Comment 2 for bug 1606487

Bootstrapping itself succeeds as Juju just ignores the warning. My understanding that "$old_mirror" in the "sed" command only covers archive.ubuntu.com, not security.ubuntu.com.
https://github.com/juju/juju/blob/juju-2.0-beta13/cloudconfig/cloudinit/cloudinit_ubuntu.go#L151-L158

$ juju bootstrap --config config.yaml localhost lxd --debug
...
logging to /var/log/cloud-init-output.log on remote host
Changing apt mirror to http://10.0.8.78/mirror/archive.ubuntu.com/ubuntu
Running apt-get update
Running apt-get upgrade
Installing package: curl
Installing package: cpu-checker
Installing package: bridge-utils
Installing package: cloud-utils
Installing package: cloud-image-utils
Installing package: tmux
Fetching tools: curl -sSfw 'tools from %{url_effective} downloaded: HTTP %{http_code}; time %{time_total}s; size %{size_download} bytes; speed %{speed_download} bytes/s ' --retry 10 -o $bin/tools.tar.gz <[http://10.0.8.78/mirror/juju/tools/agent/2.0-beta13/juju-2.0-beta13-xenial-amd64.tgz]>
Bootstrapping Juju machine agent
Starting Juju machine agent (jujud-machine-0)
...

[/etc/apt/sources.list in the controller]
...
deb http://10.0.8.78/mirror/archive.ubuntu.com/ubuntu xenial main restricted
deb-src http://10.0.8.78/mirror/archive.ubuntu.com/ubuntu xenial main restricted
...
deb http://security.ubuntu.com/ubuntu xenial-security main restricted
deb-src http://security.ubuntu.com/ubuntu xenial-security main restricted
...