I don’t trust the prebuilt images that providers provide so I like installing from my own ISO.

cloud-init is useful sometimes, but I recently had an issue with Alpine’s alternative implementation (tiny-init) where it was setting a root password I didn’t know. It was pulling it from some sort of metadata, but there was nowhere in my provider’s control panel to set the default root password. Alpine also doesn’t have any documentation about how to disable tiny-init, so I had to read the code and figure it out myself (create a file called /etc/tiny-cloud.disabled before init runs).

cloud-init also can’t configure LUKS encryption. I know its usefulness is limited on a VM (since the provider can snapshot the memory and retrieve the encryption key that way), but it’s still useful when the VM isn’t running or if you stop using that provider to ensure they can’t recover the data, and it’s required in some cases (eg Plaid required me to certify that all data is encrypted at-rest before they gave me access to their API)