Skip to content

Commit ec05690

Browse files
traviertravier
committed
examples: Add initial bootc examples (bls & uki)
Signed-off-by: Timothée Ravier <[email protected]>
1 parent fca625f commit ec05690

File tree

14 files changed

+262
-0
lines changed

14 files changed

+262
-0
lines changed

‎examples/bootc-bls/Containerfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY extra /
3+
COPY cfsctl /usr/bin
4+
5+
RUN passwd -d root
6+
7+
# need to have composefs setup root in the initramfs so we need this
8+
RUN set -x; \
9+
kver=$(cd /usr/lib/modules && echo *); \
10+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;

‎examples/bootc-bls/build

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
cargo build --release --features=pre-6.15 --bin cfsctl --bin composefs-setup-root
8+
9+
cp ../../target/release/cfsctl .
10+
cp ../../target/release/composefs-setup-root extra/usr/lib/dracut/modules.d/37composefs/
11+
12+
mkdir -p tmp
13+
14+
sudo podman build \
15+
-t quay.io/fedora/fedora-bootc-bls:42 \
16+
-f Containerfile \
17+
--iidfile=tmp/iid \

‎examples/bootc-bls/extra/etc/dracut.conf.d/no-xattr.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
export DRACUT_NO_XATTR=1

‎examples/bootc-bls/extra/usr/lib/dracut/dracut.conf.d/37composefs.conf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# we want to make sure the virtio disk drivers get included
2+
hostonly=no
3+
4+
# we need to force these in via the initramfs because we don't have modules in
5+
# the base image
6+
force_drivers+=" virtio_net vfat "

‎examples/bootc-bls/extra/usr/lib/dracut/modules.d/37composefs/composefs-setup-root.service

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Copyright (C) 2013 Colin Walters <[email protected]>
2+
#
3+
# This library is free software; you can redistribute it and/or
4+
# modify it under the terms of the GNU Lesser General Public
5+
# License as published by the Free Software Foundation; either
6+
# version 2 of the License, or (at your option) any later version.
7+
#
8+
# This library is distributed in the hope that it will be useful,
9+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11+
# Lesser General Public License for more details.
12+
#
13+
# You should have received a copy of the GNU Lesser General Public
14+
# License along with this library. If not, see <https://www.gnu.org/licenses/>.
15+
16+
[Unit]
17+
DefaultDependencies=no
18+
ConditionKernelCommandLine=composefs
19+
ConditionPathExists=/etc/initrd-release
20+
After=sysroot.mount
21+
Requires=sysroot.mount
22+
Before=initrd-root-fs.target
23+
Before=initrd-switch-root.target
24+
25+
OnFailure=emergency.target
26+
OnFailureJobMode=isolate
27+
28+
[Service]
29+
Type=oneshot
30+
ExecStart=/usr/bin/composefs-setup-root
31+
StandardInput=null
32+
StandardOutput=journal
33+
StandardError=journal+console
34+
RemainAfterExit=yes

‎examples/bootc-bls/extra/usr/lib/dracut/modules.d/37composefs/module-setup.sh

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#!/usr/bin/bash
2+
3+
check() {
4+
return 0
5+
}
6+
7+
depends() {
8+
return 0
9+
}
10+
11+
install() {
12+
inst \
13+
"${moddir}/composefs-setup-root" /usr/bin/composefs-setup-root
14+
inst \
15+
"${moddir}/composefs-setup-root.service" \
16+
"${systemdsystemunitdir}/composefs-setup-root.service"
17+
18+
$SYSTEMCTL -q --root "${initdir}" add-wants \
19+
'initrd-root-fs.target' 'composefs-setup-root.service'
20+
}

‎examples/bootc-uki/Containerfile.stage1

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM quay.io/fedora/fedora-bootc:42
2+
COPY extra /
3+
COPY cfsctl /usr/bin
4+
5+
RUN passwd -d root
6+
7+
# need to have composefs setup root in the initramfs so we need this
8+
RUN set -x; \
9+
kver=$(cd /usr/lib/modules && echo *); \
10+
dracut -vf --install "/etc/passwd /etc/group" /usr/lib/modules/$kver/initramfs.img $kver;

‎examples/bootc-uki/Containerfile.stage2

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
FROM quay.io/fedora/fedora-bootc-base-uki:42 AS base
2+
3+
FROM base as kernel
4+
5+
ARG COMPOSEFS_FSVERITY
6+
7+
RUN <<EOF
8+
set -eux
9+
10+
mkdir -p /etc/kernel /etc/dracut.conf.d
11+
echo "console=ttyS0,115200 composefs=${COMPOSEFS_FSVERITY} selinux=1 enforcing=0 systemd.debug_shell=1 root=UUID=6523f8ae-3eb1-4e2a-a05a-18b695ae656f rw" > /etc/kernel/cmdline
12+
13+
dnf install -y systemd-ukify;
14+
kver=$(cd /usr/lib/modules && echo *);
15+
ukify build \
16+
--linux /usr/lib/modules/$kver/vmlinuz \
17+
--initrd /usr/lib/modules/$kver/initramfs.img \
18+
--cmdline "@/etc/kernel/cmdline" \
19+
--output /boot/$kver.efi
20+
EOF
21+
22+
FROM base as final
23+
24+
RUN --mount=type=bind,from=kernel,target=/_mount/kernel <<EOF
25+
kver=$(cd /usr/lib/modules && echo *);
26+
mkdir -p /boot/EFI/Linux
27+
# We put the UKI in /boot for now due to composefs verity not being the
28+
# same due to mtime of /usr/lib/modules being changed
29+
cp /_mount/kernel/boot/$kver.efi /boot/EFI/Linux/$kver.efi;
30+
EOF
31+
32+
FROM base as final-final
33+
COPY --from=final /boot /boot

‎examples/bootc-uki/build.base

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
cargo build --release --features=pre-6.15 --bin cfsctl --bin composefs-setup-root
8+
9+
cp ../../target/release/cfsctl .
10+
cp ../../target/release/composefs-setup-root extra/usr/lib/dracut/modules.d/37composefs/
11+
12+
mkdir -p tmp
13+
14+
sudo podman build \
15+
-t quay.io/fedora/fedora-bootc-base-uki:42 \
16+
-f Containerfile.stage1 \
17+
--iidfile=tmp/iid \
18+
.

‎examples/bootc-uki/build.final

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/bin/bash
2+
3+
set -eux
4+
5+
cd "${0%/*}"
6+
7+
cargo build --release --features=pre-6.15 --bin cfsctl --bin composefs-setup-root
8+
9+
cp ../../target/release/cfsctl .
10+
11+
rm -rf tmp/sysroot
12+
mkdir -p tmp/sysroot/composefs
13+
14+
IMAGE_ID="$(sed s/sha256:// tmp/iid)"
15+
./cfsctl --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
16+
COMPOSEFS_FSVERITY="$(./cfsctl --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}")"
17+
18+
sudo podman build \
19+
-t quay.io/fedora/fedora-bootc-uki:42 \
20+
--build-arg=COMPOSEFS_FSVERITY="${COMPOSEFS_FSVERITY}" \
21+
-f Containerfile.stage2 \
22+
--iidfile=tmp/iid2
23+
24+
rm -rf tmp/efi
25+
mkdir -p tmp/efi
26+
./cfsctl --repo tmp/sysroot/composefs oci pull containers-storage:"${IMAGE_ID}"
27+
./cfsctl --repo tmp/sysroot/composefs oci compute-id --bootable "${IMAGE_ID}"
28+
./cfsctl --repo tmp/sysroot/composefs oci prepare-boot "${IMAGE_ID}" --bootdir tmp/efi
29+
30+
# For debugging, add --no-cache to podman command
31+
# mkdir tmp/internal-sysroot
32+
# # podman build \
33+
# --iidfile=tmp/iid \
34+
# -v "${PWD}/tmp/internal-sysroot:/tmp/sysroot:z,U" \
35+
# --secret=id=key,src=secureboot/db.key \
36+
# --secret=id=cert,src=secureboot/db.crt \
37+
38+
# See: https://wiki.archlinux.org/title/Unified_Extensible_Firmware_Interface/Secure_Boot
39+
# Alternative to generate keys for testing: `sbctl create-keys`
40+
# if [[ ! -d "secureboot" ]]; then
41+
# echo "Generating test Secure Boot keys"
42+
# mkdir secureboot
43+
# pushd secureboot > /dev/null
44+
# uuidgen --random > GUID.txt
45+
# openssl req -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Platform Key/" -out PK.crt
46+
# openssl x509 -outform DER -in PK.crt -out PK.cer
47+
# openssl req -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Key Exchange Key/" -out KEK.crt
48+
# openssl x509 -outform DER -in KEK.crt -out KEK.cer
49+
# openssl req -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj "/CN=Test Signature Database key/" -out db.crt
50+
# openssl x509 -outform DER -in db.crt -out db.cer
51+
# popd > /dev/null
52+
# fi

0 commit comments

Comments
 (0)