Various composefs work #1662

cgwalters · 2025-10-02T18:08:57Z

No description provided.

gemini-code-assist

Code Review

This pull request introduces a significant amount of work related to composefs, including switching the fs-verity hashing algorithm from SHA256 to SHA512, adding a new workflow for building 'sealed' images with Unified Kernel Images (UKIs), and making the composefs backend a default feature. The changes are mostly consistent and well-structured, with good use of type aliases to improve code clarity.

However, I've found a few issues that need attention:

There's some dead and potentially buggy code in the new xtask for building sealed images.
A new Dockerfile contains a leftover command that should be removed.
The documentation for newly added CLI options and subcommands is incomplete.

Please see my detailed comments for suggestions on how to address these points.

crates/xtask/src/xtask.rs

Dockerfile.cfsuki

gemini-code-assist · 2025-10-02T18:10:34Z

docs/src/man/bootc-install-to-disk.8.md

+**--composefs-native**
+
+
+
+**--insecure**
+
+
+
+    Default: false
+
+**--bootloader**=*BOOTLOADER*
+
+
+
+    Default: grub


The documentation for the new options --composefs-native, --insecure, and --bootloader is incomplete. Please add descriptions for these options to explain their purpose and usage.

gemini-code-assist · 2025-10-02T18:10:34Z

docs/src/man/bootc.8.md

 | **bootc usr-overlay** | Add a transient writable overlayfs on `/usr` |
 | **bootc install** | Install the running container to a target |
 | **bootc container** | Operations which can be executed as part of a container build |
+| **bootc composefs-finalize-staged** |  |


The description for the new subcommand bootc composefs-finalize-staged is missing. Please add a description to explain what this command does.

cgwalters · 2025-10-03T12:58:46Z

Split prep work for this to #1665

cgwalters · 2025-10-06T14:18:15Z

@jeckersb I ended up reworking this one to use the bootc-in-container for the sealing side because it would be too annoying in our CI to have it be on the host (which is ubuntu here).

jeckersb · 2025-10-06T18:38:26Z

crates/lib/src/cli.rs

+                // Allocate a tempdir
+                let td = tempdir_in("/var/tmp")?;
+                let td = td.path();
+                let td = &Dir::open_ambient_dir(td, cap_std::ambient_authority())?;


I don't think this is an issue even though claude pointed it out, but I still want to comment here to clarify.

Claude seems to think because this shadows the original td via the let td = td.path(); line, that the tempdir might get dropped early and there could potentially be issues with it getting cleaned up. But it's my impression that shadowing the variable doesn't change the semantics around when things get dropped. Which means that in this case, the original TempDir remains valid for the entire scope and won't be dropped until the end. Same as if it was called td_dir or something else unshadowed.

jeckersb · 2025-10-06T20:16:12Z

I'm guessing this is something to do with me running just build-sealed inside of my toolbox, but I'm getting...

$ podman build -t localhost/bootc --build-arg=COMPOSEFS_FSVERITY=23e148ffffc8f37e2609bfe450bc945fa97e984a788d93fc8f93f19f7fc9ef9a9359c252969d0e12ac10caa7dd9a9427f9ad1c74696dae9be2b2575817386ab9 --build-arg=base=localhost/bootc-unsealed --secret=id=key,src=target/test-secureboot/db.key --secret=id=cert,src=target/test-secureboot/db.crt -f Dockerfile.cfsuki .
Error: failed to parse query parameter 'secrets': "[\"id=key,src=podman-build-secret3148315696\",\"id=cert,src=podman-build-secret3059655711\"]": rename /var/tmp/libpod_builder3803266185/build/podman-build-secret3148315696 /var/tmp/libpod_builder3803266185/podman-build-secret3148315696: no such file or directory
error: command exited with non-zero code `podman build -t localhost/bootc --build-arg=COMPOSEFS_FSVERITY=23e148ffffc8f37e2609bfe450bc945fa97e984a788d93fc8f93f19f7fc9ef9a9359c252969d0e12ac10caa7dd9a9427f9ad1c74696dae9be2b2575817386ab9 --build-arg=base=localhost/bootc-unsealed --secret=id=key,src=target/test-secureboot/db.key --secret=id=cert,src=target/test-secureboot/db.crt -f Dockerfile.cfsuki .`: 125
error: Recipe `build-sealed` failed on line 18 with exit code 1

cgwalters · 2025-10-06T21:38:37Z

Hmm I don't know what's up with that error. Offhand it's perhaps something to do with the source bind path when it's relative? Does it work if you make it an absolute path? What's your wrapper for podman in the toolbox look like?

jeckersb · 2025-10-07T02:12:18Z

Hmm I don't know what's up with that error. Offhand it's perhaps something to do with the source bind path when it's relative? Does it work if you make it an absolute path? What's your wrapper for podman in the toolbox look like?

Nope still doesn't work with absolute paths

⬢ [jeckersb@toolbx bootc]$ ls -l /var/home/jeckersb/git/bootc/target/test-secureboot/db.{crt,key}
-rw-r--r--. 1 jeckersb jeckersb 1854 Oct  6 15:54 /var/home/jeckersb/git/bootc/target/test-secureboot/db.crt
-rw-------. 1 jeckersb jeckersb 3272 Oct  6 15:54 /var/home/jeckersb/git/bootc/target/test-secureboot/db.key
⬢ [jeckersb@toolbx bootc]$ podman build -t localhost/bootc --build-arg=COMPOSEFS_FSVERITY=23e148ffffc8f37e2609bfe450bc945fa97e984a788d93fc8f93f19f7fc9ef9a9359c252969d0e12ac10caa7dd9a9427f9ad1c74696dae9be2b2575817386ab9 --build-arg=base=localhost/bootc-unsealed --secret=id=key,src=/var/home/jeckersb/git/bootc/target/test-secureboot/db.key --secret=id=cert,src=/var/home/jeckersb/git/bootc/target/test-secureboot/db.crt -f Dockerfile.cfsuki .
Error: failed to parse query parameter 'secrets': "[\"id=key,src=podman-build-secret2171653322\",\"id=cert,src=podman-build-secret2161445125\"]": rename /var/tmp/libpod_builder2211788443/build/podman-build-secret2171653322 /var/tmp/libpod_builder2211788443/podman-build-secret2171653322: no such file or directory

I don't have any wrapper for podman in my toolbox, but I conditionally set CONTAINER_CONNECTION to go over the podman socket. From .bashrc:

if [ -n "${TOOLBOX_PATH}" ]
then
    CONTAINER_CONNECTION=host
fi

and then...

$ podman system connection list
Name        URI                                       Identity    Default     ReadWrite
host        unix:///run/user/1000/podman/podman.sock              true        true
$ systemctl --user status podman.socket
● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/user/podman.socket; enabled; preset: disabled)
     Active: active (listening) since Mon 2025-10-06 21:50:56 EDT; 13min ago
 Invocation: 0257bbab67374412a75a2c0b32b77018
   Triggers: ● podman.service
       Docs: man:podman-system-service(1)
     Listen: /run/user/1000/podman/podman.sock (Stream)
     CGroup: /user.slice/user-1000.slice/[email protected]/app.slice/podman.socket

I suspect there's just something weird going on with passing secrets across via podman-remote from inside of the toolbox. I'll poke at it more tomorrow.

Given the eyeball test the changes look good to me. From CI it looks like it needs a cargo fmt and an update to test image pull check since now we're pulling the image which it expects to be absent?

jeckersb · 2025-10-07T14:57:36Z

I suspect there's just something weird going on with passing secrets across via podman-remote from inside of the toolbox. I'll poke at it more tomorrow.

Testing a stripped-down case this morning, it works fine for me to pass secrets inside of the toolbox over podman-remote to the host. I've also verified that if I run the original podman command directly on the host, it works properly.

So I'm thinking now that it has something to do with passing secrets over podman-remote in combination with multistage builds.

jeckersb · 2025-10-07T20:52:13Z

I suspect there's just something weird going on with passing secrets across via podman-remote from inside of the toolbox. I'll poke at it more tomorrow.

Testing a stripped-down case this morning, it works fine for me to pass secrets inside of the toolbox over podman-remote to the host. I've also verified that if I run the original podman command directly on the host, it works properly.

So I'm thinking now that it has something to do with passing secrets over podman-remote in combination with multistage builds.

Ahhhhhh it's this - containers/podman#25314

I'll put in a separate PR to add that silly workaround to our .dockerignore

It's too spammy. Signed-off-by: Colin Walters <[email protected]>

The rationale for having c9s by default was that it's a lower bound (which is still true). But our CI covers that; I'd rather now have the default be c10s be the default as it will be the focus of features going forward. Signed-off-by: Colin Walters <[email protected]>

Signed-off-by: Colin Walters <[email protected]>

So it can be executed more generically on any container image as input and write to output. Signed-off-by: Colin Walters <[email protected]>

Signed-off-by: Colin Walters <[email protected]>

This ensures we're SHA-512 across the board. Signed-off-by: Colin Walters <[email protected]>

- Add build infrastructure to toplevel to seal - Change the install logic to detect UKIs and automatically enable composefs Signed-off-by: Colin Walters <[email protected]>

See containers/composefs-rs#131 Signed-off-by: Colin Walters <[email protected]>

Signed-off-by: Colin Walters <[email protected]>

bootc-bot bot requested a review from jeckersb October 2, 2025 18:09

github-actions bot added area/install Issues related to `bootc install` area/documentation Updates to the documentation labels Oct 2, 2025

gemini-code-assist bot reviewed Oct 2, 2025

View reviewed changes

cgwalters force-pushed the composefs-by-default branch from 837dc44 to cccc2f8 Compare October 6, 2025 14:10

jeckersb reviewed Oct 6, 2025

View reviewed changes

cgwalters force-pushed the composefs-by-default branch from cccc2f8 to d8c0ea4 Compare October 7, 2025 22:25

cgwalters added 8 commits October 7, 2025 19:22

packit: Disable copr failure messages

dc06140

It's too spammy. Signed-off-by: Colin Walters <[email protected]>

boot: Add some error context

4c7bb0e

Signed-off-by: Colin Walters <[email protected]>

ci: Move disk wrapper into Justfile

dd05fb7

So it can be executed more generically on any container image as input and write to output. Signed-off-by: Colin Walters <[email protected]>

Enable composefs by default

d40da84

Signed-off-by: Colin Walters <[email protected]>

Adjust all code to use ComposefsRepository alias

1be74d1

This ensures we're SHA-512 across the board. Signed-off-by: Colin Walters <[email protected]>

Various composefs enhancements

cae0e64

- Add build infrastructure to toplevel to seal - Change the install logic to detect UKIs and automatically enable composefs Signed-off-by: Colin Walters <[email protected]>

lints: Ignore /boot/EFI

59d6b11

See containers/composefs-rs#131 Signed-off-by: Colin Walters <[email protected]>

cgwalters force-pushed the composefs-by-default branch from d8c0ea4 to c03e6c6 Compare October 7, 2025 23:36

ci: Add coverage for composefs installs

e12b574

Signed-off-by: Colin Walters <[email protected]>

cgwalters force-pushed the composefs-by-default branch from c03e6c6 to e12b574 Compare October 7, 2025 23:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Various composefs work #1662

Various composefs work #1662

Uh oh!

cgwalters commented Oct 2, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Oct 2, 2025

Uh oh!

gemini-code-assist bot Oct 2, 2025

Uh oh!

cgwalters commented Oct 3, 2025

Uh oh!

cgwalters commented Oct 6, 2025

Uh oh!

jeckersb Oct 6, 2025

Uh oh!

jeckersb commented Oct 6, 2025

Uh oh!

cgwalters commented Oct 6, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

Uh oh!

Various composefs work #1662

Are you sure you want to change the base?

Various composefs work #1662

Uh oh!

Conversation

cgwalters commented Oct 2, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist bot Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Oct 2, 2025

Choose a reason for hiding this comment

Uh oh!

cgwalters commented Oct 3, 2025

Uh oh!

cgwalters commented Oct 6, 2025

Uh oh!

jeckersb Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

jeckersb commented Oct 6, 2025

Uh oh!

cgwalters commented Oct 6, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

jeckersb commented Oct 7, 2025

Uh oh!

Uh oh!