Update approach to handling boot resources

allisonkarlitskaya · allisonkarlitskaya · commit a4cbd3e143a1 · 2025-05-05T21:41:49.000+02:00
Drop the hidden "meta" layer approach where we try to preserve the image without the boot resources and move to a model where we explicitly delete the /boot directory if it exists. This makes creating images a lot cleaner and more natural, shown by the cleanup in the examples. At the same time we also add support for finding resources from the locations that they're present in bootc images: /usr/lib/modules in versioned subdirectories with vmlinuz and initramfs.img. Add some example "simple" writer code that can write the boot resources to a given directory. We deal with the /usr/lib/modules cases by converting them into Type #1 boot entries and writing them as such. Other consumers of this API might want to do other things, such as producing grub entries, etc. Overhaul the cfsctl oci prepare-boot command to use the new stuff. Fixes #35 Fixes #21 Signed-off-by: Allison Karlitskaya <allison.karlitskaya@redhat.com>
diff --git a/examples/bls/Containerfile b/examples/bls/Containerfile
@@ -16,9 +16,5 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
     systemctl enable systemd-networkd
     passwd -d root
     mkdir /sysroot
-    mkdir /composefs-meta
-    mv /boot /composefs-meta
-    mkdir /boot
 EOF
 COPY cfsctl /usr/bin
-RUN true  # hack to get an extra layer
diff --git a/examples/bls/Containerfile.arch b/examples/bls/Containerfile.arch
@@ -22,9 +22,5 @@ RUN <<EOF
     systemctl enable systemd-networkd systemd-resolved sshd
     passwd -d root
     mkdir /sysroot
-    mkdir /composefs-meta
-    mv /boot /composefs-meta
-    mkdir /boot
 EOF
 COPY cfsctl /usr/bin
-RUN true
diff --git a/examples/bls/Containerfile.rawhide b/examples/bls/Containerfile.rawhide
@@ -16,9 +16,5 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
     systemctl enable systemd-networkd
     passwd -d root
     mkdir /sysroot
-    mkdir /composefs-meta
-    mv /boot /composefs-meta
-    mkdir /boot
 EOF
 COPY cfsctl /usr/bin
-RUN true  # hack to get an extra layer
diff --git a/examples/bls/Containerfile.rhel9 b/examples/bls/Containerfile.rhel9
@@ -23,9 +23,5 @@ RUN --mount=type=cache,target=/var/cache/dnf <<EOF
     systemctl enable tmp.mount
     passwd -d root
     mkdir /sysroot
-    mkdir /composefs-meta
-    mv /boot /composefs-meta
-    mkdir /boot
 EOF
 COPY cfsctl /usr/bin
-RUN true  # hack to get an extra layer
diff --git a/examples/bls/Containerfile.ubuntu b/examples/bls/Containerfile.ubuntu
@@ -34,9 +34,5 @@ RUN <<EOF
     systemctl enable systemd-networkd systemd-resolved
     passwd -d root
     mkdir /sysroot
-    mkdir /composefs-meta
-    mv /boot /composefs-meta
-    mkdir /boot
 EOF
 COPY cfsctl /usr/bin
-RUN true
diff --git a/examples/bls/build b/examples/bls/build
@@ -49,19 +49,9 @@ podman build \
     .
 
 BASE_ID="$(sed s/sha256:// tmp/base.iid)"
-${CFSCTL} oci pull containers-storage:${BASE_ID}
-BASE_IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${BASE_ID}")"
-${CFSCTL} oci prepare-boot "${BASE_ID}" --bootdir tmp/efi
 
-OPTIONS="console=ttyS0,115200 composefs=${BASE_IMAGE_FSVERITY} rw"
-BLE="$(echo tmp/efi/loader/entries/*.conf)"
-test -f "${BLE}"
-if grep '^options ' "${BLE}"; then
-    sed -i "s|^options .*$|\0 ${OPTIONS}|" "${BLE}"
-else
-    echo "options    ${OPTIONS}" >> "${BLE}"
-fi
-sed -i 's@ /boot/@ /@' "${BLE}"
+${CFSCTL} oci pull containers-storage:${BASE_ID}
+${CFSCTL} oci prepare-boot "${BASE_ID}" --bootdir tmp/efi --cmdline console=ttyS0,115200 --entry-id=example --cmdline rw
 
 ../common/install-systemd-boot
 ../common/make-image "${os}-bls-efi.qcow2"
diff --git a/examples/uki/Containerfile b/examples/uki/Containerfile
@@ -52,9 +52,5 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
     dnf --setopt keepcache=1 install -y kernel btrfs-progs systemd-boot-unsigned systemd-ukify
 EOF
 
-# This could (better?) be done from cfsctl...
 FROM base AS bootable
-COPY --from=kernel /boot /composefs-meta/boot
-# https://github.com/containers/buildah/issues/5950
-RUN --mount=type=tmpfs,target=/run \
-    rm -rf /composefs-meta
+COPY --from=kernel /boot /boot
diff --git a/examples/uki/Containerfile.arch b/examples/uki/Containerfile.arch
@@ -31,9 +31,5 @@ RUN <<EOF
     mkinitcpio -p linux
 EOF
 
-# This could (better?) be done from cfsctl...
 FROM base AS bootable
-COPY --from=kernel /boot /composefs-meta/boot
-# https://github.com/containers/buildah/issues/5950
-RUN --mount=type=tmpfs,target=/run \
-    rm -rf /composefs-meta
+COPY --from=kernel /boot /boot
diff --git a/examples/uki/build b/examples/uki/build
@@ -54,10 +54,6 @@ ${PODMAN_BUILD} \
 
 FINAL_ID="$(sed s/sha256:// tmp/final.iid)"
 ${CFSCTL} oci pull containers-storage:"${FINAL_ID}"
-FINAL_IMAGE_FSVERITY="$(${CFSCTL} oci compute-id --bootable "${FINAL_ID}")"
-
-## IMPORTANT: the filesystems of the base and final images are identical
-test "${BASE_IMAGE_FSVERITY}" = "${FINAL_IMAGE_FSVERITY}"
 ${CFSCTL} oci prepare-boot "${FINAL_ID}" --bootdir tmp/efi
 
 ../common/install-systemd-boot
diff --git a/examples/unified-secureboot/Containerfile b/examples/unified-secureboot/Containerfile
@@ -44,9 +44,5 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 \
     dnf --setopt keepcache=1 install -y kernel btrfs-progs systemd-boot-unsigned systemd-ukify sbsigntools
 EOF
 
-# This could (better?) be done from cfsctl...
 FROM base AS bootable
-COPY --from=kernel /boot /composefs-meta/boot
-# https://github.com/containers/buildah/issues/5950
-RUN --mount=type=tmpfs,target=/run \
-    rm -rf /composefs-meta
+COPY --from=kernel /boot /boot
diff --git a/examples/unified/Containerfile b/examples/unified/Containerfile
@@ -41,9 +41,5 @@ RUN --mount=type=cache,target=/var/cache/libdnf5 <<EOF
     dnf --setopt keepcache=1 install -y kernel btrfs-progs systemd-boot-unsigned systemd-ukify
 EOF
 
-# This could (better?) be done from cfsctl...
 FROM base AS bootable
-COPY --from=kernel /boot /composefs-meta/boot
-# https://github.com/containers/buildah/issues/5950
-RUN --mount=type=tmpfs,target=/run \
-    rm -rf /composefs-meta
+COPY --from=kernel /boot /boot
diff --git a/src/bin/cfsctl.rs b/src/bin/cfsctl.rs
@@ -4,7 +4,7 @@ use std::{
     sync::Arc,
 };
 
-use anyhow::Result;
+use anyhow::{bail, Result};
 use clap::{Parser, Subcommand};
 
 use rustix::fs::CWD;
@@ -73,14 +73,15 @@ enum OciCommand {
         name: String,
         mountpoint: String,
     },
-    MetaLayer {
-        name: String,
-    },
     PrepareBoot {
         config_name: String,
         config_verity: Option<String>,
         #[clap(long, default_value = "/boot")]
         bootdir: PathBuf,
+        #[clap(long)]
+        entry_id: Option<String>,
+        #[clap(long)]
+        cmdline: Vec<String>,
     },
 }
 
@@ -244,16 +245,31 @@ async fn main() -> Result<()> {
             } => {
                 oci::mount(&repo, name, mountpoint, None)?;
             }
-            OciCommand::MetaLayer { ref name } => {
-                oci::meta_layer(&repo, name, None)?;
-            }
             OciCommand::PrepareBoot {
                 ref config_name,
                 ref config_verity,
                 ref bootdir,
+                ref entry_id,
+                ref cmdline,
             } => {
                 let verity = verity_opt(config_verity)?;
-                let id = oci::prepare_boot(&repo, config_name, verity.as_ref(), bootdir)?;
+                let mut fs = oci::image::create_filesystem(&repo, config_name, verity.as_ref())?;
+                let entries = fs.transform_for_boot(&repo)?;
+                let id = fs.commit_image(&repo, None)?;
+
+                let Some(entry) = entries.into_iter().next() else {
+                    bail!("No boot entries!");
+                };
+
+                let cmdline_refs: Vec<&str> = cmdline.iter().map(String::as_str).collect();
+                composefs::write_boot::write_boot_simple(
+                    &repo,
+                    entry,
+                    &id,
+                    bootdir,
+                    entry_id.as_deref(),
+                    &cmdline_refs,
+                )?;
 
                 let state = args
                     .repo
diff --git a/src/bootloader.rs b/src/bootloader.rs
diff --git a/src/filesystem_ops.rs b/src/filesystem_ops.rs
diff --git a/src/lib.rs b/src/lib.rs
diff --git a/src/oci/mod.rs b/src/oci/mod.rs
diff --git a/src/tree.rs b/src/tree.rs
diff --git a/src/write_boot.rs b/src/write_boot.rs
