UKI Cleanup by Johan-Liebert1 · Pull Request #2200 · bootc-dev/bootc

Johan-Liebert1 · 2026-05-15T07:22:34Z

ukify: Allow passing custom kernel, initramfs

While building a sealed UKI image we'd want to remove the original
kernel + initramfs from the final image and have only the final UKI
present. This was not possible before as bootc container ukify
expected kernel + initramfs to be present in usr/lib/modules of
container root

Fixes: #2185

dockerfile/uki: Rework to remove kernel + initrd

Now that we can pass kernel and initrd paths to bootc ukify, rework
our UKI Dockerfile to remove kernel + initrd from the final layer
and only keep the UKI

This still will not remove the kernel + initrd from the tarball but
have whiteout instead

See #2027 (comment)

test/integration: Test vmlinuz non-existence with UKI

vmlinuz and intrd should not be present in UKI images; add test for the
same

gemini-code-assist

Code Review

This pull request refactors the UKI (Unified Kernel Image) build process to support passing explicit kernel and initramfs paths via CLI arguments, reducing reliance on auto-discovery within the rootfs. Key changes include updating the seal-uki and finalize-uki scripts to use named arguments, modifying Dockerfile stages to extract and clean up kernel components, and extending the Rust library and CLI to handle the new parameters. Review feedback identified a potential path resolution bug in the Rust file existence checks, a filename mismatch in the upgrade test Dockerfile, and suggested improvements for error handling and validation in the seal-uki script.

travier · 2026-05-20T07:48:38Z

I think we should have the kernel and initrd as required arguments and thus only support the case where they are not in the rootfs anymore as I don't see a use case where someone would want a sealed image with both a UKI and split out kernel and initrd.

Edit: That would break the current bootc container ukify signature but I don't think we've declared it stable yet?

cgwalters · 2026-05-20T21:55:58Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

travier · 2026-05-21T14:21:29Z

Failures are transient & volatile related. Maybe from #2201?

Johan-Liebert1 · 2026-05-28T10:30:54Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

Don't know if clap has a way to do this, if it does I couldn't find it. We just print our custom warning if --kernel and --initramfs are not passed in

Johan-Liebert1 · 2026-06-16T11:08:04Z

Converting to draft. Still needs a bit more work

Now that we can pass kernel and initrd paths to `bootc ukify`, rework our UKI Dockerfile to remove kernel + initrd from the final layer and only keep the UKI This still will not *remove* the kernel + initrd from the tarball but have whiteout instead See bootc-dev#2027 (comment) Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 · 2026-06-22T08:48:31Z

This one's also ready for review

cgwalters · 2026-06-22T12:34:14Z

+
+rootfs=${1:-/}
+
+# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.


This can probably be dropped

f44 still seems to ship with 7.0

Yes, but the kernel should include the fix now. Anyways we can look at this later.

cgwalters

Thanks, this is looking closer!

cgwalters · 2026-06-24T13:23:21Z

+
+rootfs=${1:-/}
+
+# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.


Yes, but the kernel should include the fix now. Anyways we can look at this later.

cgwalters · 2026-06-24T21:36:56Z

 # Install the RPM package
 # Use rpm -Uvh with --oldpackage to allow replacing with dev version
-rpm -Uvh --replacepkgs --oldpackage --nosignature "${RPM_DIR}"/*.rpm
+rpm -Uvh --root "${INSTALL_ROOT}" --nodeps --replacepkgs --oldpackage --nosignature "${RPM_DIR}"/*.rpm


The problem is that rpm --root doesn't do important things like set up /proc etc in the target root. See e.g. rpm-software-management/dnf5#2270

I also don't like --nodeps - why did you add that?

I think the cleanest, albeit slightly more work is to do:

Download additional deps early

Install them after we've constructed the "from scratch" root

Alternatively, just pass --install for all the deps we want

I also don't like --nodeps - why did you add that?

Without --nodeps the command fails with

error: Failed dependencies: /usr/bin/bash is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 /usr/bin/chcon is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 composefs is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 ld-linux-x86-64.so.2()(64bit) is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 ld-linux-x86-64.so.2(GLIBC_2.3)(64bit) is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 libc.so.6()(64bit) is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 libc.so.6(GLIBC_2.14)(64bit) is needed by bootc-202606220627.g4df1993369-1.fc44.x86_64 [...]

Possibly because it searches for rpm db which we don't have in the target rootfs?

Installing these in /target-rootfs (after it's generated) works without --nodeps but we need bootc-initramfs-setup in the initrd :/

Install them after we've constructed the "from scratch" root

We need bootc-intramfs-setup in the initrd which is why we have to install these rpms before calling bootc-base-imagectl

Checking in bootc-base-imagtctl, there does seem to be an --install option, but my guess is that it doesn't expect an arbitrary .rpm file

Checking in bootc-base-imagtctl, there does seem to be an --install option, but my guess is that it doesn't expect an arbitrary .rpm file

Yes, we'll need to use createrepo and generate a repo file and also ensure it has higher priority. We could enhance base-imagectl for this.

We need bootc-intramfs-setup in the initrd which is why we have to install these rpms before calling bootc-base-imagectl

Right OK. (It's more subtle in that if we kept installing bootc afterwards we would silently be testing the shipped one right? Would be nasty)

But this links with the above, if we just install it as part of the rootfs generation, we don't need --nodeps.

So in a nutshell let's either:

Set up a (dnf) repo with our built content

Use --no-initramfs for base-imagectl, overlay our content after, and then regenerate the initramfs

? I'm fine with either.

Probably will have to go with option 1. With Option 2 we can't really "split" the root and kernel unless either we go with extremely mess chroot option or fallback to "mv"

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Since we do not want kernel + initrd in the final UKI dockerfile, we now build the initrd inside the `target-rootfs` generated by `bootc-base-imagectl`. Instead of rebuilding the initrd ourselves, now we add `/var/usr` directory to the target-rootfs with `--add-dir` cli option to bootc-base-imagectl. This directory contains our rpms and other configs required for building the initramfs After that's done we split the rootfs and vmlinuz + initrd into /target-rootfs and /kernel/$kver respectively Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 requested a review from cgwalters May 15, 2026 07:22

Johan-Liebert1 added the ci/merge Run full CI suite (all OSes) — equivalent to merge queue label May 15, 2026

gemini-code-assist Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/lib/src/ukify.rs Outdated

Comment thread tmt/tests/Dockerfile.upgrade Outdated

Comment thread contrib/packaging/seal-uki Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from cb42d78 to 8a3ed64 Compare May 15, 2026 08:09

github-actions Bot added the area/documentation Updates to the documentation label May 15, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch 7 times, most recently from 66dc0e3 to 3a9dc2b Compare May 18, 2026 10:09

cgwalters reviewed May 18, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Comment thread tmt/plans/integration.fmf

Johan-Liebert1 force-pushed the uki-cleanup branch from 3a9dc2b to 8e581d4 Compare May 19, 2026 09:35

Johan-Liebert1 requested a review from cgwalters May 19, 2026 10:13

Johan-Liebert1 force-pushed the uki-cleanup branch from 8e581d4 to 503b07a Compare May 19, 2026 13:00

cgwalters reviewed May 19, 2026

View reviewed changes

Comment thread crates/lib/src/bootc_composefs/status.rs Outdated

Comment thread crates/lib/src/bootc_composefs/status.rs Outdated

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh

Comment thread Dockerfile Outdated

travier reviewed May 21, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from 503b07a to 8a5c7ae Compare May 21, 2026 10:10

Johan-Liebert1 force-pushed the uki-cleanup branch from 8a5c7ae to cc8a2d8 Compare May 28, 2026 06:48

github-actions Bot added area/install Issues related to `bootc install` area/ostree Issues related to ostree labels May 28, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch from f2c3424 to 667a0fd Compare May 28, 2026 10:30

Johan-Liebert1 force-pushed the uki-cleanup branch 2 times, most recently from 4d6bed6 to 20e2fed Compare May 28, 2026 13:11

cgwalters requested changes May 28, 2026

View reviewed changes

Comment thread crates/lib/src/cli.rs Outdated

Comment thread crates/lib/src/cli.rs Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from 3e9a91e to 135915e Compare June 16, 2026 08:27

Johan-Liebert1 mentioned this pull request Jun 16, 2026

Handle UKI/Type1 boot entries properly #2144

Open

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from 866acdc to c41bdc8 Compare June 16, 2026 11:04

Johan-Liebert1 marked this pull request as draft June 16, 2026 11:07

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from f5c48ad to e2b3c1d Compare June 17, 2026 13:39

Johan-Liebert1 added 3 commits June 22, 2026 11:55

test/integration: Test vmlinuz non-existence with UKI

2a3fd82

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cli: Add cmd bootc internals uki-extract

1608308

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch from e2b3c1d to 4df1993 Compare June 22, 2026 06:27

Johan-Liebert1 marked this pull request as ready for review June 22, 2026 08:48

bootc-bot Bot requested a review from henrywang June 22, 2026 08:48

cgwalters requested changes Jun 22, 2026

View reviewed changes

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from d7e40d7 to 3538344 Compare June 23, 2026 10:35

Johan-Liebert1 requested a review from cgwalters June 23, 2026 13:17

cgwalters requested changes Jun 24, 2026

View reviewed changes

Johan-Liebert1 added 3 commits June 25, 2026 16:08

cli: Add cmd bootc container split-kernel-and-rootfs

621c88d

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

justfile: Build packages as deps for stage fetch

2417fcf

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch from 3538344 to 2417fcf Compare June 25, 2026 10:38


		rootfs=${1:-/}

		# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.

Uh oh!

Conversation

Johan-Liebert1 commented May 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

travier commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cgwalters commented May 20, 2026

Uh oh!

Uh oh!

travier commented May 21, 2026

Uh oh!

Johan-Liebert1 commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Johan-Liebert1 commented Jun 16, 2026

Uh oh!

Johan-Liebert1 commented Jun 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cgwalters left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

travier commented May 20, 2026 •

edited

Loading

Johan-Liebert1 commented May 28, 2026 •

edited

Loading

Johan-Liebert1 Jun 25, 2026 •

edited

Loading