From 7572dec67e37d542cca96c57234d2c189750917e Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 22:52:36 -0400
Subject: [PATCH 1/8] build-rootfs: add debug statement, fixup comment

Make the comment at the top more accurate and add some debug logs
for the arguemnts in the args file that are passed in so we can see
what's happening under the hood during a build.
---
 build-rootfs | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/build-rootfs b/build-rootfs
index 026d8033a0..cbe9822add 100755
--- a/build-rootfs
+++ b/build-rootfs
@@ -3,7 +3,7 @@
 # This script is called by the Containerfile to build FCOS. Here's what it does at a high-level:
 # 1. It gathers the list of FCOS-specific packages using the manifests.
 # 2. It gathers the list of FCOS-specific overlays using the manifests.
-# 3. It runs `bootc-base-imagectl rebuild`, passing in the packages and overlays.
+# 3. It runs `bootc-base-imagectl make-rootfs`.
 # 4. It injects various metadata (e.g. image.json, live/ bits, platforms.json, and disk.yaml).
 # 5. It runs the postprocess scripts defined in the manifest.
 
@@ -198,6 +198,9 @@ def build_rootfs(target_rootfs, srcdir, manifest_name,
             for locked_nevra in locked_nevras:
                 argsfile.write(f"--lock={locked_nevra}\n")
         argsfile.flush()
+        # print out argsfile content for debugging
+        with open(argsfile.name, "r") as f:
+            print(f"Using following argsfile for bootc-base-imagectl:\n{f.read()}", flush=True)
         cache_arg = []
         if os.path.isdir('/cache') and rpm_ostree_has_cachedir_fix():
             cache_arg = ['--cachedir=/cache']

From 5b17f9514b0937e0d89fcfdf8493175a285e25f0 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 22:53:54 -0400
Subject: [PATCH 2/8] build-rootfs: rework overlay processing to handle path
 directly

Previously ostree-layers entries strings had to start with '/overlay'
and it was hardcoded to look into the overlay.d/ directory for them.

Rather than this let's just have the strings in the list be the actual
directory the override resides in.

Also here we rename a bunch of variables in build-rootfs to be add_dirs
instead of overlays, because the argument to bootc-base-imagectl is
--add-dir.
---
 build-rootfs                      | 20 +++++++++-----------
 manifests/fedora-coreos-base.yaml | 12 ++++++------
 manifests/fedora-coreos.yaml      |  6 +++---
 3 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/build-rootfs b/build-rootfs
index cbe9822add..649461288b 100755
--- a/build-rootfs
+++ b/build-rootfs
@@ -165,7 +165,7 @@ def build_rootfs(target_rootfs, srcdir, manifest_name,
         elif len(lockfile_repos) > 0:
             raise Exception(f"unknown lockfile-repo found in {lockfile_repos}")
 
-    overlays = gather_overlays(manifest, srcdir)
+    add_dirs = gather_add_dirs(manifest, srcdir)
     nodocs = (manifest.get('documentation') is False)
     recommends = manifest.get('recommends')
     # We generate the initramfs using dracut ourselves later after our
@@ -179,8 +179,8 @@ def build_rootfs(target_rootfs, srcdir, manifest_name,
     with tempfile.NamedTemporaryFile(mode='w') as argsfile:
         for pkg in packages:
             argsfile.write(f"--install={pkg}\n")
-        for overlay in overlays:
-            argsfile.write(f"--add-dir={overlay}\n")
+        for add_dir in add_dirs:
+            argsfile.write(f"--add-dir={add_dir}\n")
         if nodocs:
             argsfile.write("--no-docs\n")
             # temporarily work around https://issues.redhat.com/browse/RHEL-97826
@@ -229,7 +229,7 @@ def build_rootfs(target_rootfs, srcdir, manifest_name,
     run_dracut(target_rootfs)
     cleanup_extraneous_files(target_rootfs)
 
-    calculate_inputhash(target_rootfs, overlays, manifest)
+    calculate_inputhash(target_rootfs, add_dirs, manifest)
 
 def get_bootc_base_imagectl_help():
     return subprocess.check_output(['/usr/libexec/bootc-base-imagectl', 'build-rootfs', '-h'], encoding='utf-8')
@@ -456,19 +456,17 @@ def inject_version_info(rootfs, replace_version, version):
             f.write(f'{k}={v}\n')
 
 
-# This re-implements cosa's overlay logic.
-def gather_overlays(manifest, srcdir):
-    overlays = []
+def gather_add_dirs(manifest, srcdir):
+    add_dirs = []
     for layer in manifest.get('ostree-layers', []):
-        assert layer.startswith('overlay/')
-        overlays.append(os.path.join(srcdir, 'overlay.d', layer[len('overlay/'):]))
+        add_dirs.append(os.path.join(srcdir, layer))
 
     rootfs_override = os.path.join(srcdir, 'overrides/rootfs')
     if os.path.isdir(rootfs_override) and len(os.listdir(rootfs_override)) > 0:
         print("Injecting rootfs override")
-        overlays.append(rootfs_override)
+        add_dirs.append(rootfs_override)
 
-    return overlays
+    return add_dirs
 
 
 # Inject live/ bits.
diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index c82a148ca6..50a8eb6aab 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -12,12 +12,12 @@ include:
   - coreos-bootc-delta.yaml
 
 ostree-layers:
-  - overlay/05core
-  - overlay/08nouveau
-  - overlay/09misc
-  - overlay/10disk-images
-  - overlay/20platform-chrony
-  - overlay/30lvmdevices
+  - overlay.d/05core
+  - overlay.d/08nouveau
+  - overlay.d/09misc
+  - overlay.d/10disk-images
+  - overlay.d/20platform-chrony
+  - overlay.d/30lvmdevices
 
 conditional-include:
   - if: releasever < 44
diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index 35499fcb21..e3ea95d45d 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -28,7 +28,7 @@ conditional-include:
   - if: basearch == "aarch64"
     include:
       ostree-layers:
-        - overlay/10aarch64
+        - overlay.d/10aarch64
   # Temporary workaround. containers-common moved policy.json from
   # /etc/containers to /usr/share/containers. The rpm-ostreed bind mount
   # could use CONTAINERS_POLICY_JSON env var instead, but bootc has a
@@ -49,8 +49,8 @@ conditional-include:
           cp "${src}" "${dest}"
 
 ostree-layers:
-  - overlay/15fcos
-  - overlay/17fcos-container-signing
+  - overlay.d/15fcos
+  - overlay.d/17fcos-container-signing
 
 packages:
   - fedora-release-coreos

From e6e8838e3ffadeadf7ae91e32732aeabd36f9393 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:06:10 -0400
Subject: [PATCH 3/8] build-rootfs: make postprocess log statement more
 distinct

This should help it show up better in the logs.
---
 build-rootfs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build-rootfs b/build-rootfs
index 649461288b..5fe255cd76 100755
--- a/build-rootfs
+++ b/build-rootfs
@@ -334,7 +334,7 @@ def run_postprocess_scripts(rootfs, manifest):
         with open(os.path.join(rootfs, name), mode='w') as f:
             os.fchmod(f.fileno(), 0o755)
             f.write(script)
-        print(f"Running CoreOS postprocess script {i}", flush=True)
+        print(f"\n<<< Running CoreOS postprocess script {i} >>>\n", flush=True)
         bwrap(rootfs, [f'/{name}'], env=env)
         os.unlink(os.path.join(rootfs, name))
 

From db191d7e0d184deee0a059c6cefc0098972406f4 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:07:48 -0400
Subject: [PATCH 4/8] manifests: move shared overlays to shared-el.yaml

This will make it so they don't have to be redefined in
rhel-coreos-config.
---
 manifests/fedora-coreos-base.yaml |  4 ----
 manifests/shared-el.yaml          | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index 50a8eb6aab..73009e5b4e 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -12,12 +12,8 @@ include:
   - coreos-bootc-delta.yaml
 
 ostree-layers:
-  - overlay.d/05core
-  - overlay.d/08nouveau
   - overlay.d/09misc
   - overlay.d/10disk-images
-  - overlay.d/20platform-chrony
-  - overlay.d/30lvmdevices
 
 conditional-include:
   - if: releasever < 44
diff --git a/manifests/shared-el.yaml b/manifests/shared-el.yaml
index 9b4dce5ecd..1436248424 100644
--- a/manifests/shared-el.yaml
+++ b/manifests/shared-el.yaml
@@ -28,3 +28,20 @@ conditional-include:
         - azure-vm-utils
         # Include udev rules azure storage and productid
         - WALinuxAgent-udev
+
+  # Include the layers that are shared amongst Fedora and EL
+  # (though at different import paths).
+  - if: id == "fedora"
+    include:
+      ostree-layers:
+        - overlay.d/05core
+        - overlay.d/08nouveau
+        - overlay.d/20platform-chrony
+        - overlay.d/30lvmdevices
+  - if: id != "fedora"
+    include:
+      ostree-layers:
+        - fedora-coreos-config/overlay.d/05core
+        - fedora-coreos-config/overlay.d/08nouveau
+        - fedora-coreos-config/overlay.d/20platform-chrony
+        - fedora-coreos-config/overlay.d/30lvmdevices

From 3fda15791004cc68ba95ba9776755d6f72ff000b Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:10:47 -0400
Subject: [PATCH 5/8] manifest.yaml: drop setting build_with_buildah

This is not just the default, it's the only option now. Drop this
setting.
---
 manifest.yaml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/manifest.yaml b/manifest.yaml
index 71ad5f66af..4080fd5a5a 100644
--- a/manifest.yaml
+++ b/manifest.yaml
@@ -1,7 +1,3 @@
-metadata:
-  # tell `cosa build` to default to buildah path
-  build_with_buildah: true
-
 conditional-include:
   # TODO: There is no coreos-pool for RISCV yet
   #       https://github.com/coreos/fedora-coreos-tracker/issues/1931

From 2d436f03d1c61d63b46a0a727e9fd866a8a771c6 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:15:51 -0400
Subject: [PATCH 6/8] manifests: drop selinux boolean enablement

We are now on F44 and this postprocess is dead code.
---
 manifests/fedora-coreos-base.yaml | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
index 73009e5b4e..1c9041efe6 100644
--- a/manifests/fedora-coreos-base.yaml
+++ b/manifests/fedora-coreos-base.yaml
@@ -15,24 +15,6 @@ ostree-layers:
   - overlay.d/09misc
   - overlay.d/10disk-images
 
-conditional-include:
-  - if: releasever < 44
-    include:
-      postprocess:
-        # Enable SELinux booleans used by OpenShift
-        # https://github.com/coreos/fedora-coreos-tracker/issues/284
-        # This definition is no longer used to actually effect change
-        # in the OpenShift Node images so let's drop it in 44+. The
-        # config for the OpenShift Node image is now in:
-        # https://github.com/openshift/os/blob/c96e35987fb1093beb7631f27aecf324ae8a44f5/packages-openshift.yaml#L98-L103
-        - |
-          #!/usr/bin/bash
-          set -eux -o pipefail
-          setsebool -P -N container_use_cephfs on  # RHBZ#1692369
-          setsebool -P -N virt_use_samba on  # RHBZ#1754825
-          rm -f /etc/selinux/targeted/semanage.*.LOCK
-
-
 # Be minimal
 recommends: false
 documentation: false

From 1e705c6f75be3f59751d68f44901d0e09969f967 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:23:25 -0400
Subject: [PATCH 7/8] manifests: merge fedora-coreos-base.yaml into
 fedora-coreos.yaml

It didn't really make sense to have two files for this.

Should be no funcitonal diff from this change.
---
 manifests/fedora-coreos-base.yaml | 168 ------------------------------
 manifests/fedora-coreos.yaml      | 161 +++++++++++++++++++++++++++-
 2 files changed, 160 insertions(+), 169 deletions(-)
 delete mode 100644 manifests/fedora-coreos-base.yaml

diff --git a/manifests/fedora-coreos-base.yaml b/manifests/fedora-coreos-base.yaml
deleted file mode 100644
index 1c9041efe6..0000000000
--- a/manifests/fedora-coreos-base.yaml
+++ /dev/null
@@ -1,168 +0,0 @@
-# This file is most of a Fedora CoreOS like system; it inherits from "core".
-# Add things in this file which are somewhat "opinionated", not necessarily
-# core functionality.
-
-include:
-  - system-configuration.yaml
-  - ignition-and-ostree.yaml
-  - file-transfer.yaml
-  - networking-tools.yaml
-  - user-experience.yaml
-  - shared-el.yaml
-  - coreos-bootc-delta.yaml
-
-ostree-layers:
-  - overlay.d/09misc
-  - overlay.d/10disk-images
-
-# Be minimal
-recommends: false
-documentation: false
-
-# ⚠⚠⚠ ONLY TEMPORARY HACKS ALLOWED HERE; ALL ENTRIES NEED TRACKER LINKS ⚠⚠⚠
-# See also the version of this in fedora-coreos.yaml
-postprocess:
-
-  # Mask dnsmasq. We include dnsmasq for host services that use the dnsmasq
-  # binary but intentionally mask the systemd service so users can't easily
-  # use it as an external dns server. We prefer they use a container for that.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/519
-  - |
-    #!/usr/bin/bash
-    set -eux -o pipefail
-    systemctl mask dnsmasq.service
-
-  # sudo prefers its config files to be mode 440, and some security scanners
-  # complain if /etc/sudoers.d files are world-readable.
-  # https://bugzilla.redhat.com/show_bug.cgi?id=1981979
-  # This is added by the 05core overlay listed above.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    chmod 440 /etc/sudoers.d/coreos-sudo-group
-
-  # Set the default systemd target to `multi-user.target`.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    ln -sf multi-user.target /usr/lib/systemd/system/default.target
-
-  # Add the sudo group to /etc/group in container-native flow.
-  - |
-    #!/usr/bin/env bash
-    set -xeuo pipefail
-    if [ -f /run/.containerenv ]; then
-      grep sudo /usr/lib/group >> /etc/group
-    fi
-
-  # Hack to avoid running out of space on aarch64. This should save us about 29M.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/2004
-  - |
-    #!/usr/bin/env bash
-    set -eux -o pipefail
-    rm -vrf /usr/lib/modules/*aarch64/dtb/qcom/
-
-  # Inject the ostree stateroot name from the NAME build-arg.
-  # This is done in postprocess rather than an overlay so that the
-  # value is sourced from build-args and shared across FCOS/RHCOS/SCOS.
-  - |
-    #!/usr/bin/bash
-    set -eux -o pipefail
-    cat > /usr/lib/bootc/install/20-ostree-stateroot.toml << EOF
-    [install]
-    stateroot = "${NAME}"
-    EOF
-
-# Packages listed here should be specific to Fedore CoreOS (as in not yet
-# available in RHCOS or not desired in RHCOS). All other packages should go
-# into one of the sub-manifests listed at the top.
-packages:
-  # Security
-  - polkit
-  # Containers
-  - systemd-container catatonit
-  - fuse-overlayfs slirp4netns
-  # Some host applications(i.e. NetworkManager) use dnsmasq
-  # as the binary for some various utility operations.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/519
-  - dnsmasq
-  # For podman v4 netavark gets pulled in but it only recommends
-  # aardvark-dns (which provides name resolution based on container
-  # names). This functionality was previously provided by dnsname from
-  # podman-plugins in the podman v3 stack.
-  # See https://github.com/containers/netavark/pull/217
-  - aardvark-dns
-  # Since we need `containernetworking-plugins` installed to continue
-  # to support CNI networks we need to also explicitly install
-  # `netavark` so we get both of them installed since both of them
-  # provide `container-network-stack`.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717
-  - netavark
-  # Active Directory support
-  - adcli
-  # Additional firewall support; we aren't including these in RHCOS or they
-  # don't exist in RHEL
-  - iptables-nft iptables-services
-  # WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362
-  - wireguard-tools
-  # Storage
-  - btrfs-progs
-  # Allow communication between sudo and SSSD
-  # for caching sudo rules by SSSD.
-  # https://github.com/coreos/fedora-coreos-tracker/issues/445
-  - libsss_sudo
-  # SSSD; we only ship a subset of the backends
-  - sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
-  # Used by admins interactively
-  - attr
-  - openssl
-  # Provides terminal tools like clear, reset, tput, and tset
-  - ncurses
-  # file-transfer: note fuse-sshfs is not in RHEL
-  # so we can't put it in file-transfer.yaml
-  - fuse-sshfs
-  # Improved MOTD experience
-  - console-login-helper-messages-motdgen
-  # i18n
-  - kbd
-  # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora
-  - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746
-
-# - irqbalance
-#   - This thing is crying out to be pulled into systemd, but that hasn't happened
-#     yet.  Also we may want to add to rpm-ostree something like arch negation;
-#     basically right now it doesn't exist on s390x.
-#     Anyways, it was requested by the Red Hat perf team for RHCOS, so we have it here.
-#     https://serverfault.com/questions/513807/is-there-still-a-use-for-irqbalance-on-modern-hardware
-#     https://access.redhat.com/solutions/41535
-# - qemu-user-static-x86
-#   - Include this on non-x86_64 FCOS images to allow access to the large
-#     inventory of containers only built for x86_64.
-#     https://github.com/coreos/fedora-coreos-tracker/issues/1237
-# - google-compute-engine-guest-configs-udev
-#   - Add this package on x86_64 and aarch64 (the two architectures
-#     GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494
-#     This should be moved to a shared manifest when RHEL has this package.
-# - crun-wasm wasmedge-rt
-#   - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375
-packages-x86_64:
-  - irqbalance
-  - google-compute-engine-guest-configs-udev
-  - crun-wasm wasmedge-rt
-  # Include AMD microcode updates, see https://github.com/coreos/fedora-coreos-tracker/issues/1618.
-  # This normally should belong in bootable-rpm-ostree.yaml (alongside
-  # `microcode_ctl`), but this change hasn't hit RHCOS yet.
-  - amd-ucode-firmware
-packages-ppc64le:
-  - irqbalance
-  - librtas
-  - powerpc-utils-core
-  - ppc64-diag-rtas
-  - qemu-user-static-x86
-packages-aarch64:
-  - irqbalance
-  - qemu-user-static-x86
-  - google-compute-engine-guest-configs-udev
-  - crun-wasm wasmedge-rt
-packages-s390x:
-  - qemu-user-static-x86
diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index e3ea95d45d..4b0a60773d 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -2,7 +2,19 @@
 # into "official" builds of Fedora CoreOS (such as including `fedora-release-coreos`)
 # or are very "opinionated" like disabling SSH passwords by default.
 
-include: fedora-coreos-base.yaml
+# Be minimal
+recommends: false
+documentation: false
+
+include:
+  - system-configuration.yaml
+  - ignition-and-ostree.yaml
+  - file-transfer.yaml
+  - networking-tools.yaml
+  - user-experience.yaml
+  - shared-el.yaml
+  - coreos-bootc-delta.yaml
+
 conditional-include:
   # If not on a production stream then disable Zincati
   - if:
@@ -49,10 +61,66 @@ conditional-include:
           cp "${src}" "${dest}"
 
 ostree-layers:
+  - overlay.d/09misc
+  - overlay.d/10disk-images
   - overlay.d/15fcos
   - overlay.d/17fcos-container-signing
 
+# Packages listed here should be specific to Fedore CoreOS (as in not yet
+# available in RHCOS or not desired in RHCOS). All other packages should go
+# into one of the sub-manifests listed at the top.
 packages:
+  # Security
+  - polkit
+  # Containers
+  - systemd-container catatonit
+  - fuse-overlayfs slirp4netns
+  # Some host applications(i.e. NetworkManager) use dnsmasq
+  # as the binary for some various utility operations.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/519
+  - dnsmasq
+  # For podman v4 netavark gets pulled in but it only recommends
+  # aardvark-dns (which provides name resolution based on container
+  # names). This functionality was previously provided by dnsname from
+  # podman-plugins in the podman v3 stack.
+  # See https://github.com/containers/netavark/pull/217
+  - aardvark-dns
+  # Since we need `containernetworking-plugins` installed to continue
+  # to support CNI networks we need to also explicitly install
+  # `netavark` so we get both of them installed since both of them
+  # provide `container-network-stack`.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/1128#issuecomment-1071458717
+  - netavark
+  # Active Directory support
+  - adcli
+  # Additional firewall support; we aren't including these in RHCOS or they
+  # don't exist in RHEL
+  - iptables-nft iptables-services
+  # WireGuard https://github.com/coreos/fedora-coreos-tracker/issues/362
+  - wireguard-tools
+  # Storage
+  - btrfs-progs
+  # Allow communication between sudo and SSSD
+  # for caching sudo rules by SSSD.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/445
+  - libsss_sudo
+  # SSSD; we only ship a subset of the backends
+  - sssd-client sssd-ad sssd-ipa sssd-krb5 sssd-ldap
+  # Used by admins interactively
+  - attr
+  - openssl
+  # Provides terminal tools like clear, reset, tput, and tset
+  - ncurses
+  # file-transfer: note fuse-sshfs is not in RHEL
+  # so we can't put it in file-transfer.yaml
+  - fuse-sshfs
+  # Improved MOTD experience
+  - console-login-helper-messages-motdgen
+  # i18n
+  - kbd
+  # NIC firmware we've traditionally shipped but then were split out of linux-firmware in Fedora
+  - qed-firmware # https://github.com/coreos/fedora-coreos-tracker/issues/1746
+  # CoreOS release RPM
   - fedora-release-coreos
   # CL ships this.
   - moby-engine
@@ -68,9 +136,99 @@ packages:
   # obsoletes nfs-utils-coreos
   - nfs-client-utils
 
+# Architecture specific packages:
+# - irqbalance
+#   - This thing is crying out to be pulled into systemd, but that hasn't happened
+#     yet.  Also we may want to add to rpm-ostree something like arch negation;
+#     basically right now it doesn't exist on s390x.
+#     Anyways, it was requested by the Red Hat perf team for RHCOS, so we have it here.
+#     https://serverfault.com/questions/513807/is-there-still-a-use-for-irqbalance-on-modern-hardware
+#     https://access.redhat.com/solutions/41535
+# - qemu-user-static-x86
+#   - Include this on non-x86_64 FCOS images to allow access to the large
+#     inventory of containers only built for x86_64.
+#     https://github.com/coreos/fedora-coreos-tracker/issues/1237
+# - google-compute-engine-guest-configs-udev
+#   - Add this package on x86_64 and aarch64 (the two architectures
+#     GCP supports. https://github.com/coreos/fedora-coreos-tracker/issues/1494
+#     This should be moved to a shared manifest when RHEL has this package.
+# - crun-wasm wasmedge-rt
+#   - Support for wasm runtime: https://github.com/coreos/fedora-coreos-tracker/issues/1375
+packages-x86_64:
+  - irqbalance
+  - google-compute-engine-guest-configs-udev
+  - crun-wasm wasmedge-rt
+  # Include AMD microcode updates, see https://github.com/coreos/fedora-coreos-tracker/issues/1618.
+  # This normally should belong in bootable-rpm-ostree.yaml (alongside
+  # `microcode_ctl`), but this change hasn't hit RHCOS yet.
+  - amd-ucode-firmware
+packages-ppc64le:
+  - irqbalance
+  - librtas
+  - powerpc-utils-core
+  - ppc64-diag-rtas
+  - qemu-user-static-x86
+packages-aarch64:
+  - irqbalance
+  - qemu-user-static-x86
+  - google-compute-engine-guest-configs-udev
+  - crun-wasm wasmedge-rt
+packages-s390x:
+  - qemu-user-static-x86
+
 # ⚠⚠⚠ ONLY TEMPORARY HACKS ALLOWED HERE; ALL ENTRIES NEED TRACKER LINKS ⚠⚠⚠
 # See also the version of this in fedora-coreos-base.yaml
 postprocess:
+  # Mask dnsmasq. We include dnsmasq for host services that use the dnsmasq
+  # binary but intentionally mask the systemd service so users can't easily
+  # use it as an external dns server. We prefer they use a container for that.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/519
+  - |
+    #!/usr/bin/bash
+    set -eux -o pipefail
+    systemctl mask dnsmasq.service
+
+  # sudo prefers its config files to be mode 440, and some security scanners
+  # complain if /etc/sudoers.d files are world-readable.
+  # https://bugzilla.redhat.com/show_bug.cgi?id=1981979
+  # This is added by the 05core overlay listed above.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    chmod 440 /etc/sudoers.d/coreos-sudo-group
+
+  # Set the default systemd target to `multi-user.target`.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    ln -sf multi-user.target /usr/lib/systemd/system/default.target
+
+  # Add the sudo group to /etc/group in container-native flow.
+  - |
+    #!/usr/bin/env bash
+    set -xeuo pipefail
+    if [ -f /run/.containerenv ]; then
+      grep sudo /usr/lib/group >> /etc/group
+    fi
+
+  # Hack to avoid running out of space on aarch64. This should save us about 29M.
+  # https://github.com/coreos/fedora-coreos-tracker/issues/2004
+  - |
+    #!/usr/bin/env bash
+    set -eux -o pipefail
+    rm -vrf /usr/lib/modules/*aarch64/dtb/qcom/
+
+  # Inject the ostree stateroot name from the NAME build-arg.
+  # This is done in postprocess rather than an overlay so that the
+  # value is sourced from build-args and shared across FCOS/RHCOS/SCOS.
+  - |
+    #!/usr/bin/bash
+    set -eux -o pipefail
+    cat > /usr/lib/bootc/install/20-ostree-stateroot.toml << EOF
+    [install]
+    stateroot = "${NAME}"
+    EOF
+
   # Disable Zincati on non-release builds
   # https://github.com/coreos/fedora-coreos-tracker/issues/212
   - |
@@ -81,6 +239,7 @@ postprocess:
       mkdir -p /etc/zincati/config.d
       echo -e '# https://github.com/coreos/fedora-coreos-tracker/issues/212\nupdates.enabled = false' > /etc/zincati/config.d/95-disable-on-dev.toml
     fi
+
   # Users shouldn't be configuring `rpm-ostreed.conf`
   # https://github.com/coreos/fedora-coreos-tracker/issues/271
   - |

From b6d853eb4fd8105d38b875876a15925c3d6ca9e7 Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Mon, 22 Jun 2026 23:27:38 -0400
Subject: [PATCH 8/8] manifests: move manifest includes into shared-el.yaml

This will allow us to define them here so we don't have to redefine them
downstream. As long as shared-el.yaml gets included downstream the rest
of these will get included.
---
 manifests/fedora-coreos.yaml | 6 ------
 manifests/shared-el.yaml     | 8 ++++++++
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/manifests/fedora-coreos.yaml b/manifests/fedora-coreos.yaml
index 4b0a60773d..51705861f8 100644
--- a/manifests/fedora-coreos.yaml
+++ b/manifests/fedora-coreos.yaml
@@ -7,13 +7,7 @@ recommends: false
 documentation: false
 
 include:
-  - system-configuration.yaml
-  - ignition-and-ostree.yaml
-  - file-transfer.yaml
-  - networking-tools.yaml
-  - user-experience.yaml
   - shared-el.yaml
-  - coreos-bootc-delta.yaml
 
 conditional-include:
   # If not on a production stream then disable Zincati
diff --git a/manifests/shared-el.yaml b/manifests/shared-el.yaml
index 1436248424..0cbd5ff239 100644
--- a/manifests/shared-el.yaml
+++ b/manifests/shared-el.yaml
@@ -1,3 +1,11 @@
+include:
+  - system-configuration.yaml
+  - ignition-and-ostree.yaml
+  - file-transfer.yaml
+  - networking-tools.yaml
+  - user-experience.yaml
+  - coreos-bootc-delta.yaml
+
 conditional-include:
   # Include shared-el9 workarounds on Fedora and EL9
   - if: id == "fedora"