Merge branch 'custom-base-more3' into 'wip-baseimage-rework'

two small patches

See merge request fedora/bootc/base-images!92

.gitlab-ci.yml

@@ -1,12 +1,25 @@
----
-include:
-  - remote: https://gitlab.com/platform-engineering-org/gitlab-ci/-/raw/main/templates/build-image.gitlab-ci.yml
+stages:
+  - build
 
-build-image:
+variables:
+  IMAGE_PREFIX: ${CI_REGISTRY}/${CI_PROJECT_PATH}
+
+.build-image:
+  stage: build
+  image: quay.io/buildah/stable:v1.38.1
+  needs: []
+
+build:
   extends: .build-image
-  variables:
-    EXTRA_ARGS: "--security-opt=label=disable --cap-add=all"
-  rules:
-    - if: $CI_PROJECT_NAMESPACE != "fedora/bootc"
-      when: never
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  stage: build
+  script: |
+    set -xeuo pipefail
+    curl -L --fail -o /etc/yum.repos.d/coreos-continuous.repo https://copr.fedorainfracloud.org/coprs/g/CoreOS/continuous/repo/fedora-42/group_CoreOS-continuous-fedora-42.repo
+    dnf -y install rpm-ostree
+    cd base
+    buildah build "${hostbuildopts[@]}" -f Containerfile --no-cache --security-opt=label=disable --cap-add=all --device /dev/fuse -t ${IMAGE_PREFIX}-base:tmp .
+    # Rechunk
+    rpm-ostree experimental compose build-chunked-oci --bootc --format-version=1 \
+           --from=${IMAGE_PREFIX}-base:tmp --output containers-storage:${IMAGE_PREFIX}-base
+    cd ..
+    buildah build "${hostbuildopts[@]}" -f Containerfile --no-cache --from ${IMAGE_PREFIX}-base -t ${IMAGE_PREFIX}-standard:tmp .

Containerfile

@@ -1,46 +1,18 @@
-# This container build uses some special features of podman that allow
-# a process executing as part of a container build to generate a new container
-# image "from scratch".
-#
-# This container build uses nested containerization, so you must build with e.g.
-# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
-#
-# # Why are we doing this?
-#
-# Today this base image build process uses rpm-ostree.  There is a lot of things that
-# rpm-ostree does when generating a container image...but important parts include:
-#
-# - auto-updating labels in the container metadata
-# - Generating "chunked" content-addressed reproducible image layers (notice
-#   how there are ~60 layers in the generated image)
-#
-# The latter bit in particular is currently impossible to do from Containerfile.
-# A future goal is adding some support for this in a way that can be honored by
-# buildah (xref https://github.com/containers/podman/discussions/12605)
-#
-# # Why does this build process require additional privileges?
-#
-# Because it's generating a base image and uses containerbuildcontextization features itself.
-# In the future some of this can be lifted.
+# This generates the "standard" base image, deriving from the minimal base.
 
-FROM quay.io/fedora/fedora:rawhide as repos
-
-FROM quay.io/centos-bootc/bootc-image-builder:latest as builder
-ARG MANIFEST=fedora-bootc.yaml
-COPY --from=repos /etc/dnf/vars /etc/dnf/vars
-COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg
-# The input git repository has .repo files committed to git rpm-ostree has historically
-# emphasized that.  But here, we are fetching the repos from the container base image.
-# So copy the source, and delete the hardcoded ones in git, and use the container base
-# image ones.  We can drop the ones commited to git when we hard switch to Containerfile.
-COPY . /src
-WORKDIR /src
-RUN rm -vf /src/*.repo
-COPY --from=repos /etc/yum.repos.d/*.repo /src
-RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rpm-ostree compose image \
- --image-config fedora-bootc-config.json --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} /buildcontext/out.ociarchive
-
-FROM oci-archive:./out.ociarchive
-# Need to reference builder here to force ordering. But since we have to run
-# something anyway, we might as well cleanup after ourselves.
-RUN --mount=type=bind,from=builder,src=.,target=/var/tmp --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rm /buildcontext/out.ociarchive
+# This is a local reference by default because we haven't shipped this image yet.
+FROM localhost/fedora-bootc:base
+# Copy in our configuration and build scripts. Most of the heavy lifting
+# is in `stage-install` which we emit into /usr/share/doc so it can be
+# used as a reference in other images.
+COPY usr/ /usr/
+RUN <<EORUN
+set -xeuo pipefail
+# This script installs our default packages. These scripts
+# are not a stable API, but may become one in the future.
+/usr/share/doc/bootc-image-standard/stage-install
+# Cleanup
+/usr/share/doc/bootc-image-standard/stage-clean
+# And lint.
+bootc container lint --fatal-warnings
+EORUN

README.md

@@ -9,25 +9,56 @@ been extremely successful. This project aims to apply the same technique for
 bootable host systems - using standard OCI/Docker containers as a transport and
 delivery format for base operating system updates.
 
-## Building
+## Building images
 
-First, the expectation is that most users will want to build *layered* images
-on top of the official base images. See the documentation[5] for more info.
+The current default user experience is to build *layered* images on top of the official
+binary base images produced and tested by this project. See the documentation[5] for more info.
 
-Building the images in this repo can be done with `podman build` as with any
-other application image (note that building with `docker` is not currently
-supported). You need to enable some privileges for technical reasons.
+You can build custom base images by forking this repository; however,
+https://gitlab.com/fedora/bootc/tracker/-/issues/32 tracks a more supportable
+mechanism that is not simply forking. For more information see[6].
+
+## Build process
+
+Building the images in this repo can be done with `podman build`, but
+note the build process uses a special podman-ecosystem specific mechanism
+to create fully custom images while inside a `Containerfile`.
+You need to enable some privileges as nested containerization is required.
 
 ```
 podman build --security-opt=label=disable --cap-add=all \
   --device /dev/fuse -t localhost/fedora-bootc .
 ```
 
-See the `Containerfile` for more details.
+See the `Containerfile` for more details. This builds the default `tier-1` image.
+
+## Fedora versions
+
+By default, the base images are built for Fedora rawhide. To build against a
+different Fedora version, you can override the `FROM` image used to obtain the
+Fedora repos and dnf variables. E.g.:
+
+```
+podman build --from quay.io/fedora/fedora:41 ...
+```
+
+### Deriving
 
 You are of course also free to fork, customize, and build base images yourself.
 See this page[6] of the documentation for more information.
 
+## Images
+
+At the current time, there is just one reference base image published
+to the registry. There is a `Containerfile.base` which produces a
+quite minimal base image, from which the default image derives.
+
+More on the history from [this tracker issue](https://gitlab.com/fedora/bootc/tracker/-/issues/32).
+
+- Containefile.base: A base image with the effective equivalent of installing `bootc kernel systemd dnf`
+  with "recommends" off. Intended as a derivation starting point for minimal systems.
+- Containerfile: Produces the default much larger image; somewhat similar to CoreOS.
+
 ## More information
 
 Documentation: <https://docs.fedoraproject.org/en-US/bootc/>

base/Containerfile

@@ -0,0 +1,46 @@
+# This is a relatively minimal base image build; it's intended as a derivation
+# point.
+#
+# This container build uses nested containerization to construct
+# a target rootfs from scratch; so you must build with e.g.
+# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
+
+# If you want to configure the input rpm-md repositories, just override this
+# container image.
+FROM quay.io/fedora/fedora:rawhide as repos
+
+# We use stream10 to demonstrate that we support "cross builds".
+FROM quay.io/centos/centos:stream10 as builder
+RUN <<EORUN
+set -xeuo pipefail
+# For rpm-ostree v2025.5
+curl -L -o /etc/yum.repos.d/coreos-continuous.repo https://copr.fedorainfracloud.org/coprs/g/CoreOS/continuous/repo/centos-stream-10/group_CoreOS-continuous-centos-stream-10.repo
+dnf -y install rpm-ostree selinux-policy-targeted sqlite
+EORUN
+# Copy in our source code.
+COPY . /src
+WORKDIR /src
+RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw <<EORUN
+set -xeuo pipefail
+# Copy the build configuration into the builder image, as if it's the final image
+cp -a . /usr/lib/sysimage/base-image-manifest
+# And embed the rebuild script
+install -m 0755 -t /usr/libexec ./bootc-base-image-rebuild-self
+# Finally, run the build script in the same way we expect custom images to do.
+/usr/libexec/bootc-base-image-rebuild-self /repos /target-rootfs
+EORUN
+
+# This pulls in the rootfs generated in the previous step
+FROM scratch
+COPY --from=builder /target-rootfs/ /
+LABEL containers.bootc 1
+# This is an ad-hoc way for us to reference bootc-image-builder in
+# a way that in theory client tooling can inspect and find. Today
+# it isn't widely used.
+LABEL bootc.diskimage-builder quay.io/centos-bootc/bootc-image-builder
+# https://pagure.io/fedora-kiwi-descriptions/pull-request/52
+ENV container=oci
+# Make systemd the default
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]
+

base/Makefile

@@ -0,0 +1,2 @@
+install:
+	install -m 0755 -t $(DESTDIR)/usr/libexec bootc-base-image-rebuild-self

base/basic-fixes.yaml

@@ -23,7 +23,7 @@ postprocess:
     # tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't
     # work if we want to use tmpfiles.d to write to `/root/.ssh` because
     # tmpfiles gives up on that before getting to `/var/roothome`.
-    sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
+    sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
     # Because /var/roothome is also defined in rpm-ostree-0-integration.conf
     # we need to delete /var/roothome
-    sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
+    sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf

base/bootc-base-image-rebuild-self

@@ -0,0 +1,17 @@
+#!/bin/bash
+# This script regenerates this base image using a build
+# configuration (list of packages, scripts) embedded in this current image.
+# The actual *content* packages will come from the source root.
+set -xeuo pipefail
+source_root=$1
+shift
+target=$1
+shift
+if ! test -x /usr/bin/rpm-ostree; then
+    dnf -y install rpm-ostree
+fi
+rpm-ostree experimental compose rootfs --source-root-rw=$source_root /usr/lib/sysimage/base-image-manifest/manifest.yaml $target
+# Finally, propagate the configuration and build script into the target root.
+for f in /usr/lib/sysimage/base-image-manifest /usr/libexec/bootc-base-image-rebuild-self; do
+    cp -a $f $target/$f
+done

base/bootc-base-image-rebuild-self.md

@@ -0,0 +1,83 @@
+# bootc-base-image-rebuild-self
+
+A core premise of the bootc model is that rich
+control over Linux system customization can be accomplished
+with a "default" container build:
+
+```
+FROM <base image>
+RUN ...
+```
+
+As of recently, it is possible to e.g. swap the kernel
+and other fundamental components as part of default derivation.
+
+## Understanding the base image content
+
+Most, but not all content from the base image comes from RPMs.
+There is some additional non-RPM content, as well as postprocessing
+that operates on the filesystem root. At the current
+time the implementation of the base image build uses `rpm-ostree`,
+but this is considered an implementation detail subject to change.
+
+## Rebuilding from externally controlled content
+
+Some use cases want even more control - for example,
+as an organization deploying a bootc system, I may want to ensure
+the base image version carries a set of packages at
+exactly specific versions (perhaps defined by a lockfile,
+or an rpm-md repository). There are many tools which
+manage snapshots of yum (rpm-md) repositories.
+
+The `/usr/libexec/bootc-base-image-rebuild-self` which is
+included in the base image is designed to enable this
+level of control.
+
+## Using bootc-base-image-rebuild-self
+
+This tool takes just two arguments:
+
+- A "repository configuration root" which should have an `/etc/yum.repos.d`
+  that defines the input RPM content.
+- A path to the target root filesystem which will be generated
+
+### Implementation
+
+The current implementation uses `rpm-ostree` on a manifest (treefile)
+embedded in the container image itself. The set of packages installed
+is currently not configurable; however it is quite minimal and can
+easily be customized further as we will see below.
+
+The build tooling is designed to support "cross builds"; the
+repository root could e.g. be CentOS Stream 10, while the
+builder root is Fedora or RHEL, etc. In other words, one given
+base image can be used as a "builder" to produce another
+using different RPMs.
+
+### Example: Generate a new image using CentOS Stream 10 content from RHEL
+
+FROM quay.io/centos/centos:stream10 as repos
+
+FROM registry.redhat.io/rhel10/rhel-bootc:10 as builder
+RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw /usr/libexec/bootc-base-image-rebuild-self /repos /target-rootfs
+
+# This container image uses the "artifact pattern"; it has some
+# basic configuration we expect to apply to multiple container images.
+FROM quay.io/exampleos/baseconfig@sha256:.... as baseconfig
+
+FROM scratch
+COPY --from=builder /target-rootfs/ /
+# Now we make other arbitrary changes. Copy our systemd units and
+# other tweaks from the baseconfig container image.
+COPY --from=baseconfig /usr/ /usr/
+RUN <<EORUN
+set -xeuo pipefail
+# Install critical components
+dnf -y install linux-firmware NetworkManager cloud-init cowsay
+dnf clean all
+bootc container lint
+EORUN
+LABEL containers.bootc 1
+ENV container=oci
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]

base/bootc.yaml

@@ -0,0 +1,11 @@
+# The bootc components.
+packages:
+ - systemd
+ - bootc
+ # bootc pulls in podman, which pulls in containers-common, which wants
+ # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
+ # iptables-nft instead to satisfy it.
+ - iptables-nft
+ # Required by bootc install, sgdisk has been replaced by Rust crate
+ # in bootc https://github.com/containers/bootc/pull/775
+ - xfsprogs e2fsprogs dosfstools

base/bootupd.yaml

@@ -9,9 +9,8 @@ packages-aarch64:
 packages-ppc64le:
   - grub2 ostree-grub2
 packages-s390x:
-  # On Fedora, this is provided by s390utils-core. on RHEL, this is for now
-  # provided by s390utils-base, but soon will be -core too.
-  - /usr/sbin/zipl
+  # For zipl
+  - s390utils-core
 packages-x86_64:
   - grub2 grub2-efi-x64 efibootmgr shim
   - microcode_ctl
@@ -25,7 +24,5 @@ postprocess:
   - |
     #!/bin/bash
     set -xeuo pipefail
-    # Until we have https://github.com/coreos/rpm-ostree/pull/2275
-    mkdir -p /run
     # Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
     /usr/bin/bootupctl backend generate-update-metadata

base/finalize.d/01-var.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# https://gitlab.com/fedora/bootc/base-images/-/issues/28
+set -xeuo pipefail
+ln -s ../run var/run
+# https://gitlab.com/fedora/bootc/tracker/-/issues/58
+mkdir -p var/lib/rpm-state

base/finalize.d/05-rpmdb.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+set -euo pipefail
+# https://github.com/coreos/rpm-ostree/pull/5244
+# 
+sysimage_rpmdb=usr/lib/sysimage/rpm/rpmdb.sqlite
+rpmostree_rpmdb_dir=usr/share/rpm
+rpmostree_rpmdb="${rpmostree_rpmdb_dir}/rpmdb.sqlite"
+rpmostree_base_rpmdb_dir=usr/lib/sysimage/rpm-ostree-base-db
+rpmostree_base_rpmdb="${rpmostree_base_rpmdb_dir}/rpmdb.sqlite"
+pragma='PRAGMA journal_mode=delete;'
+
+# Forcibly delete this because ostree hardlinking the sqlite databases
+# confuses rpm. This will cause rpm-ostree to enter a fallback
+# mode with package layering, but that's OK.
+if test -d "${rpmostree_base_rpmdb_dir}"; then
+    echo "Removing ${rpmostree_base_rpmdb_dir}"
+    rm "${rpmostree_base_rpmdb_dir}" -rf
+fi
+for path in ${sysimage_rpmdb} ${rpmostree_rpmdb}; do
+    if test -f "${path}-shm"; then
+        echo "Executing in ${path}: ${pragma}"
+        sqlite3 "${path}" "${pragma}" >/dev/null
+    fi
+done

base/initramfs.yaml

@@ -6,13 +6,19 @@ postprocess:
     cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
     # We want a generic image; hostonly makes no sense as part of a server side build
     hostonly=no
-    dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
+    add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
     # Extra modules that we want by default that are known to exist in the kernel
-    dracutmodules+=" virtiofs "
+    add_dracutmodules+=" virtiofs "
     EOF
     cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
     # We want this for systemd-cryptsetup tpm2 locking
-    dracutmodules+=" tpm2-tss "
+    add_dracutmodules+=" tpm2-tss "
+    EOF
+    cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF'
+    # https://issues.redhat.com/browse/RHEL-49590
+    # On image mode systems we use nss-altfiles for passwd and group,
+    # this makes sure dracut uses them which also fixes kdump writing to NFS.
+    install_items+=" /usr/lib/passwd /usr/lib/group "
     EOF

base/kernel-install.yaml

@@ -0,0 +1,24 @@
+# Configuration to enable kernel-install integration
+postprocess:
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    source /usr/lib/os-release
+    # Check if the ID is Fedora and VERSION_ID is 42 or higher
+    if [[ "$ID" == "fedora" && "$VERSION_ID" -ge 42 ]]; then
+        echo -e "# kernel-install will not try to run dracut and allow rpm-ostree to\n\
+    # take over. Rpm-ostree will use this to know that it is responsible\n\
+    # to run dracut and ensure that there is only one kernel in the image\n\
+    layout=ostree" | tee /usr/lib/kernel/install.conf > /dev/null
+    fi
+    # By default dnf keeps multiple versions of the kernel, with this
+    # configuration we tell dnf to treat the kernel as everything else.
+    # https://dnf.readthedocs.io/en/latest/conf_ref.html#main-options
+    # Let's add the config to a distribution configuration file if dnf5
+    # is used, we append to /etc/dnf/dnf.conf if not.
+    if [ -d "/usr/share/dnf5/libdnf.conf.d/" ]; then
+      echo -e "[main]\ninstallonlypkgs=''" >> /usr/share/dnf5/libdnf.conf.d/20-ostree-installonlypkgs.conf
+    else
+      echo "installonlypkgs=''" >> /etc/dnf/dnf.conf
+    fi
+

base/manifest.yaml

@@ -0,0 +1,43 @@
+edition: "2024"
+
+# Be minimal
+recommends: false
+
+# Default to `bash` in our container, the same as other containers we ship.
+container-cmd:
+  - /sbin/init
+
+remove-from-packages:
+  # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
+  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
+  # We don't want auto-generated mount units. See also
+  # https://github.com/systemd/systemd/issues/13099
+  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
+
+include:
+  - postprocess-conf.yaml
+  - tmpfiles.yaml
+  - bootc.yaml
+  - bootupd.yaml
+  - ostree.yaml
+  - initramfs.yaml
+  - basic-fixes.yaml
+  - kernel-install.yaml
+  - persistent-journal.yaml
+  - fedora-repos.yaml
+
+packages:
+  # This can be replaced later
+  - kernel
+  # this is implied by dependencies but let's make it explicit
+  - coreutils
+  # We need dnf for building derived container images. In Fedora, this pulls
+  # in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
+  # just `dnf` once the `dnf` package is retired from Fedora.
+  - /usr/bin/dnf
+  # If you don't want SELinux today, you'll need to build a custom image.
+  - selinux-policy-targeted
+  # And we want container-selinux because trying to layer it on later currently causes issues.
+  - container-selinux
+  # Needed for tpm2 bound luks
+  - tpm2-tools

base/ostree.yaml

@@ -1,9 +1,6 @@
 packages:
  - ostree nss-altfiles
 
-# We want content lifecycled with the image
-opt-usrlocal: "root"
-
 postprocess:
   # Set up default root config
   - |

base/passwd

@@ -23,7 +23,7 @@ rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
 rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
 sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
-sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
+sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
 sync:x:5:0:sync:/sbin:/bin/sync
 systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
 systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin

base/postprocess-conf.yaml

@@ -0,0 +1,34 @@
+# This file configures things relevant to `rpm-ostree compose postprocess`.
+
+# We want content lifecycled with the image
+opt-usrlocal: "root"
+
+# https://github.com/CentOS/centos-bootc/issues/167
+machineid-compat: true
+
+# Note that the default for c9s+ is sqlite; we can't rely on rpm being
+# in the target (it isn't in tier-0!) so turn this to host here.  This
+# does break the "hermetic build" aspect a bit.  Maybe eventually
+# what we should do is special case this and actually install RPM temporarily
+# and then remove it...
+rpmdb: host
+
+ignore-removed-users:
+  - root
+ignore-removed-groups:
+  - root
+etc-group-members:
+  - wheel
+  - sudo
+  - systemd-journal
+  - adm
+
+check-passwd:
+  type: "file"
+  filename: "passwd"
+check-groups:
+  type: "file"
+  filename: "group"
+
+automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
+mutate-os-release: "${releasever}"

base/tmpfiles.yaml

@@ -0,0 +1,7 @@
+postprocess:
+  - |
+    #!/bin/bash
+    cat >/usr/lib/tmpfiles.d/bootc-base-rpmstate.conf <<'EOF'
+    # Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
+    d /var/lib/rpm-state 0755 - - -
+    EOF

fedora-bootc-config.json

@@ -1,12 +0,0 @@
-{
-    "Labels": {
-        "containers.bootc": "1",
-        "bootc.diskimage-builder": "quay.io/centos-bootc/bootc-image-builder",
-        "redhat.id": "fedora",
-        "redhat.version-id": "rawhide"
-    },
-    "StopSignal": "SIGRTMIN+3",
-    "Env": [
-        "container=oci"
-    ]
-}

fedora-bootc.yaml

@@ -1,12 +0,0 @@
-releasever: rawhide
-repos:
-  - rawhide
-
-metadata:
-  name: fedora-boot-tier1
-  summary: Fedora Bootable Tier 1
-
-include:
-  - fedora-generic.yaml
-  - tier-1/manifest.yaml
-  - tier-1/kernel.yaml

fedora-tier-0.yaml

@@ -1,12 +0,0 @@
-releasever: rawhide
-repos:
-  - rawhide
-
-metadata:
-  name: fedora-boot-tier0
-  summary: Fedora Bootable Tier 0
-
-include:
-  - fedora-generic.yaml
-  - tier-0/manifest.yaml
-  - tier-0/kernel.yaml

fedora.repo

@@ -1,102 +0,0 @@
-# Note we use baseurl= here because using auto-selected mirrors conflicts with
-# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
-
-[fedora]
-name=Fedora $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[fedora-updates]
-name=Fedora $releasever - $basearch - Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
-enabled=1
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[fedora-updates-testing]
-name=Fedora $releasever - $basearch - Test Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
-enabled=1
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[fedora-modular]
-name=Fedora Modular $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Modular/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Modular/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
-skip_if_unavailable=False
-
-[fedora-updates-modular]
-name=Fedora Modular $releasever - $basearch - Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
-enabled=1
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
-skip_if_unavailable=False
-
-[fedora-updates-testing-modular]
-name=Fedora Modular $releasever - $basearch - Test Updates
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
-        https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
-enabled=1
-gpgcheck=1
-metadata_expire=6h
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[rawhide]
-name=Fedora - Rawhide - Developmental packages for the next Fedora release
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False
-
-[fedora-devel]
-name=Fedora $releasever - $basearch
-baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
-        https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
-#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
-enabled=1
-#metadata_expire=7d
-repo_gpgcheck=0
-type=rpm
-gpgcheck=1
-gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
-skip_if_unavailable=False

renovate.json

@@ -3,12 +3,17 @@
   "extends": [
     "github>platform-engineering-org/.github"
   ],
-  "baseBranches": ["main", "f40"],
+  "baseBranches": ["main", "f40", "f41"],
   "packageRules": [
     {
       "matchPackageNames": ["quay.io/fedora/fedora"],
       "allowedVersions": "=40",
       "matchBaseBranches": ["f40"]
+    },
+    {
+      "matchPackageNames": ["quay.io/fedora/fedora"],
+      "allowedVersions": "=41",
+      "matchBaseBranches": ["f41"]
     }
   ]
 }

tier-0/autoupdates.yaml

@@ -1,9 +0,0 @@
-# Enable automatic updates by default
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    set -euo pipefail
-    target=/usr/lib/systemd/system/default.target.wants
-    mkdir -p $target
-    set -x
-    ln -s ../bootc-fetch-apply-updates.timer $target

tier-0/bootc.yaml

@@ -1,12 +0,0 @@
-# The bootc components.
-packages:
- - systemd
- - bootc
- # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
- - gdisk xfsprogs e2fsprogs dosfstools
-
-exclude-packages:
-  # Exclude kernel-debug-core to make sure that it doesn't somehow get
-  # chosen as the package to satisfy the `kernel-core` dependency from
-  # the kernel package.
-  - kernel-debug-core

tier-0/kernel-rt.yaml

@@ -1,10 +0,0 @@
-repos:
-  - rt
-  - nfv
-
-# Enable the "realtime" AKA soft-realtime AKA latency-optimized kernel.
-packages:
- - kernel-rt-core kernel-rt-modules kernel-rt-modules-extra kernel-rt-kvm
-
-exclude-packages:
-  - kernel-rt-debug-core

tier-0/manifest.yaml

@@ -1,68 +0,0 @@
-
-# Modern defaults we want
-boot-location: modules
-tmp-is-dir: true
-# https://github.com/CentOS/centos-bootc/issues/167
-machineid-compat: true
-# Be minimal
-recommends: false
-
-ignore-removed-users:
-  - root
-ignore-removed-groups:
-  - root
-etc-group-members:
-  - wheel
-  - sudo
-  - systemd-journal
-  - adm
-
-# Default to `bash` in our container, the same as other containers we ship.
-container-cmd:
-  - /sbin/init
-
-# Note that the default for c9s+ is sqlite; we can't rely on rpm being
-# in the target (it isn't in tier-0!) so turn this to host here.  This
-# does break the "hermetic build" aspect a bit.  Maybe eventually
-# what we should do is special case this and actually install RPM temporarily
-# and then remove it...
-rpmdb: host
-
-check-passwd:
-  type: "file"
-  filename: "passwd"
-check-groups:
-  type: "file"
-  filename: "group"
-
-automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
-mutate-os-release: "${releasever}"
-
-remove-from-packages:
-  # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
-  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
-  # We don't want auto-generated mount units. See also
-  # https://github.com/systemd/systemd/issues/13099
-  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
-  # Drop some buggy sysusers fragments which do not match static IDs allocation:
-  # https://bugzilla.redhat.com/show_bug.cgi?id=2105177
-  - [dbus-common, /usr/lib/sysusers.d/dbus.conf]
-
-include:
-  - bootc.yaml
-  - bootupd.yaml
-  - ostree.yaml
-  - initramfs.yaml
-  - autoupdates.yaml
-  - basic-fixes.yaml
-
-packages:
-  # needed for building derived container images
-  - dnf
-  # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
-  # to build a custom image.
-  - selinux-policy-targeted
-  # And we want container-selinux because trying to layer it on later currently causes issues.
-  - container-selinux
-  # Needed for tpm2 bound luks
-  - tpm2-tools

tier-1/autoupdates.yaml

@@ -1 +0,0 @@
-../tier-0/autoupdates.yaml

tier-1/basic-fixes.yaml

@@ -1 +0,0 @@
-../tier-0/basic-fixes.yaml

tier-1/bootable-rpm-ostree.yaml

@@ -1,8 +0,0 @@
-packages:
- - rpm-ostree nss-altfiles
-
-exclude-packages:
-  # Exclude kernel-debug-core to make sure that it doesn't somehow get
-  # chosen as the package to satisfy the `kernel-core` dependency from
-  # the kernel package.
-  - kernel-debug-core

tier-1/bootc-config.yaml

@@ -1 +0,0 @@
-../tier-0/bootc-config.yaml

tier-1/bootc.yaml

@@ -1 +0,0 @@
-../tier-0/bootc.yaml

tier-1/bootupd.yaml

@@ -1 +0,0 @@
-../tier-0/bootupd.yaml

tier-1/coreos-user-experience.yaml

@@ -1,41 +0,0 @@
-# This file was forked/copied from Fedora CoreOS.  TODO: resync
-# once we have a good generic mechanism for sharing.
-packages:
-  # Basic user tools
-  ## jq - parsing/interacting with JSON data
-  - bash-completion
-  - coreutils
-  - file
-  - jq
-  - less
-  - sudo
-  - vim-minimal
-  # File compression/decompression
-  ## bsdtar - dependency of 35coreos-live dracut module
-  - bsdtar
-  - bzip2
-  - gzip
-  - tar
-  - xz
-  - zstd
-  # Improved MOTD experience
-  - console-login-helper-messages-issuegen
-  - console-login-helper-messages-profile
-  # kdump support
-  # https://github.com/coreos/fedora-coreos-tracker/issues/622
-  - kexec-tools
-  # Remote Access
-  - openssh-clients openssh-server
-  # Container tooling
-  ## crun recommends but doesn't require criu and criu-libs. We want them for
-  ## checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
-  - crun criu criu-libs
-  - podman
-  - skopeo
-  - toolbox
-  # passt provides user-mode networking daemons for namespaces
-  - passt
-  # nvme-cli for managing nvme disks
-  - nvme-cli
-  # Used by admins interactively
-  - lsof

tier-1/firmware.yaml

@@ -1,7 +0,0 @@
- packages:
-  # linux-firmware now a recommends so let's explicitly include it
-  # https://gitlab.com/cki-project/kernel-ark/-/commit/32271d0cd9bd52d386eb35497c4876a8f041f70b
-  # https://src.fedoraproject.org/rpms/kernel/c/f55c3e9ed8605ff28cb9a922efbab1055947e213?branch=rawhide
-  - linux-firmware
-  # If you're using linux-firmware, you probably also want fwupd
-  - fwupd

tier-1/fwupd.yaml

@@ -1,5 +0,0 @@
-# Firmware updates
-packages-aarch64:
-  - fwupd
-packages-x86_64:
-  - fwupd

tier-1/generic-growfs.yaml

@@ -1,12 +0,0 @@
-add-files:
-  - - bootc-generic-growpart
-    - /usr/libexec/bootc-generic-growpart
-  - - bootc-generic-growpart.service
-    - /usr/lib/systemd/system/bootc-generic-growpart.service
-
-postprocess:
-  - |
-    #!/bin/bash
-    set -euo pipefail
-    mkdir -p /usr/lib/systemd/system/local-fs.target.wants
-    ln -s ../bootc-generic-growpart.service /usr/lib/systemd/system/local-fs.target.wants/bootc-generic-growpart.service

tier-1/group

@@ -1 +0,0 @@
-../tier-0/group

tier-1/grub2-removals.yaml

@@ -1 +0,0 @@
-../tier-0/grub2-removals.yaml

tier-1/initramfs-full.yaml

@@ -1,8 +0,0 @@
-# Configuration for the "tier-1" initramfs
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    mkdir -p /usr/lib/dracut/dracut.conf.d
-    cat > /usr/lib/dracut/dracut.conf.d/30-bootc-tier-1.conf << 'EOF'
-    dracutmodules+=" lvm crypt fips "
-    EOF

tier-1/initramfs.yaml

@@ -1 +0,0 @@
-../tier-0/initramfs.yaml

tier-1/kdump-aarch64-aws-workaround.yaml

@@ -1,12 +0,0 @@
-# This file includes a fixup for kdump on aarch64 AWS instances.
-# The issue seems specific to aarch64 AWS instances, but we'll go
-# ahead and apply it across the board for aarch64, since that's
-# the easiest thing to do. Hopefully the upstream issue will get
-# resolved soon.
-postprocess:
-  - |
-    #!/usr/bin/env bash
-    # Remove irqpoll from the list of KDUMP_COMMANDLINE_APPEND. This
-    # causes issues on aarch64 AWS instances.
-    # https://github.com/coreos/fedora-coreos-tracker/issues/1187
-    sed -i -e 's/irqpoll //' /etc/sysconfig/kdump

tier-1/kernel.yaml

@@ -1 +0,0 @@
-../tier-0/kernel.yaml

tier-1/manifest-tier-0.yaml

@@ -1 +0,0 @@
-../tier-0/manifest.yaml

tier-1/manifest.yaml

@@ -1,110 +0,0 @@
-# Flip this back on, we're going to be a larger system
-recommends: true
-
-include:
-  - manifest-tier-0.yaml
-  - bootable-rpm-ostree.yaml
-  - podman.yaml
-  - firmware.yaml
-  - networking-tools.yaml
-  - system-configuration.yaml
-  - coreos-user-experience.yaml
-  - fwupd.yaml
-  - persistent-journal.yaml
-  - initramfs-full.yaml
-  - generic-growfs.yaml
-
-packages:
-  # Include and set the default editor
-  - nano
-  # And we expect this in general
-  - vim-minimal
-  - nfs-utils
-  # Additional firewall support; we aren't including these in RHCOS or they
-  # don't exist in RHEL
-  - iptables-nft iptables-services
-  - WALinuxAgent-udev
-  # Allow communication between sudo and SSSD
-  # for caching sudo rules by SSSD.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/445
-  - libsss_sudo
-  # SSSD; we only ship a subset of the backends
-  - sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
-  # Used by admins interactively
-  - attr
-  - openssl
-  - lsof
-  # Provides terminal tools like clear, reset, tput, and tset
-  - ncurses
-  # i18n
-  - kbd
-  # zram-generator (but not zram-generator-defaults) for F33 change
-  # https://github.com/coreos/fedora-coreos-tracker/issues/509
-  - zram-generator
-  # resolved was broken out to its own package in rawhide/f35
-  - systemd-resolved
-  # This one is in Python so isn't in FCOS, but we can safely add it here.
-  - sos
-
-# These are random architecture-specific packages
-packages-x86_64:
-  - irqbalance
-packages-ppc64le:
-  - irqbalance
-  - librtas
-  - powerpc-utils-core
-  - ppc64-diag-rtas
-packages-aarch64:
-  - irqbalance
-
-postprocess:
-  # Undo RPM scripts enabling units; we want the presets to be canonical
-  # https://github.com/projectatomic/rpm-ostree/issues/1803
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    rm -rf /etc/systemd/system/*
-    systemctl preset-all
-    rm -rf /etc/systemd/user/*
-    systemctl --user --global preset-all
-  # Default to iptables-nft. Otherwise, legacy wins. We can drop this once/if we
-  # remove iptables-legacy. This is needed because alternatives don't work
-  # https://github.com/coreos/fedora-coreos-tracker/issues/677
-  # https://github.com/coreos/fedora-coreos-tracker/issues/676
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    ln -sf /usr/sbin/ip6tables-nft         /etc/alternatives/ip6tables
-    ln -sf /usr/sbin/ip6tables-nft-restore /etc/alternatives/ip6tables-restore
-    ln -sf /usr/sbin/ip6tables-nft-save    /etc/alternatives/ip6tables-save
-    ln -sf /usr/sbin/iptables-nft          /etc/alternatives/iptables
-    ln -sf /usr/sbin/iptables-nft-restore  /etc/alternatives/iptables-restore
-    ln -sf /usr/sbin/iptables-nft-save     /etc/alternatives/iptables-save
-  # See: https://github.com/coreos/fedora-coreos-tracker/issues/1253
-  #      https://bugzilla.redhat.com/show_bug.cgi?id=2112857
-  #      https://github.com/coreos/rpm-ostree/issues/3918
-  # Temporary workaround to remove the SetGID binary from liblockfile that is
-  # pulled by the s390utils but not needed for /usr/sbin/zipl.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    rm -f /usr/bin/dotlockfile
-
-# Things we don't expect to ship on the host.  We currently
-# have recommends: false so these could only come in via
-# hard requirement, in which case the build will fail.
-exclude-packages:
-  - perl
-  - perl-interpreter
-  - nodejs
-  - grubby
-  - cowsay  # Just in case
-  # Let's make sure initscripts doesn't get pulled back in
-  # https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
-  - initscripts
-  # For (datacenter/cloud oriented) servers, we want to see the details by default.
-  # https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/
-  - plymouth
-  # Do not use legacy ifcfg config format in NetworkManager
-  # See https://github.com/coreos/fedora-coreos-config/pull/1991
-  - NetworkManager-initscripts-ifcfg-rh

tier-1/networking-tools.yaml

@@ -1,22 +0,0 @@
-# This defines a set of tools that are useful for configuring, debugging,
-# or manipulating the network of a system.  It is desired to keep this list
-# generic enough to be shared downstream with RHCOS.
-
-packages:
-  # Standard tools for configuring network/hostname
-  - NetworkManager hostname
-  # Interactive Networking configuration during coreos-install
-  - NetworkManager-tui
-  # Support for cloud quirks and dynamic config in real rootfs:
-  # https://github.com/coreos/fedora-coreos-tracker/issues/320
-  - NetworkManager-cloud-setup
-  # Route manipulation and QoS
-  - iproute iproute-tc
-  # Firewall manipulation
-  - iptables nftables
-  # Interactive network tools for admins
-  - socat net-tools bind-utils
-
-exclude-packages:
-  # We use NetworkManager
-  - systemd-networkd

tier-1/ostree.yaml

@@ -1 +0,0 @@
-../tier-0/ostree.yaml

tier-1/passwd

@@ -1 +0,0 @@
-../tier-0/passwd

tier-1/podman.yaml

@@ -1,7 +0,0 @@
-# Core podman bits
-
-packages:
-  - crun
-  - podman
-  - container-selinux
-  - skopeo

tier-1/system-configuration.yaml

@@ -1,32 +0,0 @@
-# These are packages that are related to configuring parts of the system.
-
-packages:
-  # Configuring SSH keys, cloud provider check-in, etc
-  # TODO: needs Ignition kargs
-  # - afterburn afterburn-dracut
-  # NTP support
-  - chrony
-  # Storage configuration/management
-  - lvm2
-  - cryptsetup
-  - e2fsprogs
-  - sg3_utils
-  - xfsprogs
-  ## This is generally useful... https://github.com/CentOS/centos-bootc/issues/394
-  - cloud-utils-growpart
-  # User configuration
-  - passwd
-  - shadow-utils
-  - acl
-  # Manipulating the kernel keyring; used by bootc
-  - keyutils
-  # There are things that write outside of the journal still (such as the
-  # classic wtmp, etc.). auditd also writes outside the journal but it has its
-  # own log rotation.
-  # Anything package layered will also tend to expect files dropped in
-  # /etc/logrotate.d to work. Really, this is a legacy thing, but if we don't
-  # have it then people's disks will slowly fill up with logs.
-  - logrotate
-  # Boost starving threads
-  # https://github.com/coreos/fedora-coreos-tracker/issues/753
-  - stalld

usr/lib/dracut/dracut.conf.d/30-bootc-full.conf

@@ -0,0 +1 @@
+add_dracutmodules+=" lvm crypt fips "

usr/lib/systemd/system-preset/05-bootc.preset

@@ -0,0 +1,7 @@
+# Our fallback
+enable bootc-generic-growpart.service
+
+# We enable this by default just so we can say we have automatic
+# updates on by default, like CoreOS. It's very much intended
+# to be tweaked or replaced outside of trivial scenarios though.
+enable bootc-fetch-apply-updates.timer

usr/lib/systemd/system/bootc-generic-growpart.service

@@ -6,6 +6,8 @@ Documentation=https://gitlab.com/fedora/bootc/docs
 ConditionVirtualization=vm
 # This helps verify that we're running in a bootc/ostree based target.
 ConditionPathIsMountPoint=/sysroot
+# For someone making a smaller image, assume they have this handled.
+ConditionPathExists=/usr/bin/growpart
 # We want to run before any e.g. large container images might be pulled.
 DefaultDependencies=no
 Requires=sysinit.target

usr/lib/tmpfiles.d/bootc-legacy-contentsets.conf

@@ -0,0 +1,5 @@
+# Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
+d /var/roothome/buildinfo 0755 - - -
+d /var/roothome/buildinfo/content_manifests 0755 - - -
+# Note we don't actually try to recreate the content; this just makes the linter ignore it
+f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - -

usr/share/doc/bootc-image-standard/packages-aarch64.txt

@@ -0,0 +1 @@
+irqbalance

usr/share/doc/bootc-image-standard/packages-excluded.txt

@@ -0,0 +1,21 @@
+# Packages excluded by default
+
+# We use NetworkManager
+systemd-networkd
+# But without the legacy
+# See https://github.com/coreos/fedora-coreos-config/pull/1991
+NetworkManager-initscripts-ifcfg-rh
+
+# Let's not have both legacy and nft versions in the image. Users are free to
+# also layer legacy themselves if they want.
+iptables-legacy
+
+# We use bootupd
+grubby
+# Let's make sure initscripts doesn't get pulled back in
+# https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
+initscripts
+
+# For (datacenter/cloud oriented) servers, we want to see the details by default.
+# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/
+plymouth

usr/share/doc/bootc-image-standard/packages-ppc64le.txt

@@ -0,0 +1,4 @@
+irqbalance
+librtas
+powerpc-utils-core
+ppc64-diag-rtas

usr/share/doc/bootc-image-standard/packages-recommended-minimal.txt

@@ -0,0 +1,45 @@
+# This file is simply a list of packages recommended to be used by default.
+# You can process this via e.g.
+# grep -E -v '^#' packages-recommended.txt | xargs dnf -y install
+
+# Used by admins interactively
+attr
+bash-completion
+hostname
+iproute
+jq
+less
+vim-minimal
+# deps of bootc, but let's be explicit. e.g. even if bootc drops the skopeo
+# dep, we still want it
+podman skopeo
+# crun recommends but doesn't require criu and criu-libs. We want them for
+# checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
+crun criu criu-libs
+# storage
+cryptsetup
+lvm2
+tar
+# zram-generator (but not zram-generator-defaults) for F33 change
+# https://github.com/coreos/fedora-coreos-tracker/issues/509
+zram-generator
+# networking
+iptables-nft
+NetworkManager
+openssh-clients
+openssh-server
+systemd-resolved
+# linux-firmware now a recommends so let's explicitly include it
+# https://gitlab.com/cki-project/kernel-ark/-/commit/32271d0cd9bd52d386eb35497c4876a8f041f70b
+# https://src.fedoraproject.org/rpms/kernel/c/f55c3e9ed8605ff28cb9a922efbab1055947e213?branch=rawhide
+linux-firmware
+# security
+polkit
+sudo
+# Allow for configuring different timezones
+tzdata
+# rpm-ostree
+rpm-ostree nss-altfiles
+# firmware updates
+# If you're using linux-firmware, you probably also want fwupd
+fwupd

usr/share/doc/bootc-image-standard/packages-x86_64.txt

@@ -0,0 +1 @@
+irqbalance

usr/share/doc/bootc-image-standard/packages.txt

@@ -0,0 +1,104 @@
+# A relatively large base image suitable for headless servers,
+# a lot like CoreOS.
+
+# Include and set the default editor
+nano
+nfs-utils
+# Additional firewall support; we aren't including these in RHCOS or they
+# don't exist in RHEL
+iptables-services
+WALinuxAgent-udev
+# Allow communication between sudo and SSSD
+# for caching sudo rules by SSSD.
+# https://github.com/coreos/fedora-coreos-tracker/issues/445
+libsss_sudo
+# SSSD; we only ship a subset of the backends
+sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
+# Used by admins interactively
+openssl
+# Provides terminal tools like clear, reset, tput, and tset
+ncurses
+# i18n
+kbd
+# zram-generator (but not zram-generator-defaults) for F33 change
+# https://github.com/coreos/fedora-coreos-tracker/issues/509
+zram-generator
+# This one is in Python so isn't in FCOS, but we can safely add it here.
+sos
+
+# Additional file compression/decompression
+bzip2 zstd
+# Improved MOTD experience
+console-login-helper-messages-issuegen
+console-login-helper-messages-profile
+# kdump support
+# https://github.com/coreos/fedora-coreos-tracker/issues/622
+kexec-tools
+# Container tooling
+toolbox
+# nvme-cli for managing nvme disks
+nvme-cli
+# Used by admins interactively
+lsof
+
+# Explicit dep for RHEL >= 10
+crypto-policies-scripts
+# Configuring SSH keys, cloud provider check-in, etc
+# TODO: needs Ignition kargs
+# - afterburn afterburn-dracut
+# NTP support
+chrony
+# Storage configuration/management
+sg3_utils
+## This is generally useful... https://github.com/CentOS/centos-bootc/issues/394
+cloud-utils-growpart
+# User configuration
+passwd
+shadow-utils
+acl
+# Manipulating the kernel keyring; used by bootc
+keyutils
+# There are things that write outside of the journal still (such as the
+# classic wtmp, etc.). auditd also writes outside the journal but it has its
+# own log rotation.
+# Anything package layered will also tend to expect files dropped in
+# /etc/logrotate.d to work. Really, this is a legacy thing, but if we don't
+# have it then people's disks will slowly fill up with logs.
+logrotate
+# Boost starving threads
+# https://github.com/coreos/fedora-coreos-tracker/issues/753
+stalld
+
+# This defines a set of tools that are useful for configuring, debugging,
+# or manipulating the network of a system.
+# Interactive Networking configuration during coreos-install
+NetworkManager-tui
+# Support for cloud quirks and dynamic config in real rootfs:
+# https://github.com/coreos/fedora-coreos-tracker/issues/320
+NetworkManager-cloud-setup
+# Route manipulation and QoS
+iproute iproute-tc
+# Firewall manipulation
+iptables nftables
+# Interactive network tools for admins
+socat net-tools bind-utils
+
+# These are recomended by other packages installed above.
+# recommended by containers-common-extra
+qemu-user-static
+# recommended by rpm-libs
+rpm-plugin-audit
+#recomended by gnupg2
+pinentry
+gnupg2-smime
+# recommended by dracut
+pigz
+memstrack
+kpartx
+# recommended by libxcrypt
+pkcs11-provider
+# recommended by containers-common
+fuse-overlayfs
+# recommended by toolbox
+cracklib-dicts
+

usr/share/doc/bootc-image-standard/stage-clean

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -xeuo pipefail
+dnf clean all
+# Lots of cleaning
+rm -vrf /var/log /var/cache /var/lib/dnf

usr/share/doc/bootc-image-standard/stage-install

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+dn=$(dirname $0)
+cd ${dn}
+dnf_args=()
+echo "Loading packages-excluded"
+for x in $(grep -E -v '^#' packages-excluded.txt); do
+  dnf_args+=(--exclude ${x})
+done
+echo "Loading packages"
+package_files=(packages-recommended-minimal.txt packages.txt)
+pkgfile_for_arch=packages-$(arch).txt
+if test -f ${pkgfile_for_arch}; then
+  echo "Loading ${pkgfile_for_arch}"
+  package_files+=(${pkgfile_for_arch})
+fi
+base_pkgs=$(grep -hE -v '^#' ${package_files[@]})
+dnf -y ${dnf_args[@]} install $base_pkgs
+
+# Ensure we regenerate the initramfs with new content
+# https://docs.fedoraproject.org/en-US/bootc/initramfs/
+kver=$(cd /usr/lib/modules && echo *); dracut -vf /usr/lib/modules/$kver/initramfs.img $kver
+
+# Undo RPM scripts enabling units; we want the presets to be canonical for the base image.
+# https://github.com/projectatomic/rpm-ostree/issues/1803
+rm -rf /etc/systemd/system/*
+systemctl preset-all
+rm -rf /etc/systemd/user/*
+systemctl --user --global preset-all