Compare commits
5
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Platform Engineering Bot
|
fd2bebf327 | ||
 Liora Milbaum
|
e968082085 | ||
|
Platform Engineering Bot
|
53fcaa9169 | ||
|
Liora Milbaum
|
0a3e4e6c4b | ||
|
Liora Milbaum
|
6164af490f |
No files matched your search
+10
-23
@@ -1,25 +1,12 @@
|
||||
stages:
|
||||
- build
|
||||
---
|
||||
include:
|
||||
- remote: https://gitlab.com/platform-engineering-org/gitlab-ci/-/raw/main/templates/build-image.gitlab-ci.yml
|
||||
|
||||
variables:
|
||||
IMAGE_PREFIX: ${CI_REGISTRY}/${CI_PROJECT_PATH}
|
||||
|
||||
.build-image:
|
||||
stage: build
|
||||
image: quay.io/buildah/stable:v1.38.1
|
||||
needs: []
|
||||
|
||||
build:
|
||||
build-image:
|
||||
extends: .build-image
|
||||
stage: build
|
||||
script: |
|
||||
set -xeuo pipefail
|
||||
curl -L --fail -o /etc/yum.repos.d/coreos-continuous.repo https://copr.fedorainfracloud.org/coprs/g/CoreOS/continuous/repo/fedora-42/group_CoreOS-continuous-fedora-42.repo
|
||||
dnf -y install rpm-ostree
|
||||
cd base
|
||||
buildah build "${hostbuildopts[@]}" -f Containerfile --no-cache --security-opt=label=disable --cap-add=all --device /dev/fuse -t ${IMAGE_PREFIX}-base:tmp .
|
||||
# Rechunk
|
||||
rpm-ostree experimental compose build-chunked-oci --bootc --format-version=1 \
|
||||
--from=${IMAGE_PREFIX}-base:tmp --output containers-storage:${IMAGE_PREFIX}-base
|
||||
cd ..
|
||||
buildah build "${hostbuildopts[@]}" -f Containerfile --no-cache --from ${IMAGE_PREFIX}-base -t ${IMAGE_PREFIX}-standard:tmp .
|
||||
variables:
|
||||
EXTRA_ARGS: "--security-opt=label=disable --cap-add=all"
|
||||
rules:
|
||||
- if: $CI_PROJECT_NAMESPACE != "fedora/bootc"
|
||||
when: never
|
||||
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
repos:
|
||||
- repo: https://github.com/pre-commit/pre-commit-hooks
|
||||
rev: v4.6.0
|
||||
rev: v5.0.0
|
||||
hooks:
|
||||
- id: end-of-file-fixer
|
||||
- id: trailing-whitespace
|
||||
|
||||
+45
-17
@@ -1,18 +1,46 @@
|
||||
# This generates the "standard" base image, deriving from the minimal base.
|
||||
# This container build uses some special features of podman that allow
|
||||
# a process executing as part of a container build to generate a new container
|
||||
# image "from scratch".
|
||||
#
|
||||
# This container build uses nested containerization, so you must build with e.g.
|
||||
# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
|
||||
#
|
||||
# # Why are we doing this?
|
||||
#
|
||||
# Today this base image build process uses rpm-ostree. There is a lot of things that
|
||||
# rpm-ostree does when generating a container image...but important parts include:
|
||||
#
|
||||
# - auto-updating labels in the container metadata
|
||||
# - Generating "chunked" content-addressed reproducible image layers (notice
|
||||
# how there are ~60 layers in the generated image)
|
||||
#
|
||||
# The latter bit in particular is currently impossible to do from Containerfile.
|
||||
# A future goal is adding some support for this in a way that can be honored by
|
||||
# buildah (xref https://github.com/containers/podman/discussions/12605)
|
||||
#
|
||||
# # Why does this build process require additional privileges?
|
||||
#
|
||||
# Because it's generating a base image and uses containerbuildcontextization features itself.
|
||||
# In the future some of this can be lifted.
|
||||
|
||||
# This is a local reference by default because we haven't shipped this image yet.
|
||||
FROM localhost/fedora-bootc:base
|
||||
# Copy in our configuration and build scripts. Most of the heavy lifting
|
||||
# is in `stage-install` which we emit into /usr/share/doc so it can be
|
||||
# used as a reference in other images.
|
||||
COPY usr/ /usr/
|
||||
RUN <<EORUN
|
||||
set -xeuo pipefail
|
||||
# This script installs our default packages. These scripts
|
||||
# are not a stable API, but may become one in the future.
|
||||
/usr/share/doc/bootc-image-standard/stage-install
|
||||
# Cleanup
|
||||
/usr/share/doc/bootc-image-standard/stage-clean
|
||||
# And lint.
|
||||
bootc container lint --fatal-warnings
|
||||
EORUN
|
||||
FROM quay.io/fedora/fedora:40 as repos
|
||||
|
||||
FROM quay.io/centos-bootc/bootc-image-builder:latest as builder
|
||||
ARG MANIFEST=fedora-bootc.yaml
|
||||
COPY --from=repos /etc/dnf/vars /etc/dnf/vars
|
||||
COPY --from=repos /etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-* /etc/pki/rpm-gpg
|
||||
# The input git repository has .repo files committed to git rpm-ostree has historically
|
||||
# emphasized that. But here, we are fetching the repos from the container base image.
|
||||
# So copy the source, and delete the hardcoded ones in git, and use the container base
|
||||
# image ones. We can drop the ones commited to git when we hard switch to Containerfile.
|
||||
COPY . /src
|
||||
WORKDIR /src
|
||||
RUN rm -vf /src/*.repo
|
||||
COPY --from=repos /etc/yum.repos.d/*.repo /src
|
||||
RUN --mount=type=cache,target=/workdir --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rpm-ostree compose image \
|
||||
--image-config fedora-bootc-config.json --cachedir=/workdir --format=ociarchive --initialize ${MANIFEST} /buildcontext/out.ociarchive
|
||||
|
||||
FROM oci-archive:./out.ociarchive
|
||||
# Need to reference builder here to force ordering. But since we have to run
|
||||
# something anyway, we might as well cleanup after ourselves.
|
||||
RUN --mount=type=bind,from=builder,src=.,target=/var/tmp --mount=type=bind,rw=true,src=.,dst=/buildcontext,bind-propagation=shared rm /buildcontext/out.ociarchive
|
||||
@@ -9,56 +9,25 @@ been extremely successful. This project aims to apply the same technique for
|
||||
bootable host systems - using standard OCI/Docker containers as a transport and
|
||||
delivery format for base operating system updates.
|
||||
|
||||
## Building images
|
||||
## Building
|
||||
|
||||
The current default user experience is to build *layered* images on top of the official
|
||||
binary base images produced and tested by this project. See the documentation[5] for more info.
|
||||
First, the expectation is that most users will want to build *layered* images
|
||||
on top of the official base images. See the documentation[5] for more info.
|
||||
|
||||
You can build custom base images by forking this repository; however,
|
||||
https://gitlab.com/fedora/bootc/tracker/-/issues/32 tracks a more supportable
|
||||
mechanism that is not simply forking. For more information see[6].
|
||||
|
||||
## Build process
|
||||
|
||||
Building the images in this repo can be done with `podman build`, but
|
||||
note the build process uses a special podman-ecosystem specific mechanism
|
||||
to create fully custom images while inside a `Containerfile`.
|
||||
You need to enable some privileges as nested containerization is required.
|
||||
Building the images in this repo can be done with `podman build` as with any
|
||||
other application image (note that building with `docker` is not currently
|
||||
supported). You need to enable some privileges for technical reasons.
|
||||
|
||||
```
|
||||
podman build --security-opt=label=disable --cap-add=all \
|
||||
--device /dev/fuse -t localhost/fedora-bootc .
|
||||
```
|
||||
|
||||
See the `Containerfile` for more details. This builds the default `tier-1` image.
|
||||
|
||||
## Fedora versions
|
||||
|
||||
By default, the base images are built for Fedora rawhide. To build against a
|
||||
different Fedora version, you can override the `FROM` image used to obtain the
|
||||
Fedora repos and dnf variables. E.g.:
|
||||
|
||||
```
|
||||
podman build --from quay.io/fedora/fedora:41 ...
|
||||
```
|
||||
|
||||
### Deriving
|
||||
See the `Containerfile` for more details.
|
||||
|
||||
You are of course also free to fork, customize, and build base images yourself.
|
||||
See this page[6] of the documentation for more information.
|
||||
|
||||
## Images
|
||||
|
||||
At the current time, there is just one reference base image published
|
||||
to the registry. There is a `Containerfile.base` which produces a
|
||||
quite minimal base image, from which the default image derives.
|
||||
|
||||
More on the history from [this tracker issue](https://gitlab.com/fedora/bootc/tracker/-/issues/32).
|
||||
|
||||
- Containefile.base: A base image with the effective equivalent of installing `bootc kernel systemd dnf`
|
||||
with "recommends" off. Intended as a derivation starting point for minimal systems.
|
||||
- Containerfile: Produces the default much larger image; somewhat similar to CoreOS.
|
||||
|
||||
## More information
|
||||
|
||||
Documentation: <https://docs.fedoraproject.org/en-US/bootc/>
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
# This is a relatively minimal base image build; it's intended as a derivation
|
||||
# point.
|
||||
#
|
||||
# This container build uses nested containerization to construct
|
||||
# a target rootfs from scratch; so you must build with e.g.
|
||||
# podman build --security-opt=label=disable --cap-add=all --device /dev/fuse <...>
|
||||
|
||||
# If you want to configure the input rpm-md repositories, just override this
|
||||
# container image.
|
||||
FROM quay.io/fedora/fedora:rawhide as repos
|
||||
|
||||
# We use stream10 to demonstrate that we support "cross builds".
|
||||
FROM quay.io/centos/centos:stream10 as builder
|
||||
RUN <<EORUN
|
||||
set -xeuo pipefail
|
||||
# For rpm-ostree v2025.5
|
||||
curl -L -o /etc/yum.repos.d/coreos-continuous.repo https://copr.fedorainfracloud.org/coprs/g/CoreOS/continuous/repo/centos-stream-10/group_CoreOS-continuous-centos-stream-10.repo
|
||||
dnf -y install rpm-ostree selinux-policy-targeted sqlite
|
||||
EORUN
|
||||
# Copy in our source code.
|
||||
COPY . /src
|
||||
WORKDIR /src
|
||||
RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw <<EORUN
|
||||
set -xeuo pipefail
|
||||
# Copy the build configuration into the builder image, as if it's the final image
|
||||
cp -a . /usr/lib/sysimage/base-image-manifest
|
||||
# And embed the rebuild script
|
||||
install -m 0755 -t /usr/libexec ./bootc-base-image-rebuild-self
|
||||
# Finally, run the build script in the same way we expect custom images to do.
|
||||
/usr/libexec/bootc-base-image-rebuild-self /repos /target-rootfs
|
||||
EORUN
|
||||
|
||||
# This pulls in the rootfs generated in the previous step
|
||||
FROM scratch
|
||||
COPY --from=builder /target-rootfs/ /
|
||||
LABEL containers.bootc 1
|
||||
# This is an ad-hoc way for us to reference bootc-image-builder in
|
||||
# a way that in theory client tooling can inspect and find. Today
|
||||
# it isn't widely used.
|
||||
LABEL bootc.diskimage-builder quay.io/centos-bootc/bootc-image-builder
|
||||
# https://pagure.io/fedora-kiwi-descriptions/pull-request/52
|
||||
ENV container=oci
|
||||
# Make systemd the default
|
||||
STOPSIGNAL SIGRTMIN+3
|
||||
CMD ["/sbin/init"]
|
||||
|
||||
@@ -1,2 +0,0 @@
|
||||
install:
|
||||
install -m 0755 -t $(DESTDIR)/usr/libexec bootc-base-image-rebuild-self
|
||||
@@ -1,17 +0,0 @@
|
||||
#!/bin/bash
|
||||
# This script regenerates this base image using a build
|
||||
# configuration (list of packages, scripts) embedded in this current image.
|
||||
# The actual *content* packages will come from the source root.
|
||||
set -xeuo pipefail
|
||||
source_root=$1
|
||||
shift
|
||||
target=$1
|
||||
shift
|
||||
if ! test -x /usr/bin/rpm-ostree; then
|
||||
dnf -y install rpm-ostree
|
||||
fi
|
||||
rpm-ostree experimental compose rootfs --source-root-rw=$source_root /usr/lib/sysimage/base-image-manifest/manifest.yaml $target
|
||||
# Finally, propagate the configuration and build script into the target root.
|
||||
for f in /usr/lib/sysimage/base-image-manifest /usr/libexec/bootc-base-image-rebuild-self; do
|
||||
cp -a $f $target/$f
|
||||
done
|
||||
@@ -1,83 +0,0 @@
|
||||
# bootc-base-image-rebuild-self
|
||||
|
||||
A core premise of the bootc model is that rich
|
||||
control over Linux system customization can be accomplished
|
||||
with a "default" container build:
|
||||
|
||||
```
|
||||
FROM <base image>
|
||||
RUN ...
|
||||
```
|
||||
|
||||
As of recently, it is possible to e.g. swap the kernel
|
||||
and other fundamental components as part of default derivation.
|
||||
|
||||
## Understanding the base image content
|
||||
|
||||
Most, but not all content from the base image comes from RPMs.
|
||||
There is some additional non-RPM content, as well as postprocessing
|
||||
that operates on the filesystem root. At the current
|
||||
time the implementation of the base image build uses `rpm-ostree`,
|
||||
but this is considered an implementation detail subject to change.
|
||||
|
||||
## Rebuilding from externally controlled content
|
||||
|
||||
Some use cases want even more control - for example,
|
||||
as an organization deploying a bootc system, I may want to ensure
|
||||
the base image version carries a set of packages at
|
||||
exactly specific versions (perhaps defined by a lockfile,
|
||||
or an rpm-md repository). There are many tools which
|
||||
manage snapshots of yum (rpm-md) repositories.
|
||||
|
||||
The `/usr/libexec/bootc-base-image-rebuild-self` which is
|
||||
included in the base image is designed to enable this
|
||||
level of control.
|
||||
|
||||
## Using bootc-base-image-rebuild-self
|
||||
|
||||
This tool takes just two arguments:
|
||||
|
||||
- A "repository configuration root" which should have an `/etc/yum.repos.d`
|
||||
that defines the input RPM content.
|
||||
- A path to the target root filesystem which will be generated
|
||||
|
||||
### Implementation
|
||||
|
||||
The current implementation uses `rpm-ostree` on a manifest (treefile)
|
||||
embedded in the container image itself. The set of packages installed
|
||||
is currently not configurable; however it is quite minimal and can
|
||||
easily be customized further as we will see below.
|
||||
|
||||
The build tooling is designed to support "cross builds"; the
|
||||
repository root could e.g. be CentOS Stream 10, while the
|
||||
builder root is Fedora or RHEL, etc. In other words, one given
|
||||
base image can be used as a "builder" to produce another
|
||||
using different RPMs.
|
||||
|
||||
### Example: Generate a new image using CentOS Stream 10 content from RHEL
|
||||
|
||||
FROM quay.io/centos/centos:stream10 as repos
|
||||
|
||||
FROM registry.redhat.io/rhel10/rhel-bootc:10 as builder
|
||||
RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw /usr/libexec/bootc-base-image-rebuild-self /repos /target-rootfs
|
||||
|
||||
# This container image uses the "artifact pattern"; it has some
|
||||
# basic configuration we expect to apply to multiple container images.
|
||||
FROM quay.io/exampleos/baseconfig@sha256:.... as baseconfig
|
||||
|
||||
FROM scratch
|
||||
COPY --from=builder /target-rootfs/ /
|
||||
# Now we make other arbitrary changes. Copy our systemd units and
|
||||
# other tweaks from the baseconfig container image.
|
||||
COPY --from=baseconfig /usr/ /usr/
|
||||
RUN <<EORUN
|
||||
set -xeuo pipefail
|
||||
# Install critical components
|
||||
dnf -y install linux-firmware NetworkManager cloud-init cowsay
|
||||
dnf clean all
|
||||
bootc container lint
|
||||
EORUN
|
||||
LABEL containers.bootc 1
|
||||
ENV container=oci
|
||||
STOPSIGNAL SIGRTMIN+3
|
||||
CMD ["/sbin/init"]
|
||||
@@ -1,11 +0,0 @@
|
||||
# The bootc components.
|
||||
packages:
|
||||
- systemd
|
||||
- bootc
|
||||
# bootc pulls in podman, which pulls in containers-common, which wants
|
||||
# `iptables`. Currently that pulls in iptables-legacy. Let's explicitly name
|
||||
# iptables-nft instead to satisfy it.
|
||||
- iptables-nft
|
||||
# Required by bootc install, sgdisk has been replaced by Rust crate
|
||||
# in bootc https://github.com/containers/bootc/pull/775
|
||||
- xfsprogs e2fsprogs dosfstools
|
||||
@@ -1,7 +0,0 @@
|
||||
variables:
|
||||
distro: "fedora"
|
||||
|
||||
# Fedora-specific packages here
|
||||
packages:
|
||||
# https://gitlab.com/fedora/bootc/base-images/-/issues/12
|
||||
- fedora-repos-archive
|
||||
@@ -1,6 +0,0 @@
|
||||
#!/bin/bash
|
||||
# https://gitlab.com/fedora/bootc/base-images/-/issues/28
|
||||
set -xeuo pipefail
|
||||
ln -s ../run var/run
|
||||
# https://gitlab.com/fedora/bootc/tracker/-/issues/58
|
||||
mkdir -p var/lib/rpm-state
|
||||
@@ -1,24 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
# https://github.com/coreos/rpm-ostree/pull/5244
|
||||
#
|
||||
sysimage_rpmdb=usr/lib/sysimage/rpm/rpmdb.sqlite
|
||||
rpmostree_rpmdb_dir=usr/share/rpm
|
||||
rpmostree_rpmdb="${rpmostree_rpmdb_dir}/rpmdb.sqlite"
|
||||
rpmostree_base_rpmdb_dir=usr/lib/sysimage/rpm-ostree-base-db
|
||||
rpmostree_base_rpmdb="${rpmostree_base_rpmdb_dir}/rpmdb.sqlite"
|
||||
pragma='PRAGMA journal_mode=delete;'
|
||||
|
||||
# Forcibly delete this because ostree hardlinking the sqlite databases
|
||||
# confuses rpm. This will cause rpm-ostree to enter a fallback
|
||||
# mode with package layering, but that's OK.
|
||||
if test -d "${rpmostree_base_rpmdb_dir}"; then
|
||||
echo "Removing ${rpmostree_base_rpmdb_dir}"
|
||||
rm "${rpmostree_base_rpmdb_dir}" -rf
|
||||
fi
|
||||
for path in ${sysimage_rpmdb} ${rpmostree_rpmdb}; do
|
||||
if test -f "${path}-shm"; then
|
||||
echo "Executing in ${path}: ${pragma}"
|
||||
sqlite3 "${path}" "${pragma}" >/dev/null
|
||||
fi
|
||||
done
|
||||
@@ -1,24 +0,0 @@
|
||||
# Configuration to enable kernel-install integration
|
||||
postprocess:
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
source /usr/lib/os-release
|
||||
# Check if the ID is Fedora and VERSION_ID is 42 or higher
|
||||
if [[ "$ID" == "fedora" && "$VERSION_ID" -ge 42 ]]; then
|
||||
echo -e "# kernel-install will not try to run dracut and allow rpm-ostree to\n\
|
||||
# take over. Rpm-ostree will use this to know that it is responsible\n\
|
||||
# to run dracut and ensure that there is only one kernel in the image\n\
|
||||
layout=ostree" | tee /usr/lib/kernel/install.conf > /dev/null
|
||||
fi
|
||||
# By default dnf keeps multiple versions of the kernel, with this
|
||||
# configuration we tell dnf to treat the kernel as everything else.
|
||||
# https://dnf.readthedocs.io/en/latest/conf_ref.html#main-options
|
||||
# Let's add the config to a distribution configuration file if dnf5
|
||||
# is used, we append to /etc/dnf/dnf.conf if not.
|
||||
if [ -d "/usr/share/dnf5/libdnf.conf.d/" ]; then
|
||||
echo -e "[main]\ninstallonlypkgs=''" >> /usr/share/dnf5/libdnf.conf.d/20-ostree-installonlypkgs.conf
|
||||
else
|
||||
echo "installonlypkgs=''" >> /etc/dnf/dnf.conf
|
||||
fi
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
edition: "2024"
|
||||
|
||||
# Be minimal
|
||||
recommends: false
|
||||
|
||||
# Default to `bash` in our container, the same as other containers we ship.
|
||||
container-cmd:
|
||||
- /sbin/init
|
||||
|
||||
remove-from-packages:
|
||||
# Generally we expect other tools to do this (e.g. Ignition or cloud-init)
|
||||
- [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
|
||||
# We don't want auto-generated mount units. See also
|
||||
# https://github.com/systemd/systemd/issues/13099
|
||||
- [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
|
||||
|
||||
include:
|
||||
- postprocess-conf.yaml
|
||||
- tmpfiles.yaml
|
||||
- bootc.yaml
|
||||
- bootupd.yaml
|
||||
- ostree.yaml
|
||||
- initramfs.yaml
|
||||
- basic-fixes.yaml
|
||||
- kernel-install.yaml
|
||||
- persistent-journal.yaml
|
||||
- fedora-repos.yaml
|
||||
|
||||
packages:
|
||||
# This can be replaced later
|
||||
- kernel
|
||||
# this is implied by dependencies but let's make it explicit
|
||||
- coreutils
|
||||
# We need dnf for building derived container images. In Fedora, this pulls
|
||||
# in dnf5. In CentOS/RHEL, this pulls in dnf(4). We can simplify this back to
|
||||
# just `dnf` once the `dnf` package is retired from Fedora.
|
||||
- /usr/bin/dnf
|
||||
# If you don't want SELinux today, you'll need to build a custom image.
|
||||
- selinux-policy-targeted
|
||||
# And we want container-selinux because trying to layer it on later currently causes issues.
|
||||
- container-selinux
|
||||
# Needed for tpm2 bound luks
|
||||
- tpm2-tools
|
||||
@@ -1,34 +0,0 @@
|
||||
# This file configures things relevant to `rpm-ostree compose postprocess`.
|
||||
|
||||
# We want content lifecycled with the image
|
||||
opt-usrlocal: "root"
|
||||
|
||||
# https://github.com/CentOS/centos-bootc/issues/167
|
||||
machineid-compat: true
|
||||
|
||||
# Note that the default for c9s+ is sqlite; we can't rely on rpm being
|
||||
# in the target (it isn't in tier-0!) so turn this to host here. This
|
||||
# does break the "hermetic build" aspect a bit. Maybe eventually
|
||||
# what we should do is special case this and actually install RPM temporarily
|
||||
# and then remove it...
|
||||
rpmdb: host
|
||||
|
||||
ignore-removed-users:
|
||||
- root
|
||||
ignore-removed-groups:
|
||||
- root
|
||||
etc-group-members:
|
||||
- wheel
|
||||
- sudo
|
||||
- systemd-journal
|
||||
- adm
|
||||
|
||||
check-passwd:
|
||||
type: "file"
|
||||
filename: "passwd"
|
||||
check-groups:
|
||||
type: "file"
|
||||
filename: "group"
|
||||
|
||||
automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
|
||||
mutate-os-release: "${releasever}"
|
||||
@@ -1,7 +0,0 @@
|
||||
postprocess:
|
||||
- |
|
||||
#!/bin/bash
|
||||
cat >/usr/lib/tmpfiles.d/bootc-base-rpmstate.conf <<'EOF'
|
||||
# Workaround for https://bugzilla.redhat.com/show_bug.cgi?id=771713
|
||||
d /var/lib/rpm-state 0755 - - -
|
||||
EOF
|
||||
@@ -0,0 +1,12 @@
|
||||
{
|
||||
"Labels": {
|
||||
"containers.bootc": "1",
|
||||
"bootc.diskimage-builder": "quay.io/centos-bootc/bootc-image-builder",
|
||||
"redhat.id": "fedora",
|
||||
"redhat.version-id": "40"
|
||||
},
|
||||
"StopSignal": "SIGRTMIN+3",
|
||||
"Env": [
|
||||
"container=oci"
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
releasever: 40
|
||||
variables:
|
||||
distro: "fedora"
|
||||
|
||||
repos:
|
||||
- fedora
|
||||
- updates
|
||||
|
||||
metadata:
|
||||
name: fedora-boot-tier1
|
||||
summary: Fedora Bootable Tier 1
|
||||
|
||||
include:
|
||||
- tier-1/manifest.yaml
|
||||
- tier-1/kernel.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
releasever: 40
|
||||
variables:
|
||||
distro: "fedora"
|
||||
|
||||
repos:
|
||||
- fedora-devel
|
||||
- fedora-updates
|
||||
|
||||
metadata:
|
||||
name: fedora-boot-tier0
|
||||
summary: Fedora Bootable Tier 0
|
||||
|
||||
include:
|
||||
- tier-0/manifest.yaml
|
||||
- tier-0/kernel.yaml
|
||||
+102
@@ -0,0 +1,102 @@
|
||||
# Note we use baseurl= here because using auto-selected mirrors conflicts with
|
||||
# change detection: https://github.com/coreos/fedora-coreos-pipeline/issues/85.
|
||||
|
||||
[fedora]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates]
|
||||
name=Fedora $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing]
|
||||
name=Fedora $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Everything/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Everything/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-modular]
|
||||
name=Fedora Modular $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/releases/$releasever/Modular/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/releases/$releasever/Modular/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-modular-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-modular-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-$releasever-$basearch
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-updates-testing-modular]
|
||||
name=Fedora Modular $releasever - $basearch - Test Updates
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/updates/testing/$releasever/Modular/$basearch/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/updates/testing/$releasever/Modular/$basearch/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-testing-f$releasever&arch=$basearch
|
||||
enabled=1
|
||||
gpgcheck=1
|
||||
metadata_expire=6h
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[rawhide]
|
||||
name=Fedora - Rawhide - Developmental packages for the next Fedora release
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
|
||||
[fedora-devel]
|
||||
name=Fedora $releasever - $basearch
|
||||
baseurl=https://dl.fedoraproject.org/pub/fedora/linux/development/$releasever/Everything/$basearch/os/
|
||||
https://dl.fedoraproject.org/pub/fedora-secondary/development/$releasever/Everything/$basearch/os/
|
||||
#metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$releasever&arch=$basearch
|
||||
enabled=1
|
||||
#metadata_expire=7d
|
||||
repo_gpgcheck=0
|
||||
type=rpm
|
||||
gpgcheck=1
|
||||
gpgkey=file:///usr/share/distribution-gpg-keys/fedora/RPM-GPG-KEY-fedora-$releasever-primary
|
||||
skip_if_unavailable=False
|
||||
+1
-8
@@ -3,17 +3,10 @@
|
||||
"extends": [
|
||||
"github>platform-engineering-org/.github"
|
||||
],
|
||||
"baseBranches": ["main", "f40", "f41"],
|
||||
"packageRules": [
|
||||
{
|
||||
"matchPackageNames": ["quay.io/fedora/fedora"],
|
||||
"allowedVersions": "=40",
|
||||
"matchBaseBranches": ["f40"]
|
||||
},
|
||||
{
|
||||
"matchPackageNames": ["quay.io/fedora/fedora"],
|
||||
"allowedVersions": "=41",
|
||||
"matchBaseBranches": ["f41"]
|
||||
"allowedVersions": "=40"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,9 @@
|
||||
# Enable automatic updates by default
|
||||
postprocess:
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
target=/usr/lib/systemd/system/default.target.wants
|
||||
mkdir -p $target
|
||||
set -x
|
||||
ln -s ../bootc-fetch-apply-updates.timer $target
|
||||
@@ -23,7 +23,7 @@ postprocess:
|
||||
# tmpfiles.d unit for `/var/roothome` is fine, but this actually doesn't
|
||||
# work if we want to use tmpfiles.d to write to `/root/.ssh` because
|
||||
# tmpfiles gives up on that before getting to `/var/roothome`.
|
||||
sed -i -e 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
|
||||
sed -ie 's, /root, /var/roothome,' /usr/lib/tmpfiles.d/provision.conf
|
||||
# Because /var/roothome is also defined in rpm-ostree-0-integration.conf
|
||||
# we need to delete /var/roothome
|
||||
sed -i -e '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
|
||||
sed -ie '/^d- \/var\/roothome /d' /usr/lib/tmpfiles.d/provision.conf
|
||||
Whitespace-only changes.
@@ -0,0 +1,12 @@
|
||||
# The bootc components.
|
||||
packages:
|
||||
- systemd
|
||||
- bootc
|
||||
# Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk
|
||||
- gdisk xfsprogs e2fsprogs dosfstools
|
||||
|
||||
exclude-packages:
|
||||
# Exclude kernel-debug-core to make sure that it doesn't somehow get
|
||||
# chosen as the package to satisfy the `kernel-core` dependency from
|
||||
# the kernel package.
|
||||
- kernel-debug-core
|
||||
@@ -9,8 +9,9 @@ packages-aarch64:
|
||||
packages-ppc64le:
|
||||
- grub2 ostree-grub2
|
||||
packages-s390x:
|
||||
# For zipl
|
||||
- s390utils-core
|
||||
# On Fedora, this is provided by s390utils-core. on RHEL, this is for now
|
||||
# provided by s390utils-base, but soon will be -core too.
|
||||
- /usr/sbin/zipl
|
||||
packages-x86_64:
|
||||
- grub2 grub2-efi-x64 efibootmgr shim
|
||||
- microcode_ctl
|
||||
@@ -24,5 +25,7 @@ postprocess:
|
||||
- |
|
||||
#!/bin/bash
|
||||
set -xeuo pipefail
|
||||
# Until we have https://github.com/coreos/rpm-ostree/pull/2275
|
||||
mkdir -p /run
|
||||
# Transforms /usr/lib/ostree-boot into a bootupd-compatible update payload
|
||||
/usr/bin/bootupctl backend generate-update-metadata
|
||||
File renamed without changes.
File renamed without changes.
@@ -6,19 +6,13 @@ postprocess:
|
||||
cat > /usr/lib/dracut/dracut.conf.d/20-bootc-base.conf << 'EOF'
|
||||
# We want a generic image; hostonly makes no sense as part of a server side build
|
||||
hostonly=no
|
||||
add_dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
|
||||
dracutmodules+=" kernel-modules dracut-systemd systemd-initrd base ostree "
|
||||
EOF
|
||||
cat > /usr/lib/dracut/dracut.conf.d/22-bootc-generic.conf << 'EOF'
|
||||
# Extra modules that we want by default that are known to exist in the kernel
|
||||
add_dracutmodules+=" virtiofs "
|
||||
dracutmodules+=" virtiofs "
|
||||
EOF
|
||||
cat > /usr/lib/dracut/dracut.conf.d/49-bootc-tpm2-tss.conf << 'EOF'
|
||||
# We want this for systemd-cryptsetup tpm2 locking
|
||||
add_dracutmodules+=" tpm2-tss "
|
||||
EOF
|
||||
cat > /usr/lib/dracut/dracut.conf.d/59-altfiles.conf << 'EOF'
|
||||
# https://issues.redhat.com/browse/RHEL-49590
|
||||
# On image mode systems we use nss-altfiles for passwd and group,
|
||||
# this makes sure dracut uses them which also fixes kdump writing to NFS.
|
||||
install_items+=" /usr/lib/passwd /usr/lib/group "
|
||||
dracutmodules+=" tpm2-tss "
|
||||
EOF
|
||||
@@ -0,0 +1,10 @@
|
||||
repos:
|
||||
- rt
|
||||
- nfv
|
||||
|
||||
# Enable the "realtime" AKA soft-realtime AKA latency-optimized kernel.
|
||||
packages:
|
||||
- kernel-rt-core kernel-rt-modules kernel-rt-modules-extra kernel-rt-kvm
|
||||
|
||||
exclude-packages:
|
||||
- kernel-rt-debug-core
|
||||
File renamed without changes.
@@ -0,0 +1,72 @@
|
||||
|
||||
# Modern defaults we want
|
||||
boot-location: modules
|
||||
tmp-is-dir: true
|
||||
# https://github.com/CentOS/centos-bootc/issues/167
|
||||
machineid-compat: true
|
||||
# Be minimal
|
||||
recommends: false
|
||||
|
||||
ignore-removed-users:
|
||||
- root
|
||||
ignore-removed-groups:
|
||||
- root
|
||||
etc-group-members:
|
||||
- wheel
|
||||
- sudo
|
||||
- systemd-journal
|
||||
- adm
|
||||
|
||||
# Default to `bash` in our container, the same as other containers we ship.
|
||||
container-cmd:
|
||||
- /sbin/init
|
||||
|
||||
# Note that the default for c9s+ is sqlite; we can't rely on rpm being
|
||||
# in the target (it isn't in tier-0!) so turn this to host here. This
|
||||
# does break the "hermetic build" aspect a bit. Maybe eventually
|
||||
# what we should do is special case this and actually install RPM temporarily
|
||||
# and then remove it...
|
||||
rpmdb: host
|
||||
|
||||
check-passwd:
|
||||
type: "file"
|
||||
filename: "passwd"
|
||||
check-groups:
|
||||
type: "file"
|
||||
filename: "group"
|
||||
|
||||
automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
|
||||
mutate-os-release: "${releasever}"
|
||||
|
||||
remove-from-packages:
|
||||
# Generally we expect other tools to do this (e.g. Ignition or cloud-init)
|
||||
- [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
|
||||
# We don't want auto-generated mount units. See also
|
||||
# https://github.com/systemd/systemd/issues/13099
|
||||
- [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
|
||||
# Drop some buggy sysusers fragments which do not match static IDs allocation:
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2105177
|
||||
- [dbus-common, /usr/lib/sysusers.d/dbus.conf]
|
||||
|
||||
include:
|
||||
- bootc.yaml
|
||||
- ostree.yaml
|
||||
- initramfs.yaml
|
||||
- autoupdates.yaml
|
||||
- basic-fixes.yaml
|
||||
|
||||
packages:
|
||||
# needed for building derived container images
|
||||
- dnf
|
||||
# Even in tier-0, we have this. If you don't want SELinux today, you'll need
|
||||
# to build a custom image.
|
||||
- selinux-policy-targeted
|
||||
# And we want container-selinux because trying to layer it on later currently causes issues.
|
||||
- container-selinux
|
||||
# Needed for tpm2 bound luks
|
||||
- tpm2-tools
|
||||
|
||||
# See https://github.com/coreos/bootupd
|
||||
arch-include:
|
||||
x86_64: bootupd.yaml
|
||||
aarch64: bootupd.yaml
|
||||
@@ -1,6 +1,9 @@
|
||||
packages:
|
||||
- ostree nss-altfiles
|
||||
|
||||
# We want content lifecycled with the image
|
||||
opt-usrlocal: "root"
|
||||
|
||||
postprocess:
|
||||
# Set up default root config
|
||||
- |
|
||||
@@ -23,7 +23,7 @@ rpc:x:32:32:Rpcbind Daemon:/var/lib/rpcbind:/usr/sbin/nologin
|
||||
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/usr/sbin/nologin
|
||||
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
|
||||
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/usr/sbin/nologin
|
||||
sssd:x:995:993:User for sssd:/run/sssd:/usr/sbin/nologin
|
||||
sssd:x:995:993:User for sssd:/:/usr/sbin/nologin
|
||||
sync:x:5:0:sync:/sbin:/bin/sync
|
||||
systemd-bus-proxy:x:989:988:systemd Bus Proxy:/:/usr/sbin/nologin
|
||||
systemd-network:x:991:990:systemd Network Management:/:/usr/sbin/nologin
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/autoupdates.yaml
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/basic-fixes.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
packages:
|
||||
- rpm-ostree nss-altfiles
|
||||
|
||||
exclude-packages:
|
||||
# Exclude kernel-debug-core to make sure that it doesn't somehow get
|
||||
# chosen as the package to satisfy the `kernel-core` dependency from
|
||||
# the kernel package.
|
||||
- kernel-debug-core
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/bootc-config.yaml
|
||||
@@ -3,18 +3,15 @@ set -eu
|
||||
|
||||
backing_device=$(findmnt -vno SOURCE /sysroot)
|
||||
echo "Backing device: ${backing_device}"
|
||||
|
||||
# Handling devicemapper targets is a whole other thing
|
||||
case $backing_device in
|
||||
/dev/mapper/*) echo "Not growing $backing_device"; exit 0 ;;
|
||||
esac
|
||||
|
||||
syspath=/sys/class/block/$(basename "${backing_device}")
|
||||
if ! test -d "${syspath}"; then
|
||||
echo "failed to find backing device ${syspath}"; exit 1
|
||||
fi
|
||||
|
||||
|
||||
# Handling devicemapper targets is a whole other thing
|
||||
case $backing_device in
|
||||
/dev/mapper/*) "Not growing $backing_device"; exit 0 ;;
|
||||
esac
|
||||
|
||||
# Note that we expect that the rootfs is on a partition
|
||||
partition=$(cat "${syspath}"/partition)
|
||||
-2
@@ -6,8 +6,6 @@ Documentation=https://gitlab.com/fedora/bootc/docs
|
||||
ConditionVirtualization=vm
|
||||
# This helps verify that we're running in a bootc/ostree based target.
|
||||
ConditionPathIsMountPoint=/sysroot
|
||||
# For someone making a smaller image, assume they have this handled.
|
||||
ConditionPathExists=/usr/bin/growpart
|
||||
# We want to run before any e.g. large container images might be pulled.
|
||||
DefaultDependencies=no
|
||||
Requires=sysinit.target
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/bootc.yaml
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/bootupd.yaml
|
||||
@@ -0,0 +1,41 @@
|
||||
# This file was forked/copied from Fedora CoreOS. TODO: resync
|
||||
# once we have a good generic mechanism for sharing.
|
||||
packages:
|
||||
# Basic user tools
|
||||
## jq - parsing/interacting with JSON data
|
||||
- bash-completion
|
||||
- coreutils
|
||||
- file
|
||||
- jq
|
||||
- less
|
||||
- sudo
|
||||
- vim-minimal
|
||||
# File compression/decompression
|
||||
## bsdtar - dependency of 35coreos-live dracut module
|
||||
- bsdtar
|
||||
- bzip2
|
||||
- gzip
|
||||
- tar
|
||||
- xz
|
||||
- zstd
|
||||
# Improved MOTD experience
|
||||
- console-login-helper-messages-issuegen
|
||||
- console-login-helper-messages-profile
|
||||
# kdump support
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/622
|
||||
- kexec-tools
|
||||
# Remote Access
|
||||
- openssh-clients openssh-server
|
||||
# Container tooling
|
||||
## crun recommends but doesn't require criu and criu-libs. We want them for
|
||||
## checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
|
||||
- crun criu criu-libs
|
||||
- podman
|
||||
- skopeo
|
||||
- toolbox
|
||||
# passt provides user-mode networking daemons for namespaces
|
||||
- passt
|
||||
# nvme-cli for managing nvme disks
|
||||
- nvme-cli
|
||||
# Used by admins interactively
|
||||
- lsof
|
||||
@@ -0,0 +1,7 @@
|
||||
packages:
|
||||
# linux-firmware now a recommends so let's explicitly include it
|
||||
# https://gitlab.com/cki-project/kernel-ark/-/commit/32271d0cd9bd52d386eb35497c4876a8f041f70b
|
||||
# https://src.fedoraproject.org/rpms/kernel/c/f55c3e9ed8605ff28cb9a922efbab1055947e213?branch=rawhide
|
||||
- linux-firmware
|
||||
# If you're using linux-firmware, you probably also want fwupd
|
||||
- fwupd
|
||||
@@ -0,0 +1,5 @@
|
||||
# Firmware updates
|
||||
packages-aarch64:
|
||||
- fwupd
|
||||
packages-x86_64:
|
||||
- fwupd
|
||||
@@ -0,0 +1,12 @@
|
||||
add-files:
|
||||
- - bootc-generic-growpart
|
||||
- /usr/libexec/bootc-generic-growpart
|
||||
- - bootc-generic-growpart.service
|
||||
- /usr/lib/systemd/system/bootc-generic-growpart.service
|
||||
|
||||
postprocess:
|
||||
- |
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
mkdir -p /usr/lib/systemd/system/local-fs.target.wants
|
||||
ln -s ../bootc-generic-growpart.service /usr/lib/systemd/system/local-fs.target.wants/bootc-generic-growpart.service
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/group
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/grub2-removals.yaml
|
||||
@@ -0,0 +1,8 @@
|
||||
# Configuration for the "tier-1" initramfs
|
||||
postprocess:
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
mkdir -p /usr/lib/dracut/dracut.conf.d
|
||||
cat > /usr/lib/dracut/dracut.conf.d/30-bootc-tier-1.conf << 'EOF'
|
||||
dracutmodules+=" lvm crypt "
|
||||
EOF
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/initramfs.yaml
|
||||
@@ -0,0 +1,12 @@
|
||||
# This file includes a fixup for kdump on aarch64 AWS instances.
|
||||
# The issue seems specific to aarch64 AWS instances, but we'll go
|
||||
# ahead and apply it across the board for aarch64, since that's
|
||||
# the easiest thing to do. Hopefully the upstream issue will get
|
||||
# resolved soon.
|
||||
postprocess:
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
# Remove irqpoll from the list of KDUMP_COMMANDLINE_APPEND. This
|
||||
# causes issues on aarch64 AWS instances.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/1187
|
||||
sed -i -e 's/irqpoll //' /etc/sysconfig/kdump
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/kernel.yaml
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/manifest.yaml
|
||||
@@ -0,0 +1,110 @@
|
||||
# Flip this back on, we're going to be a larger system
|
||||
recommends: true
|
||||
|
||||
include:
|
||||
- manifest-tier-0.yaml
|
||||
- bootable-rpm-ostree.yaml
|
||||
- podman.yaml
|
||||
- firmware.yaml
|
||||
- networking-tools.yaml
|
||||
- system-configuration.yaml
|
||||
- coreos-user-experience.yaml
|
||||
- fwupd.yaml
|
||||
- persistent-journal.yaml
|
||||
- initramfs-full.yaml
|
||||
- generic-growfs.yaml
|
||||
|
||||
packages:
|
||||
# Include and set the default editor
|
||||
- nano
|
||||
# And we expect this in general
|
||||
- vim-minimal
|
||||
- nfs-utils
|
||||
# Additional firewall support; we aren't including these in RHCOS or they
|
||||
# don't exist in RHEL
|
||||
- iptables-nft iptables-services
|
||||
- WALinuxAgent-udev
|
||||
# Allow communication between sudo and SSSD
|
||||
# for caching sudo rules by SSSD.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/445
|
||||
- libsss_sudo
|
||||
# SSSD; we only ship a subset of the backends
|
||||
- sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
|
||||
# Used by admins interactively
|
||||
- attr
|
||||
- openssl
|
||||
- lsof
|
||||
# Provides terminal tools like clear, reset, tput, and tset
|
||||
- ncurses
|
||||
# i18n
|
||||
- kbd
|
||||
# zram-generator (but not zram-generator-defaults) for F33 change
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/509
|
||||
- zram-generator
|
||||
# resolved was broken out to its own package in rawhide/f35
|
||||
- systemd-resolved
|
||||
# This one is in Python so isn't in FCOS, but we can safely add it here.
|
||||
- sos
|
||||
|
||||
# These are random architecture-specific packages
|
||||
packages-x86_64:
|
||||
- irqbalance
|
||||
packages-ppc64le:
|
||||
- irqbalance
|
||||
- librtas
|
||||
- powerpc-utils-core
|
||||
- ppc64-diag-rtas
|
||||
packages-aarch64:
|
||||
- irqbalance
|
||||
|
||||
postprocess:
|
||||
# Undo RPM scripts enabling units; we want the presets to be canonical
|
||||
# https://github.com/projectatomic/rpm-ostree/issues/1803
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
rm -rf /etc/systemd/system/*
|
||||
systemctl preset-all
|
||||
rm -rf /etc/systemd/user/*
|
||||
systemctl --user --global preset-all
|
||||
# Default to iptables-nft. Otherwise, legacy wins. We can drop this once/if we
|
||||
# remove iptables-legacy. This is needed because alternatives don't work
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/677
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/676
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
ln -sf /usr/sbin/ip6tables-nft /etc/alternatives/ip6tables
|
||||
ln -sf /usr/sbin/ip6tables-nft-restore /etc/alternatives/ip6tables-restore
|
||||
ln -sf /usr/sbin/ip6tables-nft-save /etc/alternatives/ip6tables-save
|
||||
ln -sf /usr/sbin/iptables-nft /etc/alternatives/iptables
|
||||
ln -sf /usr/sbin/iptables-nft-restore /etc/alternatives/iptables-restore
|
||||
ln -sf /usr/sbin/iptables-nft-save /etc/alternatives/iptables-save
|
||||
# See: https://github.com/coreos/fedora-coreos-tracker/issues/1253
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2112857
|
||||
# https://github.com/coreos/rpm-ostree/issues/3918
|
||||
# Temporary workaround to remove the SetGID binary from liblockfile that is
|
||||
# pulled by the s390utils but not needed for /usr/sbin/zipl.
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
set -xeuo pipefail
|
||||
rm -f /usr/bin/dotlockfile
|
||||
|
||||
# Things we don't expect to ship on the host. We currently
|
||||
# have recommends: false so these could only come in via
|
||||
# hard requirement, in which case the build will fail.
|
||||
exclude-packages:
|
||||
- perl
|
||||
- perl-interpreter
|
||||
- nodejs
|
||||
- grubby
|
||||
- cowsay # Just in case
|
||||
# Let's make sure initscripts doesn't get pulled back in
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
|
||||
- initscripts
|
||||
# For (datacenter/cloud oriented) servers, we want to see the details by default.
|
||||
# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/
|
||||
- plymouth
|
||||
# Do not use legacy ifcfg config format in NetworkManager
|
||||
# See https://github.com/coreos/fedora-coreos-config/pull/1991
|
||||
- NetworkManager-initscripts-ifcfg-rh
|
||||
@@ -0,0 +1,22 @@
|
||||
# This defines a set of tools that are useful for configuring, debugging,
|
||||
# or manipulating the network of a system. It is desired to keep this list
|
||||
# generic enough to be shared downstream with RHCOS.
|
||||
|
||||
packages:
|
||||
# Standard tools for configuring network/hostname
|
||||
- NetworkManager hostname
|
||||
# Interactive Networking configuration during coreos-install
|
||||
- NetworkManager-tui
|
||||
# Support for cloud quirks and dynamic config in real rootfs:
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/320
|
||||
- NetworkManager-cloud-setup
|
||||
# Route manipulation and QoS
|
||||
- iproute iproute-tc
|
||||
# Firewall manipulation
|
||||
- iptables nftables
|
||||
# Interactive network tools for admins
|
||||
- socat net-tools bind-utils
|
||||
|
||||
exclude-packages:
|
||||
# We use NetworkManager
|
||||
- systemd-networkd
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/ostree.yaml
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../tier-0/passwd
|
||||
File renamed without changes.
@@ -0,0 +1,7 @@
|
||||
# Core podman bits
|
||||
|
||||
packages:
|
||||
- crun
|
||||
- podman
|
||||
- container-selinux
|
||||
- skopeo
|
||||
@@ -0,0 +1,32 @@
|
||||
# These are packages that are related to configuring parts of the system.
|
||||
|
||||
packages:
|
||||
# Configuring SSH keys, cloud provider check-in, etc
|
||||
# TODO: needs Ignition kargs
|
||||
# - afterburn afterburn-dracut
|
||||
# NTP support
|
||||
- chrony
|
||||
# Storage configuration/management
|
||||
- lvm2
|
||||
- cryptsetup
|
||||
- e2fsprogs
|
||||
- sg3_utils
|
||||
- xfsprogs
|
||||
## This is generally useful... https://github.com/CentOS/centos-bootc/issues/394
|
||||
- cloud-utils-growpart
|
||||
# User configuration
|
||||
- passwd
|
||||
- shadow-utils
|
||||
- acl
|
||||
# Manipulating the kernel keyring; used by bootc
|
||||
- keyutils
|
||||
# There are things that write outside of the journal still (such as the
|
||||
# classic wtmp, etc.). auditd also writes outside the journal but it has its
|
||||
# own log rotation.
|
||||
# Anything package layered will also tend to expect files dropped in
|
||||
# /etc/logrotate.d to work. Really, this is a legacy thing, but if we don't
|
||||
# have it then people's disks will slowly fill up with logs.
|
||||
- logrotate
|
||||
# Boost starving threads
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/753
|
||||
- stalld
|
||||
@@ -1 +0,0 @@
|
||||
add_dracutmodules+=" lvm crypt fips "
|
||||
@@ -1,7 +0,0 @@
|
||||
# Our fallback
|
||||
enable bootc-generic-growpart.service
|
||||
|
||||
# We enable this by default just so we can say we have automatic
|
||||
# updates on by default, like CoreOS. It's very much intended
|
||||
# to be tweaked or replaced outside of trivial scenarios though.
|
||||
enable bootc-fetch-apply-updates.timer
|
||||
@@ -1,5 +0,0 @@
|
||||
# Workaround for https://github.com/konflux-ci/build-tasks-dockerfiles/pull/243
|
||||
d /var/roothome/buildinfo 0755 - - -
|
||||
d /var/roothome/buildinfo/content_manifests 0755 - - -
|
||||
# Note we don't actually try to recreate the content; this just makes the linter ignore it
|
||||
f /var/roothome/buildinfo/content_manifests/content-sets.json 0644 - - -
|
||||
@@ -1 +0,0 @@
|
||||
irqbalance
|
||||
@@ -1,21 +0,0 @@
|
||||
# Packages excluded by default
|
||||
|
||||
# We use NetworkManager
|
||||
systemd-networkd
|
||||
# But without the legacy
|
||||
# See https://github.com/coreos/fedora-coreos-config/pull/1991
|
||||
NetworkManager-initscripts-ifcfg-rh
|
||||
|
||||
# Let's not have both legacy and nft versions in the image. Users are free to
|
||||
# also layer legacy themselves if they want.
|
||||
iptables-legacy
|
||||
|
||||
# We use bootupd
|
||||
grubby
|
||||
# Let's make sure initscripts doesn't get pulled back in
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/220#issuecomment-611566254
|
||||
initscripts
|
||||
|
||||
# For (datacenter/cloud oriented) servers, we want to see the details by default.
|
||||
# https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/HSMISZ3ETWQ4ETVLWZQJ55ARZT27AAV3/
|
||||
plymouth
|
||||
@@ -1,4 +0,0 @@
|
||||
irqbalance
|
||||
librtas
|
||||
powerpc-utils-core
|
||||
ppc64-diag-rtas
|
||||
@@ -1,45 +0,0 @@
|
||||
# This file is simply a list of packages recommended to be used by default.
|
||||
# You can process this via e.g.
|
||||
# grep -E -v '^#' packages-recommended.txt | xargs dnf -y install
|
||||
|
||||
# Used by admins interactively
|
||||
attr
|
||||
bash-completion
|
||||
hostname
|
||||
iproute
|
||||
jq
|
||||
less
|
||||
vim-minimal
|
||||
# deps of bootc, but let's be explicit. e.g. even if bootc drops the skopeo
|
||||
# dep, we still want it
|
||||
podman skopeo
|
||||
# crun recommends but doesn't require criu and criu-libs. We want them for
|
||||
# checkpoint/restore. https://github.com/coreos/fedora-coreos-tracker/issues/1370
|
||||
crun criu criu-libs
|
||||
# storage
|
||||
cryptsetup
|
||||
lvm2
|
||||
tar
|
||||
# zram-generator (but not zram-generator-defaults) for F33 change
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/509
|
||||
zram-generator
|
||||
# networking
|
||||
iptables-nft
|
||||
NetworkManager
|
||||
openssh-clients
|
||||
openssh-server
|
||||
systemd-resolved
|
||||
# linux-firmware now a recommends so let's explicitly include it
|
||||
# https://gitlab.com/cki-project/kernel-ark/-/commit/32271d0cd9bd52d386eb35497c4876a8f041f70b
|
||||
# https://src.fedoraproject.org/rpms/kernel/c/f55c3e9ed8605ff28cb9a922efbab1055947e213?branch=rawhide
|
||||
linux-firmware
|
||||
# security
|
||||
polkit
|
||||
sudo
|
||||
# Allow for configuring different timezones
|
||||
tzdata
|
||||
# rpm-ostree
|
||||
rpm-ostree nss-altfiles
|
||||
# firmware updates
|
||||
# If you're using linux-firmware, you probably also want fwupd
|
||||
fwupd
|
||||
@@ -1 +0,0 @@
|
||||
irqbalance
|
||||
@@ -1,104 +0,0 @@
|
||||
# A relatively large base image suitable for headless servers,
|
||||
# a lot like CoreOS.
|
||||
|
||||
# Include and set the default editor
|
||||
nano
|
||||
nfs-utils
|
||||
# Additional firewall support; we aren't including these in RHCOS or they
|
||||
# don't exist in RHEL
|
||||
iptables-services
|
||||
WALinuxAgent-udev
|
||||
# Allow communication between sudo and SSSD
|
||||
# for caching sudo rules by SSSD.
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/445
|
||||
libsss_sudo
|
||||
# SSSD; we only ship a subset of the backends
|
||||
sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
|
||||
# Used by admins interactively
|
||||
openssl
|
||||
# Provides terminal tools like clear, reset, tput, and tset
|
||||
ncurses
|
||||
# i18n
|
||||
kbd
|
||||
# zram-generator (but not zram-generator-defaults) for F33 change
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/509
|
||||
zram-generator
|
||||
# This one is in Python so isn't in FCOS, but we can safely add it here.
|
||||
sos
|
||||
|
||||
# Additional file compression/decompression
|
||||
bzip2 zstd
|
||||
# Improved MOTD experience
|
||||
console-login-helper-messages-issuegen
|
||||
console-login-helper-messages-profile
|
||||
# kdump support
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/622
|
||||
kexec-tools
|
||||
# Container tooling
|
||||
toolbox
|
||||
# nvme-cli for managing nvme disks
|
||||
nvme-cli
|
||||
# Used by admins interactively
|
||||
lsof
|
||||
|
||||
# Explicit dep for RHEL >= 10
|
||||
crypto-policies-scripts
|
||||
# Configuring SSH keys, cloud provider check-in, etc
|
||||
# TODO: needs Ignition kargs
|
||||
# - afterburn afterburn-dracut
|
||||
# NTP support
|
||||
chrony
|
||||
# Storage configuration/management
|
||||
sg3_utils
|
||||
## This is generally useful... https://github.com/CentOS/centos-bootc/issues/394
|
||||
cloud-utils-growpart
|
||||
# User configuration
|
||||
passwd
|
||||
shadow-utils
|
||||
acl
|
||||
# Manipulating the kernel keyring; used by bootc
|
||||
keyutils
|
||||
# There are things that write outside of the journal still (such as the
|
||||
# classic wtmp, etc.). auditd also writes outside the journal but it has its
|
||||
# own log rotation.
|
||||
# Anything package layered will also tend to expect files dropped in
|
||||
# /etc/logrotate.d to work. Really, this is a legacy thing, but if we don't
|
||||
# have it then people's disks will slowly fill up with logs.
|
||||
logrotate
|
||||
# Boost starving threads
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/753
|
||||
stalld
|
||||
|
||||
# This defines a set of tools that are useful for configuring, debugging,
|
||||
# or manipulating the network of a system.
|
||||
# Interactive Networking configuration during coreos-install
|
||||
NetworkManager-tui
|
||||
# Support for cloud quirks and dynamic config in real rootfs:
|
||||
# https://github.com/coreos/fedora-coreos-tracker/issues/320
|
||||
NetworkManager-cloud-setup
|
||||
# Route manipulation and QoS
|
||||
iproute iproute-tc
|
||||
# Firewall manipulation
|
||||
iptables nftables
|
||||
# Interactive network tools for admins
|
||||
socat net-tools bind-utils
|
||||
|
||||
# These are recomended by other packages installed above.
|
||||
# recommended by containers-common-extra
|
||||
qemu-user-static
|
||||
# recommended by rpm-libs
|
||||
rpm-plugin-audit
|
||||
#recomended by gnupg2
|
||||
pinentry
|
||||
gnupg2-smime
|
||||
# recommended by dracut
|
||||
pigz
|
||||
memstrack
|
||||
kpartx
|
||||
# recommended by libxcrypt
|
||||
pkcs11-provider
|
||||
# recommended by containers-common
|
||||
fuse-overlayfs
|
||||
# recommended by toolbox
|
||||
cracklib-dicts
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -xeuo pipefail
|
||||
dnf clean all
|
||||
# Lots of cleaning
|
||||
rm -vrf /var/log /var/cache /var/lib/dnf
|
||||
@@ -1,29 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
dn=$(dirname $0)
|
||||
cd ${dn}
|
||||
dnf_args=()
|
||||
echo "Loading packages-excluded"
|
||||
for x in $(grep -E -v '^#' packages-excluded.txt); do
|
||||
dnf_args+=(--exclude ${x})
|
||||
done
|
||||
echo "Loading packages"
|
||||
package_files=(packages-recommended-minimal.txt packages.txt)
|
||||
pkgfile_for_arch=packages-$(arch).txt
|
||||
if test -f ${pkgfile_for_arch}; then
|
||||
echo "Loading ${pkgfile_for_arch}"
|
||||
package_files+=(${pkgfile_for_arch})
|
||||
fi
|
||||
base_pkgs=$(grep -hE -v '^#' ${package_files[@]})
|
||||
dnf -y ${dnf_args[@]} install $base_pkgs
|
||||
|
||||
# Ensure we regenerate the initramfs with new content
|
||||
# https://docs.fedoraproject.org/en-US/bootc/initramfs/
|
||||
kver=$(cd /usr/lib/modules && echo *); dracut -vf /usr/lib/modules/$kver/initramfs.img $kver
|
||||
|
||||
# Undo RPM scripts enabling units; we want the presets to be canonical for the base image.
|
||||
# https://github.com/projectatomic/rpm-ostree/issues/1803
|
||||
rm -rf /etc/systemd/system/*
|
||||
systemctl preset-all
|
||||
rm -rf /etc/systemd/user/*
|
||||
systemctl --user --global preset-all
|
||||
Reference in new issue
Block a user