Merge branch 'pr/cleanup-treefile-hacks' into 'main'

Containerfile: clean up temporary hack for `--from` handling

See merge request fedora/bootc/base-images!64

Containerfile

@@ -20,12 +20,14 @@
 #
 # # Why does this build process require additional privileges?
 #
-# Because it's generating a base image and uses containerbuildcontextization features itself.
+# Because it's generating a base image and uses containerization features itself.
 # In the future some of this can be lifted.
 
 FROM quay.io/fedora/fedora:rawhide as repos
 
-FROM quay.io/centos-bootc/bootc-image-builder:latest as builder
+# BOOTSTRAPPING: This can be any image that has rpm-ostree and selinux-policy-targeted.
+FROM quay.io/fedora/fedora:41 as builder
+RUN dnf -y install rpm-ostree selinux-policy-targeted
 ARG MANIFEST=fedora-bootc.yaml
 COPY --from=repos /etc/dnf/vars /etc/dnf/vars
 COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg
@@ -37,10 +39,16 @@ COPY . /src
 WORKDIR /src
 RUN rm -vf /src/*.repo
 COPY --from=repos /etc/yum.repos.d/*.repo /src
-RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rpm-ostree compose image \
- --image-config fedora-bootc-config.json --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} /buildcontext/out.ociarchive
+RUN --mount=type=cache,target=/workdir \
+    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
+    --mount=type=bind,from=repos,src=/,dst=/repos \
+      rpm-ostree compose image --image-config fedora-bootc-config.json \
+        --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} \
+       --source-root=/repos /buildcontext/out.ociarchive
 
 FROM oci-archive:./out.ociarchive
 # Need to reference builder here to force ordering. But since we have to run
 # something anyway, we might as well cleanup after ourselves.
-RUN --mount=type=bind,from=builder,src=.,target=/var/tmp --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rm /buildcontext/out.ociarchive
+RUN --mount=type=bind,from=builder,src=.,target=/var/tmp \
+    --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared \
+      rm /buildcontext/out.ociarchive

README.md

@@ -32,6 +32,16 @@ podman build --security-opt=label=disable --cap-add=all \
 
 See the `Containerfile` for more details. This builds the default `tier-1` image.
 
+## Fedora versions
+
+By default, the base images are built for Fedora rawhide. To build against a
+different Fedora version, you can override the `FROM` image used to obtain the
+Fedora repos and dnf variables. E.g.:
+
+```
+podman build --from quay.io/fedora/fedora:41 ...
+```
+
 ### Deriving
 
 You are of course also free to fork, customize, and build base images yourself.

fedora-40.yaml

@@ -0,0 +1,7 @@
+# NB: This treefile is used by the legacy pungi path only to build tier-1. It
+# will be removed in the future.
+releasever: 40
+repos:
+  - fedora
+  - fedora-updates
+include: fedora-bootc.yaml

fedora-41.yaml

@@ -0,0 +1,7 @@
+# NB: This treefile is used by the legacy pungi path only to build tier-1. It
+# will be removed in the future.
+releasever: 41
+repos:
+  - fedora
+  - fedora-updates
+include: fedora-bootc.yaml

fedora-bootc.yaml

@@ -1,7 +1,3 @@
-releasever: rawhide
-repos:
-  - rawhide
-
 metadata:
   name: fedora-boot-tier1
   summary: Fedora Bootable Tier 1

fedora-rawhide.yaml

@@ -0,0 +1,6 @@
+# NB: This treefile is used by the legacy pungi path only to build tier-1. It
+# will be removed in the future.
+releasever: rawhide
+repos:
+  - fedora-rawhide
+include: fedora-bootc.yaml

fedora-tier-0.yaml

@@ -1,7 +1,3 @@
-releasever: rawhide
-repos:
-  - rawhide
-
 metadata:
   name: fedora-boot-tier0
   summary: Fedora Bootable Tier 0

fedora-tier-x.yaml

@@ -1,7 +1,3 @@
-releasever: rawhide
-repos:
-  - rawhide
-
 metadata:
   name: fedora-boot-tier-x
   summary: Fedora Bootable Tier X

tier-0/bootc.yaml

@@ -6,8 +6,9 @@ packages:
  # `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
  # iptables-nft instead to satisfy it.
  - iptables-nft
- # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
- - gdisk xfsprogs e2fsprogs dosfstools
+ # Required by bootc install, sgdisk has been replaced by Rust crate
+ # in bootc https://github.com/containers/bootc/pull/775
+ - xfsprogs e2fsprogs dosfstools
 
 exclude-packages:
   # Exclude kernel-debug-core to make sure that it doesn't somehow get

tier-0/finalize.d/01-var.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+# https://gitlab.com/fedora/bootc/base-images/-/issues/28
+set -xeuo pipefail
+ln -s ../run var/run

tier-0/manifest.yaml

@@ -1,7 +1,4 @@
-
-# Modern defaults we want
-boot-location: modules
-tmp-is-dir: true
+edition: "2024"
 # https://github.com/CentOS/centos-bootc/issues/167
 machineid-compat: true
 # Be minimal
@@ -55,8 +52,10 @@ include:
 packages:
   # this is implied by dependencies but let's make it explicit
   - coreutils
-  # needed for building derived container images
-  - dnf5
+  # We need dnf for building derived container images. In Fedora, this pulls
+  # in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
+  # just `dnf` once the `dnf` package is retired from Fedora.
+  - /usr/bin/dnf
   # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
   # to build a custom image.
   - selinux-policy-targeted

tier-0/passwd

@@ -23,7 +23,7 @@ rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
 rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
 shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
 sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
-sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
+sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
 sync:x:5:0:sync:/sbin:/bin/sync
 systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
 systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin

tier-x/manifest.yaml

@@ -10,12 +10,12 @@ packages:
   - jq
   - less
   - vim-minimal
-  # crun recommends but doesn't require criu and criu-libs. We want them for
-  # checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
-  - criu criu-libs
   # deps of bootc, but let's be explicit. e.g. even if bootc drops the skopeo
   # dep, we still want it
   - podman skopeo
+  # crun recommends but doesn't require criu and criu-libs. We want them for
+  # checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
+  - crun criu criu-libs
   # storage
   - cryptsetup
   - lvm2