Dockerfile

# Build this project from source and write the updated content
# (i.e. /usr/bin/bootc and systemd units) to a new derived container
# image. See the `Justfile` for an example

# Note this is usually overridden via Justfile
ARG base=quay.io/centos-bootc/centos-bootc:stream10

# This first image captures a snapshot of the source code,
# note all the exclusions in .dockerignore.
FROM scratch as src
COPY . /src

# And this image only captures contrib/packaging separately
# to ensure we have more precise cache hits.
FROM scratch as packaging
COPY contrib/packaging /

# This image installs build deps, pulls in our source code, and installs updated
# bootc binaries in /out. The intention is that the target rootfs is extracted from /out
# back into a final stage (without the build deps etc) below.
FROM $base as buildroot
# Flip this off to disable initramfs code
ARG initramfs=1
# CI passes --build-arg=CARGO_INCREMENTAL=0 to save disk in the build cache.
# When unset (local dev), cargo uses its profile defaults.
ARG CARGO_INCREMENTAL
ENV CARGO_INCREMENTAL=${CARGO_INCREMENTAL}
# This installs our buildroot, and we want to cache it independently of the rest.
# Basically we don't want changing a .rs file to blow out the cache of packages.
# Use tmpfs for /run and /tmp with bind mounts inside to avoid leaking mount stubs into the image
RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    /run/packaging/install-buildroot
# Now copy the rest of the source
COPY --from=src /src /src
WORKDIR /src
# See https://www.reddit.com/r/rust/comments/126xeyx/exploring_the_problem_of_faster_cargo_docker/
# We aren't using the full recommendations there, just the simple bits.
# First we download all of our Rust dependencies
# Note: Local path dependencies (from [patch] sections) are auto-detected and bind-mounted by the Justfile
RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome \
    rm -rf /var/roothome/.cargo/registry; cargo fetch

# We always do a "from scratch" build
# https://docs.fedoraproject.org/en-US/bootc/building-from-scratch/
# because this fixes https://github.com/containers/composefs-rs/issues/132
# NOTE: Until we have https://gitlab.com/fedora/bootc/base-images/-/merge_requests/317
#       this stage will end up capturing whatever RPMs we find at this time.
# NOTE: This is using the *stock* bootc binary, not the one we want to build from
#       local sources. We'll override it later.
# NOTE: All your base belong to me.
FROM $base as target-base

# SKIP_CONFIGS=1 skips LBIs, test kargs, and install configs (for FCOS testing)
ARG boot_type
ARG seal_state
ARG variant
ARG baseconfigs=""
ARG rootfs=""

# Handle version skew between base image and mirrors for CentOS Stream
# xref https://gitlab.com/redhat/centos-stream/containers/bootc/-/issues/1174
RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    /run/packaging/enable-compose-repos

RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packages,src=/,target=/run/packages \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    --mount=type=bind,from=packaging,src=/usr-extras,target=/run/usr-extras <<EOF
    set -eux

    mkdir -p /var/add-dir/usr

    # Install our rpms in /var/add-dir
    /run/packaging/install-rpm-and-setup /run/packages /var/add-dir

    # Configure the rootfs
    /run/packaging/configure-rootfs "${variant}" "/var/add-dir/usr" "${rootfs}"

    # Inject base configuration (e.g. transient-etc, transient-root) before dracut runs
    /run/packaging/inject-baseconfig "/var/add-dir/usr" "${variant}" "${baseconfigs}"

    install -D -m 0644 -t /var/add-dir/usr/lib/bootc/kargs.d /run/usr-extras/lib/bootc/kargs.d/*.toml

    /usr/libexec/bootc-base-imagectl build-rootfs \
        --install bootc \
        --install bootc-tests \
        --install system-reinstall-bootc \
        --add-dir /var/add-dir/usr \
        --manifest=standard /target-rootfs

    # Composefs test images signal the backend the way composefs-native images
    # are meant to (see bootc-installation(7)): inject-baseconfig ships
    # setup-root-conf.toml, and there must be no ostree prepare-root.conf, so
    # that `bootc install` picks composefs without --composefs-backend.
    if [[ "${variant}" == composefs* ]]; then
        rm -vf /target-rootfs/usr/lib/ostree/prepare-root.conf /target-rootfs/etc/ostree/prepare-root.conf
    fi
EOF

RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp <<EOF 
    set -eux

    # create this regardless else bind mounts down the line fail for non-uki builds
    mkdir -p /kernel

    if [[ "${boot_type}" == "uki" ]]; then
        /target-rootfs/usr/bin/bootc container split-kernel-and-rootfs --rootfs /target-rootfs --output /kernel
    fi
EOF

FROM scratch as fetch
COPY --from=target-base /target-rootfs/ /
# SKIP_CONFIGS=1 skips LBIs, test kargs, and install configs (for FCOS testing)
ARG SKIP_CONFIGS
ARG boot_type
ARG seal_state
ARG bootloader
# All network-fetching operations: package installs from distro repos, Copr, Koji.
# Separated so `just build-fetch --target=fetch` can be retried independently on
# transient network failures without re-running the configuration phase.
RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=src,src=/src/hack,target=/run/hack <<-EOF
    set -ex

    cd /run/hack/ && SKIP_CONFIGS="${SKIP_CONFIGS}" ./provision-fetch.sh

    pkgs_to_install=()
    if [[ "${seal_state}" == "sealed" ]]; then
        . /usr/lib/os-release
        case "${ID}${ID_LIKE:-}" in
          *centos*|*rhel*)
            # Enable EPEL for sbsigntools
            dnf -y install epel-release
            ;;
        esac
        pkgs_to_install+=(sbsigntools)
    fi

    # Install systemd-ukify and systemd-boot for UKIs
    # This also installs systemd-boot for the grub UKI case which is not ideal...
    if [[ "${boot_type}" == "uki" ]]; then
        pkgs_to_install+=(systemd-ukify)
    fi

    if [[ ${#pkgs_to_install[@]} -gt 0 ]]; then
        dnf install -y "${pkgs_to_install[@]}"
    fi

    if [[ "$bootloader" == "grub-cc" ]]; then
        case "$(uname -m)" in
            x86_64)
                grub_cc_url=https://kojipkgs.fedoraproject.org/packages/grub2/2.12/60.eln156/x86_64/grub2-efi-x64-cc-2.12-60.eln156.x86_64.rpm
                ;;
            aarch64)
                grub_cc_url=https://kojipkgs.fedoraproject.org/packages/grub2/2.12/60.eln156/aarch64/grub2-efi-aa64-cc-2.12-60.eln156.aarch64.rpm
                ;;
            *)
                echo "Unsupported architecture: $(uname -m)" >&2
                exit 1
                ;;
        esac

        curl --fail --location --retry 5 --retry-all-errors --retry-delay 1 \
            --output /var/grub-cc.rpm "$grub_cc_url"
    fi

    # Currently dnf installs grub-cc at /usr/lib/efi/grub2/1:2.12-60.eln156/EFI/eln/cc/grubx64-cc.efi
    # which is less than ideal because: 
    # - the "cc" subdirectory
    # - no support for installing grub-cc in bootupd
    #
    # So we move the binary to /usr/lib/grub-cc/grub-cc.efi so we have a predictale location from which
    # we can copy the EFI binary to the ESP
    if [[ "$bootloader" == "grub-cc" ]]; then
        mkdir /var/grub-cc
        rpm2archive /var/grub-cc.rpm > /tmp/grub-cc.tar.gz
        tar -xvz -f /tmp/grub-cc.tar.gz -C /var/grub-cc
        file=$(find /var/grub-cc -name '*.efi')
        mkdir -p /usr/lib/grub-cc
        cp "$file" /usr/lib/grub-cc/grub-cc.efi
    fi

    rm -rvf /var/grub-cc
    rm -rvf /var/grub-cc.rpm
EOF

# Note we don't do any customization here yet
# Mark this as a test image
LABEL bootc.testimage="1"
# Otherwise standard metadata
LABEL containers.bootc 1
LABEL ostree.bootable 1
# Version from git, passed via Justfile; ensures `bootc status` shows a version
ARG image_version="devel"
LABEL org.opencontainers.image.version="${image_version}"
# https://pagure.io/fedora-kiwi-descriptions/pull-request/52
ENV container=oci
# Optional labels that only apply when running this image as a container. These keep the default entry point running under systemd.
STOPSIGNAL SIGRTMIN+3
CMD ["/sbin/init"]

# This layer contains things which aren't in the default image and may
# be used for sealing images in particular.
FROM fetch as tools
RUN --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    /run/packaging/initialize-sealing-tools

# -------------
# external dependency cutoff point:
# NOTE: Every RUN instruction past this point should use `--network=none`; we want to ensure
# all external dependencies are clearly delineated.
# This is verified in `cargo xtask check-buildsys`.
# -------------

FROM fetch as base
ARG SKIP_CONFIGS
# Local configuration only — no network access required or permitted.
# Sits after the cutoff so the linter enforces --network=none automatically.
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=src,src=/src/hack,target=/run/hack \
    sh -c 'cd /run/hack/ && SKIP_CONFIGS="${SKIP_CONFIGS}" ./provision-configure.sh'

FROM buildroot as build
# Version for RPM build (optional, computed from git in Justfile)
ARG pkgversion
# For reproducible builds, SOURCE_DATE_EPOCH must be exported as ENV for rpmbuild to see it
ARG SOURCE_DATE_EPOCH
ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH}
# Build RPM directly from source, using cached target directory
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=cache,target=/src/target \
    --mount=type=cache,target=/var/roothome \
    RPM_VERSION="${pkgversion}" /src/contrib/packaging/build-rpm

# Build a systemd-sysext containing just the bootc binary.
# Skips RPM machinery entirely for fast incremental rebuilds.
FROM buildroot as sysext
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome <<EORUN
set -xeuo pipefail
cargo build --bin bootc
mkdir -p /out/bootc/usr/bin /out/bootc/usr/lib/extension-release.d
cp target/debug/bootc /out/bootc/usr/bin/
cat > /out/bootc/usr/lib/extension-release.d/extension-release.bootc <<EOF
ID=_any
EXTENSION_RELOAD_MANAGER=1
EOF
echo "Fast sysext created (binary only):"
find /out/bootc -type f
EORUN

# This image signs systemd-boot using our key, and writes the resulting binary into /out
FROM tools as sdboot-signed
# The certificate is also a build secret, but secrets aren't part of the layer
# cache key. Copying it in makes the signing below rebuild when it changes.
COPY --from=secureboot db.crt /usr/lib/bootc-test/secureboot-db.crt
# The secureboot key and cert are passed via Justfile
# We write the signed binary into /out
# Note: /out already contains systemd-boot-unsigned RPM from initialize-sealing-tools
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=secret,id=secureboot_key \
    --mount=type=secret,id=secureboot_cert <<EORUN
set -xeuo pipefail
sha256sum /usr/lib/bootc-test/secureboot-db.crt

# Extract the unsigned systemd-boot binary from the downloaded RPM
# Work around https://github.com/bootc-dev/bootc/issues/1896
cd /tmp
rpm2cpio /out/*.rpm > pkg.cpio
cpio -idmv < pkg.cpio
rm pkg.cpio
# Find the extracted unsigned binary
sdboot_unsigned=$(ls ./usr/lib/systemd/boot/efi/systemd-boot*.efi)
sdboot_bn=$(basename ${sdboot_unsigned})
# Sign with sbsign using db certificate and key
sbsign --key /run/secrets/secureboot_key \
   --cert /run/secrets/secureboot_cert \
   --output /out/${sdboot_bn} \
   ${sdboot_unsigned}
ls -al /out/${sdboot_bn}
EORUN

# ----
# Unit and integration tests
# The section here (up until the last `FROM` line which acts as the default target)
# is non-default images for unit and source code validation.
# ----

# This "build" includes our unit tests
FROM build as units
# A place that we're more likely to be able to set xattrs
VOLUME /var/tmp
ENV TMPDIR=/var/tmp
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome make install-unit-tests

# This just does syntax checking
FROM buildroot as validate
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome make validate

FROM validate as validate-post-build
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome \
    cargo xtask update-generated from-code --check

# Stage for updating generated docs files (man pages, JSON schemas) on the host.
# Usage: podman build --target update-generated-from-code --output type=local,dest=. .
# This runs `from-code` inside the container (where ostree is available) and
# exports only the generated files back to the host working directory.
FROM buildroot as update-generated-from-code
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=cache,target=/src/target --mount=type=cache,target=/var/roothome \
    cargo xtask update-generated from-code
# Export only the generated docs — not the entire container filesystem.
# Glob patterns here automatically pick up any new schemas added to JSON_SCHEMAS
# in crates/xtask/src/xtask.rs without requiring Dockerfile changes.
FROM scratch as update-generated-from-code-output
COPY --from=update-generated-from-code /src/docs/src/man/ /docs/src/man/
COPY --from=update-generated-from-code /src/docs/src/*.schema.json /docs/src/

# ----
# Stages for the final image
# ----

# Perform all filesystem transformations except generating the sealed UKI (if configured)
FROM base as base-penultimate
ARG variant
ARG bootloader
ARG boot_type
ARG baseconfigs=""

# Switch to a signed systemd-boot, if configured
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    --mount=type=bind,from=sdboot-signed,src=/,target=/run/sdboot-signed <<EORUN
set -xeuo pipefail

if [[ "${bootloader}" == "systemd" ]]; then
  /run/packaging/switch-to-sdboot /run/sdboot-signed
fi

# Composefs test images are installed without --composefs-backend (see
# target-base), and so without --bootloader too, which bcvk only takes with it.
if [[ "${variant}" == composefs* ]]; then
  printf '[install]\nbootloader = "%s"\n' "${bootloader}" > /usr/lib/bootc/install/80-composefs-bootloader.toml
  # The composefs backend doesn't install logically bound images yet:
  # https://github.com/bootc-dev/bootc/issues/2540
  rm -vf /usr/lib/bootc/bound-images.d/*
fi

if [[ "${boot_type}" == "uki" ]]; then
    cp /run/packaging/seal-uki /usr/bin/seal-uki
    cp /run/packaging/finalize-uki /usr/bin/finalize-uki
    cp /run/packaging/initialize-sealing-tools /usr/bin/initialize-sealing-tools
fi

# Fix linting for centos
rm -rf /var/log
rm -rf /var/lib
rm -rf /var/cache
rm -rf /run/rhsm

EORUN

# Generate the sealed UKI in a separate stage
# This computes the composefs digest from base-penultimate and creates a signed UKI
# We need our newly-built bootc for the compute-composefs-digest command
FROM tools as sealed-uki
ARG variant
ARG filesystem
ARG seal_state
ARG boot_type
ARG erofs_version=auto
# Install our bootc package (only needed for the compute-composefs-digest command)
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packages,src=/,target=/run/packages \
    rpm -Uvh --oldpackage --replacepkgs --nosignature /run/packages/bootc-*.rpm
# The certificate is also a build secret, but secrets aren't part of the layer
# cache key. Copying it in makes the signing below rebuild when it changes.
COPY --from=secureboot db.crt /usr/lib/bootc-test/secureboot-db.crt
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=secret,id=secureboot_key \
    --mount=type=secret,id=secureboot_cert \
    --mount=type=bind,from=target-base,src=/kernel,target=/run/kernel \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    --mount=type=bind,from=base-penultimate,src=/,target=/run/target <<EORUN
set -xeuo pipefail
sha256sum /usr/lib/bootc-test/secureboot-db.crt

allow_missing_verity=()

if [[ $filesystem == "xfs" ]]; then
    allow_missing_verity=(--allow-missing-verity)
fi

if test "${boot_type}" = "uki"; then
  kver=$(ls /run/kernel)

  /run/packaging/seal-uki \
      --target /run/target \
      --output /out \
      --secrets /run/secrets \
      "${allow_missing_verity[@]}" \
      --kernel-dir "/run/kernel/$kver" \
      --seal-state $seal_state \
      --erofs-version $erofs_version
fi
EORUN

# And now the final image
FROM base-penultimate
ARG variant
ARG boot_type
# Copy the sealed UKI and finalize the image (remove raw kernel, create symlinks)
RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
    --mount=type=bind,from=packaging,src=/,target=/run/packaging \
    --mount=type=bind,from=target-base,src=/kernel,target=/run/kernel \
    --mount=type=bind,from=sealed-uki,src=/,target=/run/sealed-uki <<EORUN
set -xeuo pipefail

if test "${boot_type}" = "uki"; then
  kver=$(ls /run/kernel)
  /run/packaging/finalize-uki /run/sealed-uki/out "$kver"
fi
EORUN
# And finally, test our linting
# lint: allow non-tmpfs - we want to detect leaked files in /run and /tmp
RUN --network=none bootc container lint --fatal-warnings