Initial split from Fedora CoreOS
This commit is contained in:
Colin Walters
commit
60d8e77ee4
|
|
@ -0,0 +1,21 @@
|
|||
Copyright 2018 Fedora CoreOS Authors.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
"Software"), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included
|
||||
in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Demonstration base images for use with bootc
|
||||
|
||||
This repository contains "base images" suitable for use with github.com/containers/bootc
|
||||
|
||||
These images are considered experimental. The intention is that these images are
|
||||
generated by the OS vendor or distribution.
|
||||
|
|
@ -0,0 +1,53 @@
|
|||
# This minimal base starts just from: kernel + systemd + rpm-ostree + bootloader.
|
||||
# The intent of this is to inherit from this if you are doing something highly
|
||||
# custom that e.g. might not involve Ignition or podman, but you do want
|
||||
# rpm-ostree.
|
||||
# We expect most people though using coreos-assembler to inherit from
|
||||
# fedora-coreos-base.yaml.
|
||||
packages:
|
||||
# Kernel + systemd.
|
||||
- kernel systemd
|
||||
# linux-firmware now a recommends so let's explicitly include it
|
||||
# https://gitlab.com/cki-project/kernel-ark/-/commit/32271d0cd9bd52d386eb35497c4876a8f041f70b
|
||||
# https://src.fedoraproject.org/rpms/kernel/c/f55c3e9ed8605ff28cb9a922efbab1055947e213?branch=rawhide
|
||||
- linux-firmware
|
||||
# rpm-ostree
|
||||
- rpm-ostree nss-altfiles
|
||||
|
||||
# bootloader
|
||||
packages-aarch64:
|
||||
- grub2-efi-aa64 efibootmgr shim
|
||||
# firmware updates
|
||||
- fwupd
|
||||
packages-ppc64le:
|
||||
- grub2 ostree-grub2
|
||||
# firmware updates
|
||||
- fwupd
|
||||
packages-s390x:
|
||||
# On Fedora, this is provided by s390utils-core. on RHEL, this is for now
|
||||
# provided by s390utils-base, but soon will be -core too.
|
||||
- /usr/sbin/zipl
|
||||
# for Secure Execution
|
||||
- veritysetup
|
||||
packages-x86_64:
|
||||
- grub2 grub2-efi-x64 efibootmgr shim
|
||||
- microcode_ctl
|
||||
# firmware updates
|
||||
- fwupd
|
||||
|
||||
postprocess:
|
||||
# See: https://github.com/coreos/fedora-coreos-tracker/issues/1253
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2112857
|
||||
# https://github.com/coreos/rpm-ostree/issues/3918
|
||||
# Temporary workaround to remove the SetGID binary from liblockfile that is
|
||||
# pulled by the s390utils but not needed for /usr/sbin/zipl.
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
rm -f /usr/bin/dotlockfile
|
||||
|
||||
exclude-packages:
|
||||
# Exclude kernel-debug-core to make sure that it doesn't somehow get
|
||||
# chosen as the package to satisfy the `kernel-core` dependency from
|
||||
# the kernel package.
|
||||
- kernel-debug-core
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# Integration with https://github.com/coreos/bootupd
|
||||
# xref https://github.com/coreos/fedora-coreos-tracker/issues/510
|
||||
packages:
|
||||
- bootupd
|
||||
|
||||
postprocess:
|
||||
- |
|
||||
#!/bin/bash
|
||||
set -xeuo pipefail
|
||||
# Until we have https://github.com/coreos/rpm-ostree/pull/2275
|
||||
mkdir -p /run
|
||||
# Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
|
||||
/usr/bin/bootupctl backend generate-update-metadata /
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
# Note we use baseurl= here because using auto-selected mirrors conflicts with
|
||||
# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
|
||||
|
||||
[fedora-next]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-next-updates]
|
||||
name=Fedora $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-next-updates-testing]
|
||||
name=Fedora $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-next-modular]
|
||||
name=Fedora Modular $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Modular/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Modular/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-next-updates-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-next-updates-testing-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
# Note we use baseurl= here because using auto-selected mirrors conflicts with
|
||||
# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
|
||||
|
||||
[fedora-rawhide]
|
||||
name=Fedora - Rawhide - Developmental packages for the next Fedora release
|
||||
baseurl=http://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/rawhide/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=rawhide&arch=$basearch
|
||||
enabled=1
|
||||
countme=1
|
||||
metadata_expire=6h
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
excludepkgs=kernel kernel-core kernel-modules
|
||||
|
||||
# We are choosing to use only nodebug kernels in Fedora CoreOS
|
||||
# for our testing. We've seen too many issues where an issue either
|
||||
# shows up only on the debug kernels OR a debug kernel gives us a
|
||||
# false positive or negative when trying to root cause a failure.
|
||||
# Thus we use the nodebug kernel repo [1] and includepkgs=kernel
|
||||
# here and excludepkgs=kernel above.
|
||||
#
|
||||
# [1] https://fedoraproject.org/wiki/RawhideKernelNodebug
|
||||
[fedora-rawhide-nodebug-kernel]
|
||||
name=nodebug kernels for Rawhide
|
||||
baseurl=https://dl.fedoraproject.org/pub/alt/rawhide-kernel-nodebug/$basearch/
|
||||
enabled=1
|
||||
countme=1
|
||||
metadata_expire=6h
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=0
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
includepkgs=kernel kernel-core kernel-modules
|
||||
|
|
@ -0,0 +1,76 @@
|
|||
# Note we use baseurl= here because using auto-selected mirrors conflicts with
|
||||
# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
|
||||
|
||||
[fedora]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates]
|
||||
name=Fedora $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing]
|
||||
name=Fedora $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-modular]
|
||||
name=Fedora Modular $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Modular/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Modular/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
# Moving files around and verifying them
|
||||
packages:
|
||||
- git-core
|
||||
- gnupg2
|
||||
- rsync
|
||||
# Explicit dependency on curl because we use it in coreos-livepxe-rootfs.sh
|
||||
# We need curl and not curl-minimal because we support TFTP.
|
||||
- curl
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
root:x:0:
|
||||
bin:x:1:
|
||||
daemon:x:2:
|
||||
sys:x:3:
|
||||
adm:x:4:
|
||||
tty:x:5:
|
||||
disk:x:6:
|
||||
lp:x:7:
|
||||
mem:x:8:
|
||||
kmem:x:9:
|
||||
wheel:x:10:
|
||||
cdrom:x:11:
|
||||
mail:x:12:
|
||||
man:x:15:
|
||||
sudo:x:16:
|
||||
dialout:x:18:
|
||||
floppy:x:19:
|
||||
games:x:20:
|
||||
tape:x:33:
|
||||
video:x:39:
|
||||
ftp:x:50:
|
||||
lock:x:54:
|
||||
audio:x:63:
|
||||
nobody:x:99:
|
||||
users:x:100:
|
||||
ssh_keys:x:999:
|
||||
systemd-journal:x:190:
|
||||
polkitd:x:998:
|
||||
etcd:x:997:
|
||||
dip:x:40:
|
||||
cgred:x:996:
|
||||
avahi-autoipd:x:170:
|
||||
sssd:x:993:
|
||||
dockerroot:x:986:
|
||||
rpcuser:x:29:
|
||||
nfsnobody:x:65534:
|
||||
kube:x:994:
|
||||
chrony:x:992:
|
||||
tcpdump:x:72:
|
||||
ceph:x:167:
|
||||
input:x:104:
|
||||
systemd-timesync:x:991:
|
||||
systemd-network:x:990:
|
||||
systemd-resolve:x:989:
|
||||
systemd-bus-proxy:x:988:
|
||||
cockpit-ws:x:987:
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
remove-from-packages:
|
||||
# The grub bits are mainly designed for desktops, and IMO haven't seen
|
||||
# enough testing in concert with ostree. At some point we'll flesh out
|
||||
# the full plan in https://github.com/coreos/fedora-coreos-tracker/issues/47
|
||||
- [grub2-tools, /etc/grub.d/08_fallback_counting,
|
||||
/etc/grub.d/10_reset_boot_success,
|
||||
/etc/grub.d/12_menu_auto_hide,
|
||||
/usr/lib/systemd/.*]
|
||||
|
|
@ -0,0 +1,12 @@
|
|||
# This file includes a fixup for kdump on aarch64 AWS instances.
|
||||
# The issue seems specific to aarch64 AWS instances, but we'll go
|
||||
# ahead and apply it across the board for aarch64, since that's
|
||||
# the easiest thing to do. Hopefully the upstream issue will get
|
||||
# resolved soon.
|
||||
postprocess:
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
# Remove irqpoll from the list of KDUMP_COMMANDLINE_APPEND. This
|
||||
# causes issues on aarch64 AWS instances.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/1187
|
||||
sed -i -e 's/irqpoll //' /etc/sysconfig/kdump
|
||||
|
|
@ -0,0 +1,202 @@
|
|||
releasever: 37
|
||||
|
||||
repos:
|
||||
- fedora
|
||||
- fedora-updates
|
||||
|
||||
metadata:
|
||||
name: fedora-oscore
|
||||
summary: Fedora OSCore
|
||||
|
||||
# Modern defaults we want
|
||||
boot-location: modules
|
||||
tmp-is-dir: true
|
||||
# This one at least historically broke compatibility with Anaconda, but
|
||||
# let's use it by default now.
|
||||
machineid-compat: false
|
||||
# Be minimal
|
||||
recommends: false
|
||||
|
||||
ignore-removed-users:
|
||||
- root
|
||||
ignore-removed-groups:
|
||||
- root
|
||||
etc-group-members:
|
||||
- wheel
|
||||
- sudo
|
||||
- systemd-journal
|
||||
- adm
|
||||
|
||||
check-passwd:
|
||||
type: "file"
|
||||
filename: "passwd"
|
||||
check-groups:
|
||||
type: "file"
|
||||
filename: "group"
|
||||
|
||||
include:
|
||||
- bootable-rpm-ostree.yaml
|
||||
- file-transfer.yaml
|
||||
- networking-tools.yaml
|
||||
- system-configuration.yaml
|
||||
- user-experience.yaml
|
||||
- shared-workarounds.yaml
|
||||
|
||||
conditional-include:
|
||||
- if: basearch != "s390x"
|
||||
# And remove some cruft from grub2
|
||||
include: grub2-removals.yaml
|
||||
|
||||
remove-from-packages:
|
||||
# Generally we expect other tools to do this (e.g. Ignition or cloud-init)
|
||||
- [systemd, /usr/bin/systemd-firstboot,
|
||||
/usr/lib/systemd/system/systemd-firstboot.service,
|
||||
/usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
|
||||
# We don't want auto-generated mount units. See also
|
||||
# https://github.com/systemd/systemd/issues/13099
|
||||
- [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
|
||||
# Drop some buggy sysusers fragments which do not match static IDs allocation:
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2105177
|
||||
- [dbus-common, /usr/lib/sysusers.d/dbus.conf]
|
||||
|
||||
automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
|
||||
mutate-os-release: "${releasever}"
|
||||
|
||||
packages:
|
||||
# We include this for historical reasons
|
||||
- fedora-repos-ostree
|
||||
# fedora-repos-modular was converted into its own subpackage in f33
|
||||
# Continue to include it in case users want to use it.
|
||||
- fedora-repos-modular
|
||||
# Include and set the default editor
|
||||
- nano nano-default-editor
|
||||
# Security
|
||||
- polkit
|
||||
# Containers
|
||||
- systemd-container catatonit
|
||||
- fuse-overlayfs slirp4netns
|
||||
# support for old style CNI networks and name resolution for
|
||||
# podman containers with CNI networks
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/519
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071338097
|
||||
- containernetworking-plugins podman-plugins dnsmasq
|
||||
# For podman v4 netavark gets pulled in but it only recommends
|
||||
# aardvark-dns (which provides name resolution based on container
|
||||
# names). This functionality was previously provided by dnsname from
|
||||
# podman-plugins in the podman v3 stack.
|
||||
# See https://github.com/containers/netavark/pull/217
|
||||
- aardvark-dns
|
||||
# Since we need `containernetworking-plugins` installed to continue
|
||||
# to support CNI networks we need to also explicitly install
|
||||
# `netavark` so we get both of them installed since both of them
|
||||
# provide `container-network-stack`.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717
|
||||
- netavark
|
||||
# Minimal NFS client
|
||||
- nfs-utils-coreos
|
||||
# Active Directory support
|
||||
- adcli
|
||||
# Additional firewall support; we aren't including these in RHCOS or they
|
||||
# don't exist in RHEL
|
||||
- iptables-nft iptables-services
|
||||
# WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362
|
||||
- wireguard-tools
|
||||
# Storage
|
||||
- btrfs-progs
|
||||
- WALinuxAgent-udev
|
||||
# Allow communication between sudo and SSSD
|
||||
# for caching sudo rules by SSSD.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/445
|
||||
- libsss_sudo
|
||||
# SSSD; we only ship a subset of the backends
|
||||
- sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
|
||||
# Used by admins interactively
|
||||
- attr
|
||||
- openssl
|
||||
- lsof
|
||||
# Provides terminal tools like clear, reset, tput, and tset
|
||||
- ncurses
|
||||
# file-transfer: note fuse-sshfs is not in RHEL
|
||||
# so we can't put it in file-transfer.yaml
|
||||
- fuse-sshfs
|
||||
# Improved MOTD experience
|
||||
- console-login-helper-messages-motdgen
|
||||
# i18n
|
||||
- kbd
|
||||
# zram-generator (but not zram-generator-defaults) for F33 change
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/509
|
||||
- zram-generator
|
||||
# resolved was broken out to its own package in rawhide/f35
|
||||
- systemd-resolved
|
||||
# In F35+ need `iptables-legacy` package
|
||||
# See https://github.com/coreos/fedora-coreos-tracker/issues/676#issuecomment-928028451
|
||||
- iptables-legacy
|
||||
|
||||
# Include the qemu-user-static-x86 package on aarch64 and s390x FCOS images
|
||||
# to allow access to the large inventory of containers only built for x86_64.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/1237
|
||||
packages-x86_64:
|
||||
- irqbalance
|
||||
packages-ppc64le:
|
||||
- irqbalance
|
||||
- librtas
|
||||
- powerpc-utils-core
|
||||
- ppc64-diag-rtas
|
||||
packages-aarch64:
|
||||
- irqbalance
|
||||
- qemu-user-static-x86
|
||||
packages-s390x:
|
||||
- qemu-user-static-x86
|
||||
|
||||
# See https://github.com/coreos/bootupd
|
||||
arch-include:
|
||||
x86_64: bootupd.yaml
|
||||
aarch64: bootupd.yaml
|
||||
|
||||
postprocess:
|
||||
# Undo RPM scripts enabling units; we want the presets to be canonical
|
||||
# https://github.com/projectatomic/rpm-ostree/issues/1803
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
rm -rf /etc/systemd/system/*
|
||||
systemctl preset-all
|
||||
rm -rf /etc/systemd/user/*
|
||||
systemctl --user --global preset-all
|
||||
# Default to iptables-nft. Otherwise, legacy wins. We can drop this once/if we
|
||||
# remove iptables-legacy. This is needed because alternatives don't work
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/677
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/676
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
ln -sf /usr/sbin/ip6tables-nft /etc/alternatives/ip6tables
|
||||
ln -sf /usr/sbin/ip6tables-nft-restore /etc/alternatives/ip6tables-restore
|
||||
ln -sf /usr/sbin/ip6tables-nft-save /etc/alternatives/ip6tables-save
|
||||
ln -sf /usr/sbin/iptables-nft /etc/alternatives/iptables
|
||||
ln -sf /usr/sbin/iptables-nft-restore /etc/alternatives/iptables-restore
|
||||
ln -sf /usr/sbin/iptables-nft-save /etc/alternatives/iptables-save
|
||||
|
||||
# Things we don't expect to ship on the host. We currently
|
||||
# have recommends: false so these could only come in via
|
||||
# hard requirement, in which case the build will fail.
|
||||
exclude-packages:
|
||||
- python
|
||||
- python2
|
||||
- python2-libs
|
||||
- python3
|
||||
- python3-libs
|
||||
- perl
|
||||
- perl-interpreter
|
||||
- nodejs
|
||||
- grubby
|
||||
- cowsay # Just in case
|
||||
# Let's make sure initscripts doesn't get pulled back in
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
|
||||
- initscripts
|
||||
# For (datacenter/cloud oriented) servers, we want to see the details by default.
|
||||
# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/
|
||||
- plymouth
|
||||
# Do not use legacy ifcfg config format in NetworkManager
|
||||
# See https://github.com/coreos/fedora-coreos-config/pull/1991
|
||||
- NetworkManager-initscripts-ifcfg-rh
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
# This defines a set of tools that are useful for configuring, debugging,
|
||||
# or manipulating the network of a system. It is desired to keep this list
|
||||
# generic enough to be shared downstream with RHCOS.
|
||||
|
||||
packages:
|
||||
# Standard tools for configuring network/hostname
|
||||
- NetworkManager hostname
|
||||
# Interactive Networking configuration during coreos-install
|
||||
- NetworkManager-tui
|
||||
# Teaming https://github.com/coreos/fedora-coreos-config/pull/289
|
||||
# and http://bugzilla.redhat.com/1758162
|
||||
- NetworkManager-team teamd
|
||||
# Support for cloud quirks and dynamic config in real rootfs:
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/320
|
||||
- NetworkManager-cloud-setup
|
||||
# Route manipulation and QoS
|
||||
- iproute iproute-tc
|
||||
# Firewall manipulation
|
||||
- iptables nftables
|
||||
# Interactive network tools for admins
|
||||
- socat net-tools bind-utils
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
adm:x:3:4:adm:/var/adm:/usr/sbin/nologin
|
||||
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/usr/sbin/nologin
|
||||
bin:x:1:1:bin:/bin:/usr/sbin/nologin
|
||||
ceph:x:167:167:Ceph daemons:/var/lib/ceph:/usr/sbin/nologin
|
||||
chrony:x:994:992::/var/lib/chrony:/usr/sbin/nologin
|
||||
cockpit-ws:x:988:987:User for cockpit-ws:/:/usr/sbin/nologin
|
||||
daemon:x:2:2:daemon:/sbin:/usr/sbin/nologin
|
||||
dbus:x:81:81:System Message Bus:/:/usr/sbin/nologin
|
||||
dockerroot:x:997:986:Docker User:/var/lib/docker:/usr/sbin/nologin
|
||||
etcd:x:998:997:etcd user:/var/lib/etcd:/usr/sbin/nologin
|
||||
ftp:x:14:50:FTP User:/var/ftp:/usr/sbin/nologin
|
||||
games:x:12:100:games:/usr/games:/usr/sbin/nologin
|
||||
halt:x:7:0:halt:/sbin:/sbin/halt
|
||||
kube:x:996:994:Kubernetes user:/:/usr/sbin/nologin
|
||||
lp:x:4:7:lp:/var/spool/lpd:/usr/sbin/nologin
|
||||
mail:x:8:12:mail:/var/spool/mail:/usr/sbin/nologin
|
||||
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/usr/sbin/nologin
|
||||
nobody:x:99:99:Kernel Overflow User:/:/usr/sbin/nologin
|
||||
operator:x:11:0:operator:/root:/usr/sbin/nologin
|
||||
polkitd:x:999:998:User for polkitd:/:/usr/sbin/nologin
|
||||
root:x:0:0:Super User:/root:/bin/bash
|
||||
rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
|
||||
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
|
||||
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
|
||||
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
|
||||
sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
|
||||
sync:x:5:0:sync:/sbin:/bin/sync
|
||||
systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
|
||||
systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
|
||||
systemd-resolve:x:990:989:systemd Resolver:/:/usr/sbin/nologin
|
||||
systemd-timesync:x:993:991:systemd Time Synchronization:/:/usr/sbin/nologin
|
||||
tcpdump:x:72:72::/:/usr/sbin/nologin
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
# This manifest is a list of shared workarounds that are needed in both Fedora CoreOS
|
||||
# and downstreams (i.e. Red Hat CoreOS).
|
||||
|
||||
postprocess:
|
||||
# Put in the fix for multipathd.service in dracut on releases that haven't
|
||||
# been fixed yet.
|
||||
# https://github.com/dracutdevs/dracut/pull/1606
|
||||
# https://github.com/coreos/fedora-coreos-config/pull/1233
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
source /etc/os-release
|
||||
# This has landed in Fedora but not in any version of RHEL yet
|
||||
if [[ ${ID} != "rhel" ]]; then
|
||||
exit 0
|
||||
fi
|
||||
mkdir /usr/lib/dracut/modules.d/36coreos-multipath-fix
|
||||
cat > /usr/lib/dracut/modules.d/36coreos-multipath-fix/90-multipathd-remove-execstop.conf <<'EOF'
|
||||
# Temporary workaround for https://github.com/dracutdevs/dracut/pull/1606.
|
||||
[Service]
|
||||
ExecStop=
|
||||
EOF
|
||||
cat > /usr/lib/dracut/modules.d/36coreos-multipath-fix/module-setup.sh <<'EOF'
|
||||
#!/bin/bash
|
||||
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
|
||||
# ex: ts=8 sw=4 sts=4 et filetype=sh
|
||||
install() {
|
||||
# Temporary workaround for https://github.com/dracutdevs/dracut/pull/1606.
|
||||
mkdir -p "$systemdsystemunitdir/multipathd.service.d"
|
||||
inst_simple "$moddir/90-multipathd-remove-execstop.conf" \
|
||||
"$systemdsystemunitdir/multipathd.service.d/90-multipathd-remove-execstop.conf"
|
||||
}
|
||||
EOF
|
||||
chmod +x /usr/lib/dracut/modules.d/36coreos-multipath-fix/module-setup.sh
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# These are packages that are related to configuring parts of the system.
|
||||
# It is intended to be kept generic so that it may be shared downstream with
|
||||
# RHCOS.
|
||||
|
||||
packages:
|
||||
# Configuring SSH keys, cloud provider check-in, etc
|
||||
# TODO: needs Ignition kargs
|
||||
# - afterburn afterburn-dracut
|
||||
# NTP support
|
||||
- chrony
|
||||
# Storage configuration/management
|
||||
## cloud-utils-growpart - For growing root partition
|
||||
- cifs-utils
|
||||
- cloud-utils-growpart
|
||||
- cryptsetup
|
||||
- device-mapper-multipath
|
||||
- e2fsprogs
|
||||
- iscsi-initiator-utils
|
||||
- lvm2
|
||||
- mdadm
|
||||
- sg3_utils
|
||||
- xfsprogs
|
||||
# User configuration
|
||||
- passwd
|
||||
- shadow-utils
|
||||
- acl
|
||||
# SELinux policy
|
||||
- selinux-policy-targeted
|
||||
# There are things that write outside of the journal still (such as the
|
||||
# classic wtmp, etc.). auditd also writes outside the journal but it has its
|
||||
# own log rotation.
|
||||
# Anything package layered will also tend to expect files dropped in
|
||||
# /etc/logrotate.d to work. Really, this is a legacy thing, but if we don't
|
||||
# have it then people's disks will slowly fill up with logs.
|
||||
- logrotate
|
||||
# Boost starving threads
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/753
|
||||
- stalld
|
||||
- ssh-key-dir
|
||||
|
||||
postprocess:
|
||||
# Make kdump work on firstboot
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
# Make kdump ignore `ignition.firstboot` when copying kargs from
|
||||
# the running kernel to the kdump kernel when passing to be kexec.
|
||||
# This makes it so kdump can be set up on the very first boot.
|
||||
# Upstream request to have this upstream so we can stop carrying it here:
|
||||
# https://lists.fedoraproject.org/archives/list/kexec@lists.fedoraproject.org/thread/5P4WIJLW2TSGF4PZGRZGOXYML4RXZU23/
|
||||
sed -i -e 's/KDUMP_COMMANDLINE_REMOVE="/KDUMP_COMMANDLINE_REMOVE="ignition.firstboot /' /etc/sysconfig/kdump
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
# This file is included in RHEL CoreOS, see
|
||||
# https://github.com/openshift/os/blob/71c974b1e456292033e3ef3fe7bcfe17d1855ebc/manifest.yaml#L12
|
||||
# Only apply changes here that should apply to both FCOS and RHCOS.
|
||||
|
||||
# Default to `bash` in our container, the same as other containers we ship.
|
||||
container-cmd:
|
||||
- /usr/bin/bash
|
||||
|
||||
# These packages are either widely used utilities/services or
|
||||
# are targeted for improving the general CoreOS user experience.
|
||||
# It is intended to be kept generic so that it may be shared downstream with
|
||||
# RHCOS.
|
||||
packages:
|
||||
# Basic user tools
|
||||
## jq - parsing/interacting with JSON data
|
||||
- bash-completion
|
||||
- coreutils
|
||||
- file
|
||||
- jq
|
||||
- less
|
||||
- sudo
|
||||
- vim-minimal
|
||||
# File compression/decompression
|
||||
## bsdtar - dependency of 35coreos-live dracut module
|
||||
- bsdtar
|
||||
- bzip2
|
||||
- gzip
|
||||
- tar
|
||||
- xz
|
||||
- zstd
|
||||
# Improved MOTD experience
|
||||
- console-login-helper-messages-issuegen
|
||||
- console-login-helper-messages-profile
|
||||
# kdump support
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/622
|
||||
- kexec-tools
|
||||
# Remote Access
|
||||
- openssh-clients openssh-server
|
||||
# Container tooling
|
||||
- crun
|
||||
- podman
|
||||
- runc
|
||||
- skopeo
|
||||
- toolbox
|
||||
# nvme-cli for managing nvme disks
|
||||
- nvme-cli
|
||||
Loading…
Reference in New Issue