec

$ systemctl is-active ssh
active

Two words in that inet line decide the rest of the chapter. 192.168.1.137/24 is the address and the size of the network it belongs to: 24 bits of network, leaving the last 8 bits for hosts. dynamic means the address was lent by the router's DHCP server, and valid_lft 84903sec is the lease counting down, a little under a day. Reboot the board on a busy network, or leave it powered off over a weekend, and the number you carefully wrote on a sticky note points at somebody's laptop. The JetPack image already runs an SSH server, which is what active reports. If yours prints inactive, install it with sudo apt install -y openssh-server and enable it with sudo systemctl enable --now ssh.

# on your workstation, not on the board
ssh-keygen -t ed25519 -C "glados jetson"    # skip if you already have a key
ssh glados@192.168.1.137                    # the password you chose at the wizard
exit
ssh-copy-id glados@192.168.1.137
ssh glados@192.168.1.137 uname -a

$ ssh-copy-id glados@192.168.1.137
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
glados@192.168.1.137's password:

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh 'glados@192.168.1.137'"
and check to make sure that only the key you wanted was added.

$ ssh glados@192.168.1.137 uname -a   # measured on the bench — yours will vary
Linux glados-jetson 5.15.148-tegra #1 SMP PREEMPT Tue Jan  7 17:14:38 PST 2025 aarch64 aarch64 aarch64 GNU/Linux

ssh-copy-id does something small and exact: it appends one line, your public key, to ~/.ssh/authorized_keys on the board, creating the directory with the permissions the SSH server insists on. From then on the server proves you are you by asking your client to sign a challenge with the matching private key, and no password crosses the network. The reason to bother is not security alone. A password prompt is interactive, and every command in the rest of this volume is going to run as ssh glados-jetson something from a script, in a loop, or out of a Makefile. Interactive prompts have no place there.

Read the tail of that uname line before moving on. aarch64, three times, is the board telling you it is 64-bit ARM. Every wheel, container image and compiled binary that arrives here has to exist for that architecture, and a fair number of things you are used to installing on an x86 laptop simply do not. 5.15.148-tegra is NVIDIA's kernel, not a stock Ubuntu one, so board support arrives on NVIDIA's release schedule and not Ubuntu's.

# on the board, over ssh now
nmcli -t -f NAME,DEVICE connection show
sudo nmcli connection modify "Wired connection 1" \
    ipv4.method manual \
    ipv4.addresses 192.168.1.100/24 \
    ipv4.gateway 192.168.1.1 \
    ipv4.dns 192.168.1.1
sudo nmcli connection up "Wired connection 1"

$ nmcli -t -f NAME,DEVICE connection show
Wired connection 1:eth0

$ sudo nmcli connection up "Wired connection 1"
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
client_loop: send disconnect: Broken pipe

# on your workstation: ~/.ssh/config
Host glados-jetson
    HostName 192.168.1.100
    User glados
    IdentityFile ~/.ssh/id_ed25519

That Broken pipe is not a bug and it is not optional. The last command tears down and rebuilds the connection on eth0, and your SSH session is running over eth0, so the session dies in the middle of the command that killed it. The board is fine. Reconnect at the new address, which after the ~/.ssh/config entry above is just ssh glados-jetson. Expect a warning about a changed host key only if some other machine used to answer at 192.168.1.100.

There are two honest ways to pin an address and they disagree about where the truth lives. A DHCP reservation on the router keeps every address on your network in one table, and the board keeps asking for a lease as normal. The static configuration above puts the answer on the board, where it survives replacing the router and where it will happily collide with a lease the router hands somebody else. Pick a number outside the router's DHCP pool, pick one method, and write down which one you chose, because the failure mode of forgetting is a board that answers at an address you cannot explain.

# labs/jetson_setup_check.py — runs on the board, with the interpreter it shipped with
import socket


def read_os_release(path: str = "/etc/os-release") -> dict[str, str]:
    """Parse the distro's KEY=value file into a dict."""
    info: dict[str, str] = {}
    try:
        with open(path) as handle:
            for line in handle:
                line = line.strip()
                if not line or line.startswith("#") or "=" not in line:
                    continue
                key, value = line.split("=", 1)
                info[key] = value.strip('"')
    except FileNotFoundError:
        pass
    return info


if __name__ == "__main__":
    release = read_os_release()
    print("Hostname:", socket.gethostname())
    print("OS      :", release.get("PRETTY_NAME", "unknown"))
    print("Version :", release.get("VERSION_ID", "unknown"))

$ python3 labs/jetson_setup_check.py   # measured on the bench — yours will vary
Hostname: glados-jetson
OS      : Ubuntu 22.04.5 LTS
Version : 22.04

/etc/os-release is a file every mainstream Linux distribution promises to write, in a format simple enough to read from a shell script or from twelve lines of Python. Parsing it beats running lsb_release and picking words out of its output, because a file with a published format does not change its wording between releases. The 1 in split("=", 1) caps the split at the first equals sign, and it is not decoration: the file carries a HOME_URL whose query string contains more of them, and without the cap that line unpacks into four values and raises ValueError. Note this script runs with the system python3, the 3.10 that Ubuntu 22.04 ships. The project's pinned 3.11 and its uv workspace are not on this board yet, and the audit has to work before they are.

import fcntl
import struct

SIOCGIFADDR = 0x8915          # the kernel's request number for "this interface's address"


def interface_ipv4(name: str) -> str | None:
    """Ask the kernel for the IPv4 address held by one interface."""
    probe = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    try:
        request = struct.pack("256s", name[:15].encode("utf-8"))
        reply = fcntl.ioctl(probe.fileno(), SIOCGIFADDR, request)
        return socket.inet_ntoa(reply[20:24])
    except OSError:
        return None
    finally:
        probe.close()


def interface_addresses() -> dict[str, str]:
    """Every interface currently holding an IPv4 address, in kernel order."""
    found: dict[str, str] = {}
    for _index, name in socket.if_nameindex():
        address = interface_ipv4(name)
        if address is not None:
            found[name] = address
    return found


if __name__ == "__main__":
    for name, address in interface_addresses().items():
        print(f"{name:<10} {address}")

$ python3 labs/jetson_setup_check.py   # measured on the bench — yours will vary
lo         127.0.0.1
eth0       192.168.1.100
l4tbr0     192.168.55.1

socket.if_nameindex() is the kernel's own list of network interfaces, the same list ip link prints, handed over as pairs of index and name. For each name, fcntl.ioctl passes a request straight to the kernel: here is a buffer with an interface name in it, fill in its address. The reply comes back the same length as the request, laid out as the C structure the kernel uses. Sixteen bytes of interface name, then an address structure whose first four bytes are the family and the port, so the four bytes of IPv4 address begin at offset 20 and socket.inet_ntoa turns them into the dotted string. An OSError means that interface exists but holds no IPv4 address right now, which is ordinary for an interface that is down.

Three interfaces, three different meanings. lo is the loopback: it exists on every Linux machine, it never leaves the box, and its presence tells you nothing about your network. eth0 is the Ethernet port, holding the static address from stage 3, and it is the only one your desk can reach. l4tbr0 is the bridge behind the USB device-mode network, reachable only by whatever is on the far end of that cable. An audit that reported one address would have to choose, and any choice it made would be wrong somewhere.

import shutil
from pathlib import Path

MIN_FREE_BYTES = 20 * 1024**3   # a floor for the models that arrive later in this volume


def format_bytes(count: float) -> str:
    """Render a byte count the way df -h does, in steps of 1024."""
    for unit in ("B", "KB", "MB", "GB", "TB"):
        if count < 1024:
            return f"{count:.1f} {unit}"
        count /= 1024
    return f"{count:.1f} PB"


def port_is_open(port: int = 22, host: str = "127.0.0.1") -> bool:
    """True when something on this machine is listening on that port."""
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as probe:
        probe.settimeout(1.0)
        return probe.connect_ex((host, port)) == 0


def count_authorized_keys() -> int:
    path = Path.home() / ".ssh" / "authorized_keys"
    if not path.exists():
        return 0
    return sum(1 for line in path.read_text().splitlines()
               if line.strip() and not line.startswith("#"))


def run_audit() -> dict[str, tuple[bool, str]]:
    """Four questions whose answers decide whether the monitor can come off."""
    lan = {n: a for n, a in interface_addresses().items() if not a.startswith("127.")}
    listening = port_is_open()
    keys = count_authorized_keys()
    free = shutil.disk_usage("/").free
    return {
        "reachable address": (bool(lan),
                              ", ".join(f"{n} {a}" for n, a in lan.items()) or "loopback only"),
        "ssh listening": (listening,
                          "127.0.0.1:22 accepted a connection" if listening else "nothing on port 22"),
        "key login ready": (keys > 0, f"{keys} key(s) in ~/.ssh/authorized_keys"),
        "room for models": (free >= MIN_FREE_BYTES,
                            f"{format_bytes(free)} free (floor {format_bytes(MIN_FREE_BYTES)})"),
    }


def main() -> None:
    release = read_os_release()
    usage = shutil.disk_usage("/")
    results = run_audit()
    passed = sum(1 for ok, _ in results.values() if ok)

    print("=" * 58)
    print("  Jetson headless audit")
    print("=" * 58)
    print(f"  Hostname   : {socket.gethostname()}")
    print(f"  OS         : {release.get('PRETTY_NAME', 'unknown')}")
    print(f"  Interfaces : {', '.join(f'{n} {a}' for n, a in interface_addresses().items())}")
    print(f"  Disk       : {format_bytes(usage.free)} free of {format_bytes(usage.total)}")
    print("-" * 58)
    for name, (ok, detail) in results.items():
        print(f"  {'PASS' if ok else 'FAIL':<4}  {name:<18} {detail}")
    print("=" * 58)
    verdict = "the monitor can come off" if passed == len(results) else "keep the monitor attached"
    print(f"  {passed}/{len(results)} checks passed: {verdict}.")
    print("=" * 58)


if __name__ == "__main__":
    main()

$ scp labs/jetson_setup_check.py glados-jetson:~/
jetson_setup_check.py                             100% 3241     1.4MB/s   00:00

$ ssh glados-jetson python3 jetson_setup_check.py   # measured on the bench — yours will vary
==========================================================
  Jetson headless audit
==========================================================
  Hostname   : glados-jetson
  OS         : Ubuntu 22.04.5 LTS
  Interfaces : lo 127.0.0.1, eth0 192.168.1.100, l4tbr0 192.168.55.1
  Disk       : 414.4 GB free of 457.5 GB
----------------------------------------------------------
  PASS  reachable address  eth0 192.168.1.100, l4tbr0 192.168.55.1
  PASS  ssh listening      127.0.0.1:22 accepted a connection
  PASS  key login ready    1 key(s) in ~/.ssh/authorized_keys
  PASS  room for models    414.4 GB free (floor 20.0 GB)
==========================================================
  4/4 checks passed: the monitor can come off.
==========================================================

Each check is a question you would otherwise ask by hand and forget to ask again. port_is_open is the one worth looking at twice: connect_ex attempts a real TCP connection to the board's own port 22 and returns an error number instead of raising, so a refused connection is a value to test rather than an exception to catch. It runs on the board, over lo, and that is the reason the loopback interface earns a line on the report even though nothing outside can use it. The disk floor of 20 GB is the only number here with an opinion in it; the models this volume moves onto the board are several gigabytes each, and finding that out with 4 GB free is a bad afternoon.

Notice that run_audit returns data and prints nothing, while main prints and decides nothing. Keeping them apart is what makes the last exercise in this chapter a five-line change instead of a rewrite: a dictionary of named results can be rendered as a table, written as JSON, or compared against yesterday's copy, and the code that gathered it does not care which.