examples: Add bootc UKI & BLS examples #1614

jeckersb · 2025-09-15T20:08:00Z

Rebirth of #1533 targeting
main after the composefs-backend branch was merged.

jeckersb · 2025-09-16T13:27:23Z

tmt/plans/bootc-integration.fmf

    test:
        - /tmt/tests/test-24-local-upgrade-reboot
+
+/test-26-examples-build:


I'm not totally sold on testing this way. This was the result of asking claude to write a test to make sure the examples build. Is it too heavyweight to go through the matrix of spawning VMs with tmt just to sanity check the examples work?

(At the very least if we do it via tmt we need to add it to the list of tests in the github workflow)

(At the very least if we do it via tmt we need to add it to the list of tests in the github workflow)

I added this at least for the moment just to see it run and see what happens...

Yes, it's messy to build containers inside a tmt test, and we definitely want to make it easy to build it outside of such a test too.

But OTOH, I think it's totally fine to do it this way as is right now. BTW though this will just conflict with #1607 - what we're going to need to do is at least have a separate tmt "plan" for tests which are testing booting via bootc vs testing the build side.

Well first order of business...

./tmt-test-wrapper-inner.sh-tmt-tests-test-26-examples-build-1-default-0-default-0: line 6: cd: examples/bootc-bls: No such file or directory

Guess it's time to learn what path tomfoolery is going on in tmt

Maybe also a good point to go on a side quest and finally learn what nushell is all about...

I'm kind of regretting nushell a bit because IME ai models are more likely to confabulate with it. But writing nontrivial amounts of bash sucks.

One issue is TMT really pushes for having tests be interpreted code, but maybe we could mitigate that. There's obviously a ton of interpreted options, from python to ansible.

Ideally though for me, tests are like production code:

in a static compiled language (nushell is at least partially static)

actors operate autonomously instead of having logic pushed to them

But anyways for what's going on here, bash is probably OK...

Yeah it was less "rewrite this tiny bash snippet in nushell" and moreso "most everything else is in nushell so I should probably at least understand how everything else works"

examples/bootc-bls/extra/etc/dracut.conf.d/no-xattr.conf

examples/bootc-bls/extra/usr/lib/dracut/dracut.conf.d/37composefs.conf

cgwalters · 2025-09-22T12:46:20Z

tmt/tests/examples/bootc-uki/install-grub.sh

+    --security-opt label=type:unconfined_t \
+    "${IMAGE}" \
+    bootc install to-disk \
+        --composefs-native \


Right now bcvk doesn't allow passing arbitrary flags; we can add that of course, but I do think we should be aiming to move this to an install flag or autodetection instead.

jeckersb · 2025-09-24T18:49:18Z

Added some commits here, tried to break it up so everything was self-explanatory in its intentions. Tests are finally passing for me locally so I suspect this should pass and be ready for review.

jeckersb · 2025-09-24T20:51:58Z

Hm looks like 051-test-initramfs.nu failed?

jeckersb · 2025-09-24T21:03:25Z

Hm looks like 051-test-initramfs.nu failed?

19:42:30                 out: TAP version 14
19:42:30                 out: initramfs
19:42:30                 out: -- No entries --
19:42:30                 out: Connection to 127.0.0.1 closed.
19:42:30         Command returned '1' (failure).

🤔

cgwalters · 2025-09-29T18:48:02Z

This needs a rebase

Signed-off-by: Timothée Ravier <[email protected]>

Update bootc examples to use the new unified bootc command interface: - Replace cfsctl binary with bootc and use 'bootc internals cfs' subcommands - Rename composefs-setup-root to bootc-initramfs-setup - Update dracut module from 37composefs to 37bootc - Remove sudo requirement from podman build commands - Update service and module configuration files accordingly 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]> Signed-off-by: John Eckersberg <[email protected]>

Add test-26-examples-build to validate that the bootc-bls and bootc-uki example build scripts work correctly. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]> Signed-off-by: John Eckersberg <[email protected]>

Doing this as a distinct commit so as to not conflate future modifications with the bulk code movement. Signed-off-by: John Eckersberg <[email protected]>

As we progress the composefs work along this is becoming more of a general requirement. I think it still makes sense to leave it as optional for now, but I think for the bulk of the cases we'll want to go ahead and build the initramfs support in. Signed-off-by: John Eckersberg <[email protected]>

By default bootc will enable fsverity when ext4 is the chosen filesystem, and we need fsverity to do composefs testing. Signed-off-by: John Eckersberg <[email protected]>

Since we're running this under tmt, the "system" bootc binaries were built from source and injected into the integration disk image. No need to rebuild these inside of the test job itself. Signed-off-by: John Eckersberg <[email protected]>

The systemd unit is conditional on this so without it the test will always fail. Signed-off-by: John Eckersberg <[email protected]>

cgwalters · 2025-09-29T20:40:33Z

We had a live chat about this. So this gives us test coverage of the build+install, but not run. We should land this, but then an important next step will be teasing things out so that basically add composefs-backend as an option to the existing matrix (at least getting through test-readonly and ideally test-20-local-upgrade).

I think as part of that we'll want at least env FEATURES=composefs just build (or maybe we make it "sticky" with touch target/composefs) or so?

Then the GHA matrix expands.

cgwalters · 2025-09-29T20:50:14Z

tests/build.sh

 # testcloud barfs on .raw
 if test -n "${bcvk}"; then
-  bcvk to-disk --format=qcow2 --disk-size "${SIZE}" localhost/bootc-integration "${DISK}"
+  bcvk to-disk --format=qcow2 --disk-size "${SIZE}" --filesystem ext4 localhost/bootc-integration "${DISK}"


OK for now but I think the composefs base image build should override the filesystem type here?

Or hmmm...actually we should fail at bootc container lint time if the base image specifies a filesystem which is known not to support fsverity probably and it's a sealed image.

bootc-bot bot requested a review from henrywang September 15, 2025 20:08

jeckersb force-pushed the uki-bls-examples branch from b3c5bad to f8b1745 Compare September 15, 2025 20:39

jeckersb marked this pull request as ready for review September 15, 2025 20:40

jeckersb commented Sep 16, 2025

View reviewed changes

jeckersb force-pushed the uki-bls-examples branch from f8b1745 to 8de031c Compare September 16, 2025 13:59

travier reviewed Sep 16, 2025

View reviewed changes

examples/bootc-bls/extra/etc/dracut.conf.d/no-xattr.conf Outdated Show resolved Hide resolved

travier reviewed Sep 16, 2025

View reviewed changes

examples/bootc-bls/extra/usr/lib/dracut/dracut.conf.d/37composefs.conf Outdated Show resolved Hide resolved

jeckersb force-pushed the uki-bls-examples branch from 8de031c to 92cab58 Compare September 16, 2025 16:57

travier mentioned this pull request Sep 17, 2025

WIP: examples: Add bootc UKI & BLS examples #1617

Draft

cgwalters reviewed Sep 22, 2025

View reviewed changes

jeckersb force-pushed the uki-bls-examples branch from 92cab58 to 1bfae10 Compare September 24, 2025 18:44

travier and others added 10 commits September 29, 2025 14:50

examples: Add initial bootc examples (bls & uki)

a1e82f0

Signed-off-by: Timothée Ravier <[email protected]>

examples/bootc*: Secure Boot support

c49fea0

Signed-off-by: Timothée Ravier <[email protected]>

examples/bootc*: Temporary bootc install scripts

1ef204d

Signed-off-by: Timothée Ravier <[email protected]>

examples: move under tmt/tests/

27295cc

Doing this as a distinct commit so as to not conflate future modifications with the bulk code movement. Signed-off-by: John Eckersberg <[email protected]>

Use ext4 by default when building integration disk image

0d578cf

By default bootc will enable fsverity when ext4 is the chosen filesystem, and we need fsverity to do composefs testing. Signed-off-by: John Eckersberg <[email protected]>

examples: use "system" bootc binaries

15b8e14

Since we're running this under tmt, the "system" bootc binaries were built from source and injected into the integration disk image. No need to rebuild these inside of the test job itself. Signed-off-by: John Eckersberg <[email protected]>

tests: skip initramfs if no composefs in cmdline

4e9f167

The systemd unit is conditional on this so without it the test will always fail. Signed-off-by: John Eckersberg <[email protected]>

jeckersb force-pushed the uki-bls-examples branch from 81f010a to 4e9f167 Compare September 29, 2025 18:50

cgwalters enabled auto-merge (rebase) September 29, 2025 20:49

cgwalters approved these changes Sep 29, 2025

View reviewed changes

cgwalters merged commit 8cf0971 into bootc-dev:main Sep 29, 2025
27 checks passed

cgwalters reviewed Sep 29, 2025

View reviewed changes

examples: Add bootc UKI & BLS examples #1614

examples: Add bootc UKI & BLS examples #1614

Uh oh!

Conversation

jeckersb commented Sep 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeckersb Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeckersb commented Sep 24, 2025

Uh oh!

jeckersb commented Sep 24, 2025

Uh oh!

jeckersb commented Sep 24, 2025

Uh oh!

cgwalters commented Sep 29, 2025

Uh oh!

cgwalters commented Sep 29, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jeckersb Sep 16, 2025 •

edited

Loading