error: Installing to filesystem: Verifying empty rootfs: Requiring directory contains only mount points: Found entry in boot: efi

[supakeen]

After the latest bootc update (1.12.0) image-builder and bootc-image-builder are failing to produce any disk images out of containers that include this new version with:

mount/- (org.osbuild.xfs): mounting /dev/loop0p4 -> /store/tmp/buildroot-tmp-p1p9zjbo/mounts/
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p2 -> /store/tmp/buildroot-tmp-p1p9zjbo/mounts/boot/efi
Installing image: docker://quay.io/centos-bootc/centos-bootc:stream9
error: Installing to filesystem: Verifying empty rootfs: Requiring directory contains only mount points: Found entry in boot: efi

This was already mentioned in matrix by @dustymaybe; but I thought an upstream issue to track this would be benificial so I can direct our users to this.

It seems there's already an open PR to address this: #1904.

---

As a workaround users can build containers that pin bootc to 1.10.0 for now.

[alexlarsson]

This is affecting automotive too

[cgwalters]

OK, another one with us missing gating on bib in this repo. Will work on a point release.

[supakeen]

OK, another one with us missing gating on bib in this repo. Will work on a point release.

@travier and me started discussing how to have integration tests in bootc (and bootupd) here: coreos/bootupd#1050

[cgwalters]

I'm not immediately reproducing this problem. What precise container images are in play here?

For me a simple

$ sudo podman run \                                                                                                                                                                                                                                                                                     
         --rm \                                                                                                                                                                                                                                                                                            
         --privileged \                                                                                                                                                                                                                                                                                    
         --pull=newer \                                                                                                                                                                                                                                                                                    
         --security-opt label=type:unconfined_t \                                                                                                                                                                                                                                                          
         -v /tmp/output:/output \                                                                                                                                                                                                                                                                          
         -v /var/lib/containers/storage:/var/lib/containers/storage \                                                                                                                                                                                                                                      
         quay.io/centos-bootc/bootc-image-builder:latest \                                                                                                                                                                                                                                                 
         --type qcow2 \                                                                                                                                                                                                                                                                                    
         quay.io/centos-bootc/centos-bootc:stream10

works. And to be clear this is with

$ podman run --rm -ti quay.io/centos-bootc/centos-bootc:stream10 rpm -q bootc
bootc-1.12.0-1.el10.x86_64
$

[supakeen]

This was happening with quay.io/fedora/fedora-bootc:rawhide; the Fedora IoT issue (virt-s1/rhel-edge#11175) was also rawhide.

---

However, if I do the same build now, I cannot reproduce it anymore.

$ sudo podman run \
    --rm \
    -it \
    --privileged \
    --pull=newer \
    --security-opt label=type:unconfined_t \
    -v ./output:/output 
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    quay.io/centos-bootc/bootc-image-builder:latest \
    --type qcow2 \
    --rootfs ext4 \
    quay.io/fedora/fedora-bootc:rawhide

@alexlarsson where did you see this/did it go away for you as well?

[cgwalters]

OK I spent some tokens on this, the below is the output of our session

Assisted-by: OpenCode (Opus 4.5)

---

Summary

Issue #1907 reports that bootc 1.12.0 fails with Found entry in boot: efi when building disk images using bootc-image-builder or other osbuild tooling.

Error message:

error: Installing to filesystem: Verifying empty rootfs: Requiring directory contains only mount points: Found entry in boot: efi

Root Cause

The bug was introduced in PR #1727 ("install: Allow mounted directories during install to-filesystem") and affects bootc versions between 1.11.x/1.12.0 and the fix in PR #1904.

The buggy code in crates/lib/src/install.rs:

if etype == FileType::dir() && dir_fd.open_dir_noxdev(&entry_name)?.is_some() {
    require_dir_contains_only_mounts(&dir_fd, &entry_name)?;
} else {
    anyhow::bail!("Found entry in {dir_name}: {entry_name}");
}

When checking /boot and finding efi directory:

1. open_dir_noxdev("efi") returns None because /boot/efi is on a different device (it's a mount point)
2. The condition is_some() is false, so it falls through to the else branch
3. Error: "Found entry in boot: efi"

The fix (PR #1904): Changed to if etype == FileType::dir() - the mount point detection happens at the START of the recursive call, not in the condition.

When the Bug Triggers

The bug triggers when the partition layout has:

• / (root filesystem) with /boot as a directory on root (not a separate partition)
• /boot/efi as a separate mount point (different device)

This layout is used by:

• CentOS Automotive with ukiboot or aboot boot modes (the default)
• Custom container images with embedded disk.yaml that omits /boot partition

The bug does NOT trigger with the default bootc-image-builder layout, which has /boot as a separate partition.

Affected Versions

Component	Version	Status
bootc	1.12.0	Contains bug
bootc	1.12.0-1.el10 (RPM)	Contains bug (built Jan 9, 2026)
bootc	main branch	Fixed (PR #1904 merged Jan 14, 2026)
bootc-image-builder	latest	Uses bootc from container, so affected if container has 1.12.0

Reproduction Steps

Prerequisites

• A CentOS Stream 10 or similar system with podman
• bootc-image-builder container

Step 1: Create a container with a no-/boot partition layout

Create a Containerfile:

FROM quay.io/centos-bootc/centos-bootc:stream10

# Create a disk.yaml that omits /boot partition (only root + ESP)
# This mimics the CentOS Automotive ukiboot layout
RUN mkdir -p /usr/lib/bootc-image-builder && cat > /usr/lib/bootc-image-builder/disk.yaml << "DISKEOF"
.common:
  partitioning:
    guids:
      - &bios_boot_partition_guid "21686148-6449-6E6F-744E-656564454649"
      - &efi_system_partition_guid "C12A7328-F81F-11D2-BA4B-00A0C93EC93B"
      - &filesystem_data_guid "0FC63DAF-8483-4772-8E79-3D69D8477DE4"

partition_table:
  type: "gpt"
  partitions:
    - size: "1 MiB"
      bootable: true
      type: *bios_boot_partition_guid
    - size: "501 MiB"
      type: *efi_system_partition_guid
      payload_type: "filesystem"
      payload:
        type: vfat
        mountpoint: "/boot/efi"
        label: "EFI-SYSTEM"
        fstab_options: "umask=0077,shortname=winnt"
        fstab_freq: 0
        fstab_passno: 2
    - size: "4 GiB"
      type: *filesystem_data_guid
      payload_type: "filesystem"
      payload:
        type: xfs
        label: "root"
        mountpoint: "/"
        fstab_options: "ro"
DISKEOF

Build the container:

podman build -t localhost/bootc-noboot -f Containerfile .

Step 2: Build with bootc-image-builder

sudo podman run --rm --privileged \
  --security-opt label=type:unconfined_t \
  -v ./output:/output \
  -v /var/lib/containers/storage:/var/lib/containers/storage \
  quay.io/centos-bootc/bootc-image-builder:latest \
  --type qcow2 \
  localhost/bootc-noboot:latest

Step 3: Observe the error

The build will fail with:

mount/- (org.osbuild.xfs): mounting /dev/loop0p3 -> /store/tmp/.../mounts/
mount/boot-efi (org.osbuild.fat): mounting /dev/loop0p2 -> /store/tmp/.../mounts/boot/efi
Installing image: docker://localhost/bootc-noboot:latest
error: Installing to filesystem: Verifying empty rootfs: Requiring directory contains only mount points: Found entry in boot: efi

Note the mount layout:

• / mounted (partition 3)
• /boot/efi mounted (partition 2)
• No /boot mount - it's a directory on the root filesystem

Alternative Manual Reproduction

Without building a custom container, you can reproduce directly:

# Create filesystems
truncate -s 100M /tmp/test_efi.img
truncate -s 2G /tmp/test_root.img
mkfs.vfat /tmp/test_efi.img
mkfs.xfs /tmp/test_root.img

# Mount with /boot on root, /boot/efi as separate mount
mkdir -p /tmp/testmount
mount -o loop /tmp/test_root.img /tmp/testmount
mkdir -p /tmp/testmount/boot/efi
mount -o loop /tmp/test_efi.img /tmp/testmount/boot/efi

# Run bootc install (this will fail with the bug)
podman run --rm --privileged \
  -v /tmp/testmount:/testmount:rshared \
  quay.io/centos-bootc/centos-bootc:stream10 \
  bootc install to-filesystem \
    --skip-fetch-check \
    --generic-image \
    --source-imgref docker://quay.io/centos-bootc/centos-bootc:stream10 \
    /testmount

Expected error:

error: Installing to filesystem: Verifying empty rootfs: Requiring directory contains only mount points: Found entry in boot: efi

Related Issues

Repository	Issue
bootc-dev/bootc	#1907
osbuild/bootc-image-builder	#1178
osbuild/image-builder-cli	#430

Workaround

Until a bootc release containing PR #1904 is available, users can:

1. Pin bootc to version 1.10.0 in their container images
2. Use the default bib partition layout (which includes a separate /boot partition)

Fix Status

• PR install: Fix bug in mount point check #1904 merged: January 14, 2026
• Latest release (v1.12.0): Does NOT contain the fix
• Point release pending: Needed to ship the fix