--- a/conf.d/vm.mk	
+++ a/conf.d/vm.mk	
@@ -22,4 +22,7 @@ vm/icewm-setup: vm/.desktop-bare mixin/icewm use/oem use/x11-autostart
 	@$(call add,THE_BRANDING,graphics)
 	@$(call add,THE_LISTS,$(call tags,base l10n))
 
+vm/vagrant-base: vm/net use/vagrant
+	@$(call set,KFLAVOURS,led-ws)
+
 endif
--- a/features.in/vagrant/authorized_keys	
+++ a/features.in/vagrant/authorized_keys	
@@ -0,0 +1, @@ 
+ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key
--- a/features.in/vagrant/config.mk	
+++ a/features.in/vagrant/config.mk	
@@ -0,0 +1,3 @@ 
+use/vagrant: use/vmguest/vbox use/deflogin use/net-ssh
+	@$(call add_feature)
+	@$(call add,USERS,vagrant:vagrant:1:1)
--- a/features.in/vagrant/rootfs/image-scripts.d/50-vagrant	
+++ a/features.in/vagrant/rootfs/image-scripts.d/50-vagrant	
@@ -0,0 +1,16 @@ 
+#!/bin/sh
+# NB: 50-vargant > 50-users
+
+# https://raw.github.com/mitchellh/vagrant/master/keys/vagrant.pub
+pubkey="ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key"
+sshkeys=~vagrant/.ssh/authorized_keys
+install -pDm400 -o vagrant -g vagrant /dev/null "$sshkeys"
+echo "$pubkey" > "$sshkeys"
+
+### FIXME: check if this works
+sudocfg=/etc/sudoers.d/vagrant
+install -pDm400 /dev/null "$sudocfg"
+cat > "$sudocfg" << EOF
+Defaults:vagrant  !requiretty
+vagrant ALL=(ALL) NOPASSWD:ALL
+EOF