NixOS/nixops — pull request #207 by aszlig (2014-06-27 04:58:39+00:00)
Title: MachineState: Don't send keys within state.RESCUE.

This will store keys on the machine's disk when you try to deploy a machine expression that has `deployment.keys` set, because in rescue state we don't have `/run` mounted.

If you want to manually get rid of `/run/keys` from your disk you can access the files that are covered by another mount using a bind mount of the parent directory, so you can delete the keys using something like this:

```sh
mkdir /delkeys
mount --bind / /delkeys
rm -r /delkeys/run/keys
umount /delkeys
rmdir /delkeys
```

But that's no longer necessary since release `14.04`, because the stage 2 init script does a `rm -rf /run/keys` on bootup already.