diff --git a/build-rootfs b/build-rootfs index 026d8033a0..5fe255cd76 100755 --- a/build-rootfs +++ b/build-rootfs @@ -3,7 +3,7 @@ # This script is called by the Containerfile to build FCOS. Here's what it does at a high-level: # 1. It gathers the list of FCOS-specific packages using the manifests. # 2. It gathers the list of FCOS-specific overlays using the manifests. -# 3. It runs `bootc-base-imagectl rebuild`, passing in the packages and overlays. +# 3. It runs `bootc-base-imagectl make-rootfs`. # 4. It injects various metadata (e.g. image.json, live/ bits, platforms.json, and disk.yaml). # 5. It runs the postprocess scripts defined in the manifest. @@ -165,7 +165,7 @@ def build_rootfs(target_rootfs, srcdir, manifest_name, elif len(lockfile_repos) > 0: raise Exception(f"unknown lockfile-repo found in {lockfile_repos}") - overlays = gather_overlays(manifest, srcdir) + add_dirs = gather_add_dirs(manifest, srcdir) nodocs = (manifest.get('documentation') is False) recommends = manifest.get('recommends') # We generate the initramfs using dracut ourselves later after our @@ -179,8 +179,8 @@ def build_rootfs(target_rootfs, srcdir, manifest_name, with tempfile.NamedTemporaryFile(mode='w') as argsfile: for pkg in packages: argsfile.write(f"--install={pkg}\n") - for overlay in overlays: - argsfile.write(f"--add-dir={overlay}\n") + for add_dir in add_dirs: + argsfile.write(f"--add-dir={add_dir}\n") if nodocs: argsfile.write("--no-docs\n") # temporarily work around https://issues.redhat.com/browse/RHEL-97826 @@ -198,6 +198,9 @@ def build_rootfs(target_rootfs, srcdir, manifest_name, for locked_nevra in locked_nevras: argsfile.write(f"--lock={locked_nevra}\n") argsfile.flush() + # print out argsfile content for debugging + with open(argsfile.name, "r") as f: + print(f"Using following argsfile for bootc-base-imagectl:\n{f.read()}", flush=True) cache_arg = [] if os.path.isdir('/cache') and rpm_ostree_has_cachedir_fix(): cache_arg = ['--cachedir=/cache'] @@ -226,7 +229,7 @@ def build_rootfs(target_rootfs, srcdir, manifest_name, run_dracut(target_rootfs) cleanup_extraneous_files(target_rootfs) - calculate_inputhash(target_rootfs, overlays, manifest) + calculate_inputhash(target_rootfs, add_dirs, manifest) def get_bootc_base_imagectl_help(): return subprocess.check_output(['/usr/libexec/bootc-base-imagectl', 'build-rootfs', '-h'], encoding='utf-8') @@ -331,7 +334,7 @@ def run_postprocess_scripts(rootfs, manifest): with open(os.path.join(rootfs, name), mode='w') as f: os.fchmod(f.fileno(), 0o755) f.write(script) - print(f"Running CoreOS postprocess script {i}", flush=True) + print(f"\n<<< Running CoreOS postprocess script {i} >>>\n", flush=True) bwrap(rootfs, [f'/{name}'], env=env) os.unlink(os.path.join(rootfs, name)) @@ -453,19 +456,17 @@ def inject_version_info(rootfs, replace_version, version): f.write(f'{k}={v}\n') -# This re-implements cosa's overlay logic. -def gather_overlays(manifest, srcdir): - overlays = [] +def gather_add_dirs(manifest, srcdir): + add_dirs = [] for layer in manifest.get('ostree-layers', []): - assert layer.startswith('overlay/') - overlays.append(os.path.join(srcdir, 'overlay.d', layer[len('overlay/'):])) + add_dirs.append(os.path.join(srcdir, layer)) rootfs_override = os.path.join(srcdir, 'overrides/rootfs') if os.path.isdir(rootfs_override) and len(os.listdir(rootfs_override)) > 0: print("Injecting rootfs override") - overlays.append(rootfs_override) + add_dirs.append(rootfs_override) - return overlays + return add_dirs # Inject live/ bits. diff --git a/manifest.yaml b/manifest.yaml index 71ad5f66af..4080fd5a5a 100644 --- a/manifest.yaml +++ b/manifest.yaml @@ -1,7 +1,3 @@ -metadata: - # tell `cosa build` to default to buildah path - build_with_buildah: true - conditional-include: # TODO: There is no coreos-pool for RISCV yet # https://github.com/coreos/fedora-coreos-tracker/issues/1931 diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml deleted file mode 100644 index c82a148ca6..0000000000 --- a/manifests/fedora-coreos-base.yaml +++ /dev/null @@ -1,190 +0,0 @@ -# This file is most of a Fedora CoreOS like system; it inherits from "core". -# Add things in this file which are somewhat "opinionated", not necessarily -# core functionality. - -include: - - system-configuration.yaml - - ignition-and-ostree.yaml - - file-transfer.yaml - - networking-tools.yaml - - user-experience.yaml - - shared-el.yaml - - coreos-bootc-delta.yaml - -ostree-layers: - - overlay/05core - - overlay/08nouveau - - overlay/09misc - - overlay/10disk-images - - overlay/20platform-chrony - - overlay/30lvmdevices - -conditional-include: - - if: releasever < 44 - include: - postprocess: - # Enable SELinux booleans used by OpenShift - # https://github.com/coreos/fedora-coreos-tracker/issues/284 - # This definition is no longer used to actually effect change - # in the OpenShift Node images so let's drop it in 44+. The - # config for the OpenShift Node image is now in: - # https://github.com/openshift/os/blob/c96e35987fb1093beb7631f27aecf324ae8a44f5/packages-openshift.yaml#L98-L103 - - | - #!/usr/bin/bash - set -eux -o pipefail - setsebool -P -N container_use_cephfs on # RHBZ#1692369 - setsebool -P -N virt_use_samba on # RHBZ#1754825 - rm -f /etc/selinux/targeted/semanage.*.LOCK - - -# Be minimal -recommends: false -documentation: false - -# ⚠⚠⚠ ONLY TEMPORARY HACKS ALLOWED HERE; ALL ENTRIES NEED TRACKER LINKS ⚠⚠⚠ -# See also the version of this in fedora-coreos.yaml -postprocess: - - # Mask dnsmasq. We include dnsmasq for host services that use the dnsmasq - # binary but intentionally mask the systemd service so users can't easily - # use it as an external dns server. We prefer they use a container for that. - # https://github.com/coreos/fedora-coreos-tracker/issues/519 - - | - #!/usr/bin/bash - set -eux -o pipefail - systemctl mask dnsmasq.service - - # sudo prefers its config files to be mode 440, and some security scanners - # complain if /etc/sudoers.d files are world-readable. - # https://bugzilla.redhat.com/show_bug.cgi?id=1981979 - # This is added by the 05core overlay listed above. - - | - #!/usr/bin/env bash - set -xeuo pipefail - chmod 440 /etc/sudoers.d/coreos-sudo-group - - # Set the default systemd target to `multi-user.target`. - - | - #!/usr/bin/env bash - set -xeuo pipefail - ln -sf multi-user.target /usr/lib/systemd/system/default.target - - # Add the sudo group to /etc/group in container-native flow. - - | - #!/usr/bin/env bash - set -xeuo pipefail - if [ -f /run/.containerenv ]; then - grep sudo /usr/lib/group >> /etc/group - fi - - # Hack to avoid running out of space on aarch64. This should save us about 29M. - # https://github.com/coreos/fedora-coreos-tracker/issues/2004 - - | - #!/usr/bin/env bash - set -eux -o pipefail - rm -vrf /usr/lib/modules/*aarch64/dtb/qcom/ - - # Inject the ostree stateroot name from the NAME build-arg. - # This is done in postprocess rather than an overlay so that the - # value is sourced from build-args and shared across FCOS/RHCOS/SCOS. - - | - #!/usr/bin/bash - set -eux -o pipefail - cat > /usr/lib/bootc/install/20-ostree-stateroot.toml << EOF - [install] - stateroot = "${NAME}" - EOF - -# Packages listed here should be specific to Fedore CoreOS (as in not yet -# available in RHCOS or not desired in RHCOS). All other packages should go -# into one of the sub-manifests listed at the top. -packages: - # Security - - polkit - # Containers - - systemd-container catatonit - - fuse-overlayfs slirp4netns - # Some host applications(i.e. NetworkManager) use dnsmasq - # as the binary for some various utility operations. - # https://github.com/coreos/fedora-coreos-tracker/issues/519 - - dnsmasq - # For podman v4 netavark gets pulled in but it only recommends - # aardvark-dns (which provides name resolution based on container - # names). This functionality was previously provided by dnsname from - # podman-plugins in the podman v3 stack. - # See https://github.com/containers/netavark/pull/217 - - aardvark-dns - # Since we need `containernetworking-plugins` installed to continue - # to support CNI networks we need to also explicitly install - # `netavark` so we get both of them installed since both of them - # provide `container-network-stack`. - # https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717 - - netavark - # Active Directory support - - adcli - # Additional firewall support; we aren't including these in RHCOS or they - # don't exist in RHEL - - iptables-nft iptables-services - # WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362 - - wireguard-tools - # Storage - - btrfs-progs - # Allow communication between sudo and SSSD - # for caching sudo rules by SSSD. - # https://github.com/coreos/fedora-coreos-tracker/issues/445 - - libsss_sudo - # SSSD; we only ship a subset of the backends - - sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap - # Used by admins interactively - - attr - - openssl - # Provides terminal tools like clear, reset, tput, and tset - - ncurses - # file-transfer: note fuse-sshfs is not in RHEL - # so we can't put it in file-transfer.yaml - - fuse-sshfs - # Improved MOTD experience - - console-login-helper-messages-motdgen - # i18n - - kbd - # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora - - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746 - -# - irqbalance -# - This thing is crying out to be pulled into systemd, but that hasn't happened -# yet. Also we may want to add to rpm-ostree something like arch negation; -# basically right now it doesn't exist on s390x. -# Anyways, it was requested by the Red Hat perf team for RHCOS, so we have it here. -# https://serverfault.com/questions/513807/is-there-still-a-use-for-irqbalance-on-modern-hardware -# https://access.redhat.com/solutions/41535 -# - qemu-user-static-x86 -# - Include this on non-x86_64 FCOS images to allow access to the large -# inventory of containers only built for x86_64. -# https://github.com/coreos/fedora-coreos-tracker/issues/1237 -# - google-compute-engine-guest-configs-udev -# - Add this package on x86_64 and aarch64 (the two architectures -# GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494 -# This should be moved to a shared manifest when RHEL has this package. -# - crun-wasm wasmedge-rt -# - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375 -packages-x86_64: - - irqbalance - - google-compute-engine-guest-configs-udev - - crun-wasm wasmedge-rt - # Include AMD microcode updates, see https://github.com/coreos/fedora-coreos-tracker/issues/1618. - # This normally should belong in bootable-rpm-ostree.yaml (alongside - # `microcode_ctl`), but this change hasn't hit RHCOS yet. - - amd-ucode-firmware -packages-ppc64le: - - irqbalance - - librtas - - powerpc-utils-core - - ppc64-diag-rtas - - qemu-user-static-x86 -packages-aarch64: - - irqbalance - - qemu-user-static-x86 - - google-compute-engine-guest-configs-udev - - crun-wasm wasmedge-rt -packages-s390x: - - qemu-user-static-x86 diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml index 35499fcb21..51705861f8 100644 --- a/manifests/fedora-coreos.yaml +++ b/manifests/fedora-coreos.yaml @@ -2,7 +2,13 @@ # into "official" builds of Fedora CoreOS (such as including `fedora-release-coreos`) # or are very "opinionated" like disabling SSH passwords by default. -include: fedora-coreos-base.yaml +# Be minimal +recommends: false +documentation: false + +include: + - shared-el.yaml + conditional-include: # If not on a production stream then disable Zincati - if: @@ -28,7 +34,7 @@ conditional-include: - if: basearch == "aarch64" include: ostree-layers: - - overlay/10aarch64 + - overlay.d/10aarch64 # Temporary workaround. containers-common moved policy.json from # /etc/containers to /usr/share/containers. The rpm-ostreed bind mount # could use CONTAINERS_POLICY_JSON env var instead, but bootc has a @@ -49,10 +55,66 @@ conditional-include: cp "${src}" "${dest}" ostree-layers: - - overlay/15fcos - - overlay/17fcos-container-signing + - overlay.d/09misc + - overlay.d/10disk-images + - overlay.d/15fcos + - overlay.d/17fcos-container-signing +# Packages listed here should be specific to Fedore CoreOS (as in not yet +# available in RHCOS or not desired in RHCOS). All other packages should go +# into one of the sub-manifests listed at the top. packages: + # Security + - polkit + # Containers + - systemd-container catatonit + - fuse-overlayfs slirp4netns + # Some host applications(i.e. NetworkManager) use dnsmasq + # as the binary for some various utility operations. + # https://github.com/coreos/fedora-coreos-tracker/issues/519 + - dnsmasq + # For podman v4 netavark gets pulled in but it only recommends + # aardvark-dns (which provides name resolution based on container + # names). This functionality was previously provided by dnsname from + # podman-plugins in the podman v3 stack. + # See https://github.com/containers/netavark/pull/217 + - aardvark-dns + # Since we need `containernetworking-plugins` installed to continue + # to support CNI networks we need to also explicitly install + # `netavark` so we get both of them installed since both of them + # provide `container-network-stack`. + # https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717 + - netavark + # Active Directory support + - adcli + # Additional firewall support; we aren't including these in RHCOS or they + # don't exist in RHEL + - iptables-nft iptables-services + # WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362 + - wireguard-tools + # Storage + - btrfs-progs + # Allow communication between sudo and SSSD + # for caching sudo rules by SSSD. + # https://github.com/coreos/fedora-coreos-tracker/issues/445 + - libsss_sudo + # SSSD; we only ship a subset of the backends + - sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap + # Used by admins interactively + - attr + - openssl + # Provides terminal tools like clear, reset, tput, and tset + - ncurses + # file-transfer: note fuse-sshfs is not in RHEL + # so we can't put it in file-transfer.yaml + - fuse-sshfs + # Improved MOTD experience + - console-login-helper-messages-motdgen + # i18n + - kbd + # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora + - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746 + # CoreOS release RPM - fedora-release-coreos # CL ships this. - moby-engine @@ -68,9 +130,99 @@ packages: # obsoletes nfs-utils-coreos - nfs-client-utils +# Architecture specific packages: +# - irqbalance +# - This thing is crying out to be pulled into systemd, but that hasn't happened +# yet. Also we may want to add to rpm-ostree something like arch negation; +# basically right now it doesn't exist on s390x. +# Anyways, it was requested by the Red Hat perf team for RHCOS, so we have it here. +# https://serverfault.com/questions/513807/is-there-still-a-use-for-irqbalance-on-modern-hardware +# https://access.redhat.com/solutions/41535 +# - qemu-user-static-x86 +# - Include this on non-x86_64 FCOS images to allow access to the large +# inventory of containers only built for x86_64. +# https://github.com/coreos/fedora-coreos-tracker/issues/1237 +# - google-compute-engine-guest-configs-udev +# - Add this package on x86_64 and aarch64 (the two architectures +# GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494 +# This should be moved to a shared manifest when RHEL has this package. +# - crun-wasm wasmedge-rt +# - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375 +packages-x86_64: + - irqbalance + - google-compute-engine-guest-configs-udev + - crun-wasm wasmedge-rt + # Include AMD microcode updates, see https://github.com/coreos/fedora-coreos-tracker/issues/1618. + # This normally should belong in bootable-rpm-ostree.yaml (alongside + # `microcode_ctl`), but this change hasn't hit RHCOS yet. + - amd-ucode-firmware +packages-ppc64le: + - irqbalance + - librtas + - powerpc-utils-core + - ppc64-diag-rtas + - qemu-user-static-x86 +packages-aarch64: + - irqbalance + - qemu-user-static-x86 + - google-compute-engine-guest-configs-udev + - crun-wasm wasmedge-rt +packages-s390x: + - qemu-user-static-x86 + # ⚠⚠⚠ ONLY TEMPORARY HACKS ALLOWED HERE; ALL ENTRIES NEED TRACKER LINKS ⚠⚠⚠ # See also the version of this in fedora-coreos-base.yaml postprocess: + # Mask dnsmasq. We include dnsmasq for host services that use the dnsmasq + # binary but intentionally mask the systemd service so users can't easily + # use it as an external dns server. We prefer they use a container for that. + # https://github.com/coreos/fedora-coreos-tracker/issues/519 + - | + #!/usr/bin/bash + set -eux -o pipefail + systemctl mask dnsmasq.service + + # sudo prefers its config files to be mode 440, and some security scanners + # complain if /etc/sudoers.d files are world-readable. + # https://bugzilla.redhat.com/show_bug.cgi?id=1981979 + # This is added by the 05core overlay listed above. + - | + #!/usr/bin/env bash + set -xeuo pipefail + chmod 440 /etc/sudoers.d/coreos-sudo-group + + # Set the default systemd target to `multi-user.target`. + - | + #!/usr/bin/env bash + set -xeuo pipefail + ln -sf multi-user.target /usr/lib/systemd/system/default.target + + # Add the sudo group to /etc/group in container-native flow. + - | + #!/usr/bin/env bash + set -xeuo pipefail + if [ -f /run/.containerenv ]; then + grep sudo /usr/lib/group >> /etc/group + fi + + # Hack to avoid running out of space on aarch64. This should save us about 29M. + # https://github.com/coreos/fedora-coreos-tracker/issues/2004 + - | + #!/usr/bin/env bash + set -eux -o pipefail + rm -vrf /usr/lib/modules/*aarch64/dtb/qcom/ + + # Inject the ostree stateroot name from the NAME build-arg. + # This is done in postprocess rather than an overlay so that the + # value is sourced from build-args and shared across FCOS/RHCOS/SCOS. + - | + #!/usr/bin/bash + set -eux -o pipefail + cat > /usr/lib/bootc/install/20-ostree-stateroot.toml << EOF + [install] + stateroot = "${NAME}" + EOF + # Disable Zincati on non-release builds # https://github.com/coreos/fedora-coreos-tracker/issues/212 - | @@ -81,6 +233,7 @@ postprocess: mkdir -p /etc/zincati/config.d echo -e '# https://github.com/coreos/fedora-coreos-tracker/issues/212\nupdates.enabled = false' > /etc/zincati/config.d/95-disable-on-dev.toml fi + # Users shouldn't be configuring `rpm-ostreed.conf` # https://github.com/coreos/fedora-coreos-tracker/issues/271 - | diff --git a/manifests/shared-el.yaml b/manifests/shared-el.yaml index 9b4dce5ecd..0cbd5ff239 100644 --- a/manifests/shared-el.yaml +++ b/manifests/shared-el.yaml @@ -1,3 +1,11 @@ +include: + - system-configuration.yaml + - ignition-and-ostree.yaml + - file-transfer.yaml + - networking-tools.yaml + - user-experience.yaml + - coreos-bootc-delta.yaml + conditional-include: # Include shared-el9 workarounds on Fedora and EL9 - if: id == "fedora" @@ -28,3 +36,20 @@ conditional-include: - azure-vm-utils # Include udev rules azure storage and productid - WALinuxAgent-udev + + # Include the layers that are shared amongst Fedora and EL + # (though at different import paths). + - if: id == "fedora" + include: + ostree-layers: + - overlay.d/05core + - overlay.d/08nouveau + - overlay.d/20platform-chrony + - overlay.d/30lvmdevices + - if: id != "fedora" + include: + ostree-layers: + - fedora-coreos-config/overlay.d/05core + - fedora-coreos-config/overlay.d/08nouveau + - fedora-coreos-config/overlay.d/20platform-chrony + - fedora-coreos-config/overlay.d/30lvmdevices