tested as init action with default route

tested as init action with proxy egress

Author: cjac

examples/secure-boot/README.md

@@ -38,6 +38,35 @@ SC by ensuring that the underlying infrastructure is secure and
 trusted. This helps to strengthen the overall security posture of
 Google Cloud Platform environments and protect sensitive data.
 
+## Development Workflow for Customization Scripts
+
+When developing a new customization script (like `install_gpu_driver.sh` or others in this directory) to be used with the custom image build process, the following workflow is recommended:
+
+1.  **Manual Execution on a Live Cluster Node:**
+    *   Create a standard Dataproc cluster matching the target OS version (e.g., 2.2-debian12).
+    *   SSH into a node (e.g., the master node).
+    *   Copy your script to the node (e.g., using `gcloud compute scp your-script.sh node-name:/tmp/`).
+    *   Get a clean root shell: `exec sudo -i bash`
+    *   Run the script with tracing and timing: `time bash -x /tmp/your-script.sh`.
+    *   Debug and refine the script in this environment. This allows for rapid iteration, and the `time` command helps identify performance bottlenecks. Add idempotency checks to your script to allow for faster re-runs during debugging.
+
+2.  **Test as an Init Action on Cluster Creation:**
+    *   Once the script runs cleanly when executed manually as root, test it as an initialization action during cluster creation.
+    *   Upload the script to a GCS bucket.
+    *   Create a new cluster using `gcloud dataproc clusters create --initialization-actions gs://your-bucket/your-script.sh ...`.
+    *   This verifies the script works correctly within the Dataproc cluster startup sequence and with the permissions of the init action environment.
+
+3.  **Test as a Custom Image Customization Script:**
+    *   Use the `temp/create-custom-image-test-host-X.X.sh` scripts (e.g., `create-custom-image-test-host-2.2.sh`) to create a single builder VM mimicking the custom image creation environment for the target OS.
+    *   This will run your script via the `startup_script/run.sh` wrapper, just like the real image build process.
+    *   SSH to the debug instance (e.g., `debug-deb12-build`) to check logs and behavior. The relevant logs will be in `/tmp` on the instance.
+
+4.  **Full Custom Image Build:**
+    *   Once the script works in the single debug instance, run the full build process using `examples/secure-boot/build-and-run-podman.sh` (ensure it's set to run `examples/secure-boot/build-current-images.sh`).
+    *   This will build all image variants and purposes defined in `pre-init.sh` and its screenrc.
+
+This staged approach helps isolate issues, starting from manual execution and progressively moving closer to the automated custom image build process.
+
 ## Examples
 
 To create a custom image with a self-signed, trusted certificate