Currently, all our CI images have the freeipa-client package installed so that TestIPA and maybe others can run. Instead of including it directly in the image, we could make it available from a "package set" and only install it while running TestIPA.

The immediate reason for this is that the freeipa-client package has started to skew the default configuration of the Debian and Ubuntu images. It has started to conflict with systemd-timesyncd, which would otherwise be the default in Debian. This affects all tests unfairly.

The challenges are:

• freeipa-client probably has a lot of dependencies that need to be available from the package set as well. We need to compute them during image creation and download them as well. Maybe apt/apt-get/aptitude can do that easily, maybe not.
• Installing it takes time and also prevents the tests that do that from being "nondestructive". Maybe we need to invent a mechanism that prepares a image on the fly for a given test class, via "provision"?