Roadmap to Fedora Bootable Containers

Siosm commented

2024-05-13 10:23:56 +00:00

(Migrated from gitlab.com)

Important initial notes

This is a proposed roadmap that is subject to change and refinement
While not complete nor matching the current Fedora bootable container images, you can already use the Fedora Atomic Desktops using container images, with caveats. See: https://gitlab.com/fedora/ostree/ci-test#experimental-ostree-native-container-images-for-rpm-ostree-based-fedora-desktop-variants

With that out of the way, let's look at the work ahead.

Roadmap - To Do

Rebasing on Fedora Bootc manifests / container images

Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/88

Needs better support for container builds in the Fedora Infrastructure
- Forgejo with runners?
- Konflux?
Building with Konflux discussed in https://gitlab.com/fedora/ostree/sig/-/issues/91
Use a single repo and set of manifests for legacy rpm-ostree manifest builds and the new bootc base image container based image builds like Fedora CoreOS does
~~Might mean using a Git submodule or merging all manifests into a single repo~~
~~Investigate if rebasing to a container based workflow for those image would bring benefits~~
~~Investigate the new Experimental Base Images Builder:~~
- ~~https://gitlab.com/fedora/bootc/base-images-experimental/-/merge_requests/18~~
Related to: https://gitlab.com/fedora/ostree/sig/-/issues/4, https://gitlab.com/fedora/ostree/sig/-/issues/21, https://gitlab.com/fedora/ostree/sig/-/issues/22

bootc integration in graphical system updaters

Support updating systems via bootc using GNOME Software & Plasma Discover
- GNOME Software: TBD
- Support in Plasma Discover: Partial, some bugs remain
rpm-ostree likely to stay in the image for a while until this is resolved
Bootc is currently root only: no unprivileged interface, no DBus interface
Related discussions:

Local package layering

Figure out a solution for users that have locally layered packages
Similar to what's needed for Fedora CoreOS
Tracked in https://gitlab.com/fedora/bootc/tracker/-/issues/4
Related to https://gitlab.com/fedora/ostree/sig/-/issues/45

Building Installer or LiveISO & disk images

Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/32

Build Installer or LiveISO images and pre-installed disk images (where it makes sense) to let users directly install using Bootable Containers.
Needs support for pre-installing Flatpaks
Related to https://fedoraproject.org/wiki/Changes/BuildAtomicDesktopsWithImageBuilder

Switching to Bootable Container images by default

Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/2

Needs work and testing to migrate existing users to the new format
~~Needs work on the installer part:~~
- ~~Initial work for the lorax one: https://github.com/ublue-os/isogenerator~~
Needs history for container images:
- Tracked in https://pagure.io/cloud-image-uploader/issue/37
Needs signed container images (with cosign or equivalent)
- https://github.com/fedora-infra/siguldry/issues/49
Support for zstd:chunked images to reduce the size of updates:
- https://github.com/ostreedev/ostree-rs-ext/issues/608
- https://gitlab.com/fedora/bootc/tracker/-/issues/9
Reduce the update cadence to reduce the impact of updates:
- https://gitlab.com/fedora/ostree/sig/-/issues/69

Documentation updates

We will likely have to update the documentation to link to the Fedora Bootable Containers docs.

Roadmap - Done

✅ Building and publishing Bootable Container images

Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/48

Container images built on Fedora's infra using support in Pungi:
- Rawhide & branched: https://pagure.io/pungi-fedora/blob/main/f/fedora.conf#_730
- Stable: https://pagure.io/fedora-infra/ansible/blob/main/f/roles/bodhi2/backend/templates/pungi.rpm.conf.j2#_214
Manifests are in https://pagure.io/workstation-ostree-config, shared with the classic ostree ones
Work in progress to publish those images in the official Fedora registry:

Note that https://gitlab.com/fedora/ostree/ci-test is synced from the same repo but the images are not built on Fedora's infra. Those images are the ones used by https://universal-blue.org/ and derivatives (Bluefin, Bazzite, etc.) right now

✅ DNF5 integration

Add dnf5 to the images:
Better error handling / messages in dnf (on running systems) would make this less confusing to our users
A lot of testing needed, especially regarding alternative kernels, custom kernel modules, /var and /opt handling, etc.

✅ Anaconda

We are already using Anaconda

✅ Documentation updates

Unify the docs for Atomic Desktops: https://gitlab.com/fedora/ostree/sig/-/issues/10

References

See:

For Fedora CoreOS, see: https://github.com/coreos/fedora-coreos-tracker/issues/1726

## Important initial notes * This is a proposed roadmap that is subject to change and refinement * While not complete nor matching the current Fedora bootable container images, you can already use the Fedora Atomic Desktops using container images, with caveats. See: https://gitlab.com/fedora/ostree/ci-test#experimental-ostree-native-container-images-for-rpm-ostree-based-fedora-desktop-variants With that out of the way, let's look at the work ahead. ## Roadmap - To Do ### Rebasing on Fedora Bootc manifests / container images Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/88 * Needs better support for container builds in the Fedora Infrastructure * Forgejo with runners? * Konflux? * Building with Konflux discussed in https://gitlab.com/fedora/ostree/sig/-/issues/91 * Use a single repo and set of manifests for legacy rpm-ostree manifest builds and the new bootc base image container based image builds like Fedora CoreOS does * ~~Might mean using a Git submodule or merging all manifests into a single repo~~ * ~~Investigate if rebasing to a container based workflow for those image would bring benefits~~ * ~~Investigate the new Experimental Base Images Builder:~~ * ~~https://gitlab.com/fedora/bootc/base-images-experimental/-/merge_requests/18~~ * Related to: https://gitlab.com/fedora/ostree/sig/-/issues/4, https://gitlab.com/fedora/ostree/sig/-/issues/21, https://gitlab.com/fedora/ostree/sig/-/issues/22 ### bootc integration in graphical system updaters * Support updating systems via bootc using GNOME Software & Plasma Discover * GNOME Software: TBD * Support in Plasma Discover: Partial, some bugs remain * rpm-ostree likely to stay in the image for a while until this is resolved * Bootc is currently root only: no unprivileged interface, no DBus interface * Related discussions: * https://gitlab.com/fedora/ostree/sig/-/issues/7 * https://github.com/containers/bootc/pull/472 * https://github.com/containers/bootc/issues/474 ### Local package layering * Figure out a solution for users that have locally layered packages * Similar to what's needed for Fedora CoreOS * Tracked in https://gitlab.com/fedora/bootc/tracker/-/issues/4 * Related to https://gitlab.com/fedora/ostree/sig/-/issues/45 ### Building Installer or LiveISO & disk images Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/32 * Build Installer or LiveISO images and pre-installed disk images (where it makes sense) to let users directly install using Bootable Containers. * Needs support for pre-installing Flatpaks * Related to https://fedoraproject.org/wiki/Changes/BuildAtomicDesktopsWithImageBuilder ### Switching to Bootable Container images by default Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/2 * Needs work and testing to migrate existing users to the new format * ~~Needs work on the installer part:~~ * ~~Initial work for the lorax one: https://github.com/ublue-os/isogenerator~~ * Needs history for container images: * Tracked in https://pagure.io/cloud-image-uploader/issue/37 * Needs signed container images (with cosign or equivalent) * https://github.com/fedora-infra/siguldry/issues/49 * Support for zstd:chunked images to reduce the size of updates: * https://github.com/ostreedev/ostree-rs-ext/issues/608 * https://gitlab.com/fedora/bootc/tracker/-/issues/9 * Reduce the update cadence to reduce the impact of updates: * https://gitlab.com/fedora/ostree/sig/-/issues/69 ### Documentation updates * We will likely have to update the documentation to link to the Fedora Bootable Containers docs. ## Roadmap - Done ### ✅ Building and publishing Bootable Container images Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/48 * Container images built on Fedora's infra using support in Pungi: * Rawhide & branched: https://pagure.io/pungi-fedora/blob/main/f/fedora.conf#_730 * Stable: https://pagure.io/fedora-infra/ansible/blob/main/f/roles/bodhi2/backend/templates/pungi.rpm.conf.j2#_214 * Manifests are in https://pagure.io/workstation-ostree-config, shared with the classic ostree ones * Work in progress to publish those images in the official Fedora registry: * https://pagure.io/releng/issue/10399 * https://pagure.io/releng/issue/12081 * https://discussion.fedoraproject.org/t/we-need-to-come-up-with-a-consistent-approach-for-generating-and-publishing-containers-both-traditional-and-atomic-desktop-containers-both-stable-and-unstable-releases/109213 Note that https://gitlab.com/fedora/ostree/ci-test is synced from the same repo but the images are not built on Fedora's infra. Those images are the ones used by https://universal-blue.org/ and derivatives (Bluefin, Bazzite, etc.) right now ### ✅ DNF5 integration * Add dnf5 to the images: * https://gitlab.com/fedora/bootc/tracker/-/issues/12 * https://bugzilla.redhat.com/show_bug.cgi?id=2293627 * https://fedoraproject.org/wiki/Changes/DNFAndBootcInImageModeFedora * Better error handling / messages in dnf (on running systems) would make this less confusing to our users * A lot of testing needed, especially regarding alternative kernels, custom kernel modules, /var and /opt handling, etc. ### ✅ bootupd integration Tracked in: https://gitlab.com/fedora/ostree/sig/-/issues/1 ### ✅ Moving existing systems to static GRUB config: Tracked as part of the composefs issue: https://gitlab.com/fedora/ostree/sig/-/issues/35 * https://github.com/fedora-silverblue/issue-tracker/issues/530 * https://github.com/fedora-silverblue/issue-tracker/issues/120 ### ✅ Switching to composefs Tracked in https://gitlab.com/fedora/ostree/sig/-/issues/35 * Use composefs by default and update all current systems to it * Will not use signatures at the beginning * See: https://gitlab.com/fedora/bootc/tracker/-/issues/11#note_1929159362 * See: https://github.com/coreos/fedora-coreos-tracker/issues/1718 ### ✅ Anaconda We are already using Anaconda ### ✅ Documentation updates * Unify the docs for Atomic Desktops: https://gitlab.com/fedora/ostree/sig/-/issues/10 ## References See: * https://fedoramagazine.org/get-involved-with-fedora-bootable-containers/ * https://fedoraproject.org/wiki/Initiatives/Fedora_bootc For Fedora CoreOS, see: https://github.com/coreos/fedora-coreos-tracker/issues/1726

Siosm commented

2024-05-13 10:27:33 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-13 10:28:34 +00:00

(Migrated from gitlab.com)

Initial work from Robert Sturla for merging manifests: https://github.com/rsturla/fedora-bootc-base

Siosm commented

2024-05-13 10:29:25 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-13 10:31:47 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-14 10:25:21 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-14 10:49:10 +00:00

(Migrated from gitlab.com)

changed the description

lmilbaum commented

2024-05-16 16:38:11 +00:00

(Migrated from gitlab.com)

Strange. The subscribe button doesn't exist. How can one subscribe to this issue?

pm4rcin commented

2024-05-16 21:00:55 +00:00

(Migrated from gitlab.com)

Click three dots on the right top of the issue and there you have notifications.

Siosm commented

2024-05-17 16:31:20 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-17 16:33:14 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-17 16:33:31 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-23 12:54:38 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-28 14:21:40 +00:00

(Migrated from gitlab.com)

mentioned in issue fedora/bootc/tracker#11

Siosm commented

2024-05-30 14:32:57 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-05-30 14:50:04 +00:00

(Migrated from gitlab.com)

changed the description

boredsquirrel commented

2024-06-04 00:12:06 +00:00

(Migrated from gitlab.com)

To clarify as I find this a bit confusing:

Will a theoretical switch completely to bootable containers deprecate OSTree or rpm-ostree?

Currently, using a bootable container image with rpm-ostree works just like using an ostree remote. What is the issue here?

Is dnf5 integration strictly needed for bootable container support, while the above combination already works fine?

Will the bootable container images behave differently, will they require different mechanisms for a factory reset, are they just as well controlled as rpm-ostree when layering packages?

To clarify as I find this a bit confusing: Will a theoretical switch completely to bootable containers deprecate OSTree or rpm-ostree? Currently, using a bootable container image with rpm-ostree works just like using an ostree remote. What is the issue here? Is dnf5 integration strictly needed for bootable container support, while the above combination already works fine? Will the bootable container images behave differently, will they require different mechanisms for a factory reset, are they just as well controlled as rpm-ostree when layering packages?

Siosm commented

2024-06-04 11:38:52 +00:00

(Migrated from gitlab.com)

mentioned in issue #35

Siosm commented

2024-06-04 11:50:32 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-06-04 11:51:46 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-06-20 14:33:44 +00:00

(Migrated from gitlab.com)

mentioned in issue fedora/bootc/tracker#24

walters2 commented

2024-07-02 14:23:07 +00:00

(Migrated from gitlab.com)

@Siosm is arguing this is blocked on https://github.com/ostreedev/ostree-rs-ext/issues/388

Siosm commented

2024-07-02 14:25:45 +00:00

(Migrated from gitlab.com)

Fully rebasing to bootc container images and using a Containerfile flow for building the Atomic Desktops is blocked on (non-exhaustive list):

Availability of a working container building infrastructure in Fedora Infra
Logic to re-encapsulate the content of the final image to get a properly layered image and not huge layers
- Related to https://github.com/ostreedev/ostree-rs-ext/issues/388, which is also needed for UKI/composefs

Fully rebasing to bootc container images and using a Containerfile flow for building the Atomic Desktops is blocked on (non-exhaustive list): - Availability of a working container building infrastructure in Fedora Infra - Logic to re-encapsulate the content of the final image to get a properly layered image and not huge layers - Related to https://github.com/ostreedev/ostree-rs-ext/issues/388, which is also needed for UKI/composefs

Siosm commented

2024-07-06 21:21:33 +00:00

(Migrated from gitlab.com)

List of things we need to do when we transition people from classic ostree remotes to the container one:

Set bootloader=none. Needed for composefs (for now).
Force a bootloader update. Needed for composefs, ostree-grub2 removal.
Rebase to container URL.
Setup container signature verification.

Things we still need to figure out in the Fedora infra:

Container or/and ostree commit signatures.

List of things we need to do when we transition people from classic ostree remotes to the container one: - Set `bootloader=none`. Needed for composefs (for now). - [x] Force a bootloader update. Needed for composefs, ostree-grub2 removal. - Rebase to container URL. - Setup container signature verification. Things we still need to figure out in the Fedora infra: - Container or/and ostree commit signatures.

Siosm commented

2024-07-29 11:50:54 +00:00

(Migrated from gitlab.com)

mentioned in issue #48

Siosm commented

2024-07-29 11:52:09 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-08-01 12:44:10 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-08-01 12:44:43 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-10-14 09:05:57 +00:00

(Migrated from gitlab.com)

mentioned in issue #2

Siosm commented

2024-10-22 12:56:11 +00:00

(Migrated from gitlab.com)

mentioned in issue fedora/bootc/tracker#42

Siosm commented

2024-10-30 14:57:40 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-11-28 10:35:46 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-11-28 10:36:01 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2024-11-28 10:37:33 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2025-01-09 18:13:05 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2025-01-10 11:34:02 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2025-01-10 11:35:11 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2025-01-21 15:53:48 +00:00

(Migrated from gitlab.com)

Pasting here a copy of a comment I made in chat about the state of the Atomic Desktop container images that we have right now:

Overall, there are no deal breakers right now (I'm running my systems using the containers) but it's not ready for general use:

updates are much larger with containers than ostree and our daily release cadence does not help

there is no history of previous builds for the official images, making bissecting/debugging/rollingback impossible

the package layering story with bootc is not ready. I'm working on sysexts (https://github.com/travier/fedora-sysexts) and that works well for me but it's not fully there yet as well

the GUI for system update does not work with bootc, so you need to do things on the command line

Nothing here is a major issue on its own but those would easily be perceived as regressions for current users.

While appearing as unrelated/not-immediately needed, the composefs & static grub work is important to keep us in sync with the work happening in the other variants and align with the state of the bootc image. We need that work to make sure that we can migrate our existing users to the container format safely as well.

Pasting here a copy of a comment I made in chat about the state of the Atomic Desktop container images that we have right now: > Overall, there are no deal breakers right now (I'm running my systems using the containers) but it's not ready for general use: > > - updates are much larger with containers than ostree and our daily release cadence does not help > - there is no history of previous builds for the official images, making bissecting/debugging/rollingback impossible > - the package layering story with bootc is not ready. I'm working on sysexts (https://github.com/travier/fedora-sysexts) and that works well for me but it's not fully there yet as well > - the GUI for system update does not work with bootc, so you need to do things on the command line > > Nothing here is a major issue on its own but those would easily be perceived as regressions for current users. > > While appearing as unrelated/not-immediately needed, the composefs & static grub work is important to keep us in sync with the work happening in the other variants and align with the state of the bootc image. We need that work to make sure that we can migrate our existing users to the container format safely as well.

Siosm commented

2025-02-18 09:48:27 +00:00

(Migrated from gitlab.com)

changed the description

Siosm commented

2025-04-24 16:21:40 +00:00

(Migrated from gitlab.com)

marked the checklist item Tracked as part of the composefs issue: https://gitlab.com/fedora/ostree/sig/-/issues/35 as completed

marked the checklist item **Tracked as part of the composefs issue: https://gitlab.com/fedora/ostree/sig/-/issues/35** as completed

Siosm commented

2025-04-24 16:21:42 +00:00

(Migrated from gitlab.com)