This PR adds rechunk for reducing image size and fixing existing SELinux issues. Rechunk is very much experimental so I'll continue to test over in: https://github.com/gerblesh/cosmic-rechu...
On Day 2 and haven't seen anything yet that wasn't already caught.
For cosmic, may want to include nmtui since the network manager setting is extremely unfeatured. Everything can be done from nmcli, but nmtui is a little more convenient once things are configured but not exposed graphically by cosmic
this sounds like you're waiting for someone to shill 'my' project: https://blue-build.org/ well, it's not exactly what you want, maybe. you still can't manage disk partitioning, hostnames, etc. in a native container image, since you're building a 'base OS' and not a whole installation like with NixOS.
Someone did mention that in general, and there was some discussion there. Some of what I need really is improvements in anaconda or similar. Some is covered by blue-build, and I made some suggestions for possible modules of interest.
you talked about some way to include secrets. we've had tangential discussion recently and you can read more there, but the gist is that the container images are usually published to ghcr.io and are thus public, including secrets in it would not be secure. the images are made such that multiple users could use them (though some personal images definitely stretch that). you might want to sacrifice the thinking that everything (including secrets) would be managed by a single system. you can still technically use home-manager on other atomic systems, and there are other good ways to manage and sync secrets locally too AFAIK.
I think sops-nix actually hits the sweet spot here. You use a standard tool for secret management (sops) to write encrypted files that can be published publicly, but can only be decrypted on a host using a specific non-published secret (host ssh key most commonly, but something via vault, 1password, etc could also be used). A systemd service does the decryption during boot and writes to somewhere in /run so they're not ever persisted to disk.