{endverbatim}
 
 {section: execute node}
+
+I started from the _condor_annex_ base image, removed HTCondor, and installed the version under test from RPMs.  IIRC, the base condor config remained stock.  (Confirm.)
+
+=--- /etc/condor/config.d/annex ---=
+{verbatim}
+DAEMON_LIST = MASTER, STARTD
+
+# Probably not necessary for production.
+STARTD_DEBUG = D_SECURITY D_NETWORK
+
+SEC_CLIENT_AUTHENTICATION_METHODS = FS, PASSWORD
+SEC_ENABLE_MATCH_PASSWORD_AUTHENTICATION = TRUE
+SEC_DEFAULT_AUTHENTICATION_METHODS = FS, PASSWORD
+SEC_PASSWORD_FILE = /etc/condor/password_file
+ALLOW_OWNER = $(ALLOW_OWNER) condor_pool@*/*
+ALLOW_WRITE = $(ALLOW_WRITE) condor_pool@*/*
+
+# This in effect gives the pool 15 minutes to claim this startd
+# before shutting down.  This wasn't enough in a few cases, but
+# that could be avoided by running more than one schedd or starting
+# fewer jobs at the same time.  It also causes this instance to
+# suicide if the pool runs of jobs, which was the real main point.
+STARTD_NOCLAIM_SHUTDOWN = 900
+# Intended to shut the master down when the startd goes away for
+# more than sixty seconds.  Also shuts the master down if the
+# startd hasn't been started in sixty seconds.
+MASTER.DAEMON_SHUTDOWN_FAST = ( STARTD_StartTime == 0 ) && ((CurrentTime - DaemonStartTime) > 60)
+# The script the shuts the instance down when HTCondor exits.
+MASTER_SHUTDOWN_SHUTDOWN = /etc/condor/shutdown
+# Because we can, mostly.
+ENCRYPT_EXECUTE_DIRECTORY = TRUE
+
+# Take the last quad of the instance's IP address and add it to
+# the base port number to determine which child collector and CCB
+# collector to use.  Note that PORTSTR is in the ClassAd language;
+# the indirection is required because of the way the HTCondor
+# config language parses $INT().
+PORTSTR = 10000 + int(split( "$(IP_ADDRESS)", "." )[3])
+PORTNO = $INT(PORTSTR)
+COLLECTOR_HOST = e141.chtc.wisc.edu:$(PORTNO)
+CCB_ADDRESS = e142.chtc.wisc.edu:$(PORTNO)
+
+# Advertise the instance ID.
+STARTD_ATTRS = $(STARTD_ATTRS) EC2InstanceID
+NUM_CPUS = 10
+CLAIM_WORKLIFE = 24 * $(HOUR)
+{endverbatim}
+
+=--- /etc/condor/shutdown ---=
+{verbatim}
+#!/bin/sh
+/sbin/shutdown -h now
+{endverbatim}
+
+=--- /etc/rc.local ---=
+{verbatim}
+#!/bin/sh
+#
+# This script will be executed *after* all the other init scripts.
+# You can put your own initialization stuff in here if you don't
+# want to do the full Sys V style init stuff.
+
+touch /var/lock/subsys/local
+
+# The above is from the stock OS installation.
+
+# Create ec2.local, with some information that may be of interest to us.
+echo EC2PublicIP = $(/usr/bin/curl -s http://169.254.169.254/latest/meta-data/public-ipv4) >> /etc/condor/config.d/ec2.local
+echo EC2InstanceID = \"$(/usr/bin/curl -s http://169.254.169.254/latest/meta-data/instance-id)\" >> /etc/condor/config.d/ec2.local
+
+# HTCondor shouldn't be started by default, but if it is, be sure to fully reconfigure it.
+service condor restart
+
+# Until #5590 becomes available, we have to do this to actually turn the HTCondor master shutdown script on.
+while ! condor_set_shutdown -exec shutdown; do sleep 1; done
+{endverbatim}