This is just the base images. So basic hardware enablement and unopinionated changes. More opiniona

This is just the base images. So basic hardware enablement and unopinionated changes.
More opinionated images (Bluefin/Bazzite) use the images built in ublue-os/main as base images in their containerfiles

FROM ghcr.io/ublue-os/silverblue-main:40
COPY <bluefin-files>
RUN rpm-ostree install <bluefin-packages>

FROM ghcr.io/ublue-os/silverblue-main:40
COPY <bluefin-files>
RUN rpm-ostree install <bluefin-packages>

FROM ghcr.io/ublue-os/silverblue-main:40
COPY <bluefin-files>
RUN rpm-ostree install <bluefin-packages>

FROM ghcr.io/ublue-os/silverblue-main:40
COPY <bluefin-files>
RUN rpm-ostree install <bluefin-packages>

RRobert This is just the base images. So basic hardware enablement and unopinionated ch...

imbev•8/15/24, 4:59 PM

Ok. Is there anything preventing usage of dnf within the downstream Containerfiles?

antheas•8/15/24, 4:59 PM

yeah, an error condition

antheas•8/15/24, 4:59 PM

but other than that theoretically nothing

imbev•8/15/24, 5:00 PM

A migration to bootc would make that possible instead of using

rpm-ostree install

rpm-ostree install

antheas•8/15/24, 5:00 PM

something in fedora-bootc enables it

antheas•8/15/24, 5:00 PM

which is not done if the image comes from the other repos

antheas•8/15/24, 5:01 PM

if you do that dnf will work in your image

antheas•8/15/24, 5:02 PM

bootc is broadly a rebrand of the portfolio,

rpm-ostree install

rpm-ostree install

is a reimplementation of dnf installdnf install when running in a container

antheas•8/15/24, 5:03 PM

the problem with building base images using OCI is preserving permissions

antheas•8/15/24, 5:03 PM

until ubuntu 24, containers used to crap on permissions so the image would not work afterwards

antheas•8/15/24, 5:03 PM

but now that is much less of a problem if you use a recent podman

Iimbev Ok. Is there anything preventing usage of dnf within the downstream Containerfil...

fiftydinar•8/15/24, 5:03 PM

dnf5dnf5 appears to work in a Containerfile, but can't guarantee if there are some micro-issues with it, like with missing SeLinux labels, permissions & such

antheas•8/15/24, 5:04 PM

every selinux label you add in a container is thrown away

antheas•8/15/24, 5:04 PM

when it is deployed

antheas•8/15/24, 5:04 PM

permissions-wise, recent podmans are good but there are quirks there

Iimbev Does that handle all of ublue configuration? Or is that only for base images?

j0rge•8/15/24, 5:04 PM

can someone paste in the architecture diagram for imbev? sorry in a call

j0rge•8/15/24, 5:05 PM

@Kyle Gospo jeefy at work is like "aww ublue, how cute."

j0rge•8/15/24, 5:05 PM

^^^ CNCF's runners firing on all cylinders today

imbev•8/15/24, 5:06 PM

What I'm seeing as a difference is that ublue is using ostree container commitostree container commit for each layer of the image, while bootc-derived images are able to use the Container's own layers without that step.

Iimbev What I'm seeing as a difference is that ublue is using `ostree container commit`...

Kyle Gospo•8/15/24, 5:07 PM

not required, that was a recent change

Kyle Gospo•8/15/24, 5:07 PM

that just does some cleanup prior to layer generation, such as wiping out temporary files

antheas•8/15/24, 5:08 PM

ostree container commit cleaned var essentially

Jj0rge can someone paste in the architecture diagram for imbev? sorry in a call

AfterStory•8/15/24, 5:08 PM

https://universal-blue.discourse.group/docs?topic=1523

Universal Blue

Architecture Diagram

Hadn’t heard of that specifically, but had herd of similar projects. Didn’t use one, because I didn’t have time to learn one, and I think the results would be less aesthetically pleasing.

antheas•8/15/24, 5:08 PM

if you use rechunk it will also clean var so you dont need it

antheas•8/15/24, 5:09 PM

i should try to build kinoite using "from fedora"

antheas•8/15/24, 5:09 PM

that would be a flex

antheas•8/15/24, 5:09 PM

future plans

imbev•8/15/24, 5:17 PM

I'm thinking of the following:

Refactor ublue-os/main to FROM quay.io/fedora/fedora-bootc:VERFROM quay.io/fedora/fedora-bootc:VER, replace rpm-ostree calls with standard dnf calls. There're a few hacks that need to be done with bootc, but it can otherwise be treated like mutable fedora most of the time within the Containerfile
Refactor downstream images in the same way
The rest might be able to be reused as is

imbev•8/15/24, 5:18 PM

Would a branch or strangler strategy be preferred?

Iimbev I'm thinking of the following: - Refactor ublue-os/main to `FROM quay.io/fedora...

RobertOP•8/15/24, 5:18 PM

We could, but then we have the added burden of managing package lists for Gnome, KDE etc, which we don't currently do
Right now, we just FROM quay.io/fedora-ostree-desktops/{silverblue|kinoite|something}:VERFROM quay.io/fedora-ostree-desktops/{silverblue|kinoite|something}:VER and it's all managed by others

imbev•8/15/24, 5:20 PM

Is there a significant difference between the atomic desktops and the mutable variants using the corresponding package group other than the immutability?

Iimbev Is there a significant difference between the atomic desktops and the mutable va...

Noel•8/15/24, 5:21 PM

Timothee would be a good one to ask on that. He is in Matrix in the Atomic desktops channel.

Noel•8/15/24, 5:21 PM

I don't see him too often in here.

Iimbev I'm thinking of the following: - Refactor ublue-os/main to `FROM quay.io/fedora...

j0rge•8/15/24, 5:23 PM

hah yeah this is what we're supposed to be doing, we got some repos we cloned as main-bootc, hwe-bootc, etc but I don't think we're using them

j0rge•8/15/24, 5:24 PM

I'm not sure if we need to have a ton of new repos, we could just opportunanistically snag swap the common ones like gnome/kde, as those come online.

Jj0rge I'm not sure if we need to have a ton of new repos, we could just opportunanisti...

imbev•8/15/24, 5:26 PM

It'd be simple to switch the base image and remove a dnf groupinstalldnf groupinstall once upstream Fedora produces them

j0rge•8/15/24, 5:27 PM

how's the tool song go? save us from our wanton slumber?

Zoid•8/15/24, 5:28 PM

i was wondering when we would get to doing this. Very interesting. what does groupinstallgroupinstall do? I dont think ive ever seen that

ZZoid i was wondering when we would get to doing this. Very interesting. what does `gr...

Noel•8/15/24, 5:28 PM

it's a DNF command. There are groups of packages you can install and allows you to install all the ones you need. An example would be like the Gnome DE or KDE DE.

Iimbev I'm thinking of the following: - Refactor ublue-os/main to `FROM quay.io/fedora...

antheas•8/15/24, 5:29 PM

if you do that you will get an invalid selinux policy and invalid permissions on your directory tree

antheas•8/15/24, 5:29 PM

and it will not boot

Aantheas if you do that you will get an invalid selinux policy and invalid permissions on...

imbev•8/15/24, 5:29 PM

I haven't encountered that with bootc, but that might be relevant to rpm-ostree -> bootc migration

antheas•8/15/24, 5:30 PM

the reason you ahvent is because youre using an image that has the DE in the commit

antheas•8/15/24, 5:30 PM

so it has correct SELinux and correct directory permissions

antheas•8/15/24, 5:30 PM

if you make the base commit smaller, such as using an image without a DE it doesn quite work

antheas•8/15/24, 5:30 PM

the guys here had this problem with cosmic too

antheas•8/15/24, 5:30 PM

they needed to use a workaround for selinux

Aantheas the reason you ahvent is because youre using an image that has the DE in the com...

imbev•8/15/24, 5:33 PM

I don't think that's the case, dnf list installed | grep -i gnomednf list installed | grep -i gnome has no output within the AlmaLinux bootc image

antheas•8/15/24, 5:34 PM

and does it boot?

imbev•8/15/24, 5:34 PM

I believe so, but I can confirm that rq

This is just the base images. So basic hardware enablement and unopinionated changes. More opiniona

Similar Threads

Similar Threads

Similar Threads