slaprunner: recovery-code cannot be changed manually

software/slaprunner/instance-runner.cfg

@@ -15,6 +15,7 @@ parts =
   slaprunner-promise
   slaprunner-frontend-promise
   dropbear-promise
+  private
   shellinabox-promise
   symlinks
   shellinabox
@@ -541,7 +542,11 @@ frequency = */2 * * * *
 command = $${prepare-software:wrapper-path}
 
 [public]
-recovery-code = $${recovery-code:passwd}
 shell-password = $${shellinabox-code:passwd}
 
+[private]
+recipe = slapos.cookbook:zeroknown.write
+filename = knowledge0.cfg
+recovery-code = $${recovery-code:passwd}
+
 [zero-parameters]