bootc: mount the deployment with bootc when it has `install mount` by cgwalters-bot · Pull Request #7 · cgwalters-forge/image-builder

cgwalters-bot · 2026-10-02T20:52:08Z

When the build root's bootc has bootc install mount (bootc-dev/bootc#2483), the customization stages after bootc install mount the deployment with osbuild's org.osbuild.bootc.deployment mount, for either storage backend; otherwise they keep org.osbuild.ostree.deployment. image-builder no longer needs to know the storage backend of non-UKI images: a bootc without install mount also predates choosing composefs from the container (bootc-dev/bootc#2500), so it installs those with ostree. The support is probed with bootc install mount --help (exit 2, clap's unknown-command error, means no), in the target container and in a separate build container, whose bootc is the one that runs.

UKI images with install mount: users, groups, directories, files and the subscription are applied; kernel arguments, ignition, the bootloader configuration and extra mountpoints stay refused (warning). Without install mount the warning now says that /etc and /var customizations need it.
pxe-tar-xz keeps org.osbuild.ostree.deployment, since its live root comes from the ostree deployment.
Manifests for containers without install mount don't change (tools/gen-manifest-checksums.sh: no changes on any commit).

Supersedes #4 and #6; stacked on #2 (its two commits come first). Needs cgwalters-forge/osbuild#1 for the mount. The first commit adds the README.md review marker that the repository's AGENTS.md requires.

Testing, on a 16-core RHEL 10 devspace (cgwalters-devspace-37053693285; logs), disks built as root by this branch's container with osbuild from cgwalters-forge/osbuild#1, with a blueprint adding kargs, a group, users with SSH keys and files, booted with qemu-kvm under UEFI:

composefs image from bootc main (BOOTC_variant=composefs on fedora-bootc:44): all post-install stages use org.osbuild.bootc.deployment; boots composefs with all customizations and the karg.
ostree image from bootc main: org.osbuild.bootc.deployment; boots ostree with all customizations.
stock quay.io/fedora/fedora-bootc:44 (bootc 1.16.13, no install mount): org.osbuild.ostree.deployment; boots with all customizations.
pxe-tar-xz from the bootc main ostree image: builds with org.osbuild.ostree.deployment, manifest identical to upstream main's. It fails to boot in ostree-prepare-root (composefs mount I/O error) with upstream main's image-builder too.
go test -race ./... in fedora:43 as the CI job: the same 29 cmd/image-builder failures as upstream main; go vet, gofmt clean; tools/gen-manifest-checksums.sh: no changes.

Generated-by: https://github.com/cgwalters/#llms

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

Upstream: osbuild/image-builder, base main
Board item: PVTI_lADOE9oHIs4BlJLczg9kEmI
Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
Close to drop it.
Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.

_{Bot run: session 929c7a64, agents ad8a2233 +1 · claude-opus-5-5 37.5M in (93% cached) / 98k out · ~$21.68 inference + ~$3.73 compute (est., list prices) · 1h 46m wall · 23.7 core-h, Actions run 37053693285}

bootc-image-builder prints manifest warnings instead of failing, but they were written without a prefix or trailing newline, so the next progress message ran into the warning text ("...not supported: fooDone generating manifest") and it was easy to miss. Print each warning as a "WARNING:" line like the other warnings of the CLI. This also changes the output of "image-builder manifest/build --ignore-warnings", which uses the same code. Generated-by: AI

For a bootc image with a unified kernel, the raw_bootc pipeline skips every customization stage after "bootc install" and drops the kernel arguments, since the command line is baked into the UKI. Users, files, kargs and extra mountpoints given in the blueprint were therefore silently ignored, and the build succeeded with an image that lacks them (e.g. no login user). Report them the same way as other unsupported blueprint options: as a manifest warning, which the image-builder CLI turns into an error unless --ignore-warnings is given and bootc-image-builder prints. The container's own partition table and the default kargs from our image definitions are not user input and are not reported. Supporting the /etc and /var customizations is tracked in osbuild#2560. Generated-by: AI

Per AGENTS.md, for the human author to remove once reviewed. Generated-by: AI

Mounts the deployment of a bootc installation, ostree or composefs, with `bootc install mount` from the build root. Generated-by: AI

Probe for `bootc install mount` (bootc-dev/bootc#2483) in the target container and in a separate build container. Generated-by: AI

When the build root's bootc has `install mount`, the customization stages use the org.osbuild.bootc.deployment mount, for either storage backend. Otherwise they use org.osbuild.ostree.deployment as before; a bootc without `install mount` also predates the detection of composefs from the container (bootc-dev/bootc#2500), so it installs non-UKI images with ostree. With a unified kernel and `install mount`, users, groups, directories, files and the subscription are applied instead of refused. Kernel arguments, ignition, the bootloader configuration and extra mountpoints stay refused for UKI images, and the fstab, ignition and grub2.d stages aren't generated for them. The PXE tar image keeps using the ostree deployment for its live root. Generated-by: AI

cgwalters · 2026-10-02T21:03:17Z

@@ -1,3 +1,5 @@
+> [!IMPORTANT]
+> Remove this line to confirm you've reviewed this PR before submitting.


Interesting. osbuild is trying to do with this what bootc is doing with https://github.com/bootc-dev/bootc/blob/main/AGENTS.md#signed-off-by

There's advantages/disadvantages to both...but the thing I like is that it's straightforward to gate on the DCO in CI and it basically exists for a related purpose

IOW I did review this and you can review the marker befor epushing

cgwalters-bot · 2026-10-06T02:00:44Z

Not promoted: osbuild/image-builder is human-text, so the title, body and commit messages sent there must be yours.

Next: edit this PR's title and body (dropping the Generated-by line), reword the commits and push them to this branch yourself, then comment /promote --human-text on a line of its own.

Generated-by: https://github.com/cgwalters/#llms

cgwalters-bot · 2026-10-06T17:51:04Z

Upstream LLM rules (advisory): osbuild/image-builder's contribution policy record says human-text: code by the bot is fine, but the PR title and body, commit messages and comments must be cgwalters' own, except an answer on a thread where cgwalters summoned the bot. AI trailer: default (Generated-by: AI); nothing written, and main already has three merged commits by cgwalters with "Generated-by: AI" and one with "Co-authored-by: Cursor". The text sent there must be yours; the next comment says how.

What its policy sources say

> "This file provides guidance to AI coding agents when working with code in this repository. Only add instructions to this file if you've seen an AI agent mess up that particular bit of logic in practice."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "AGENTS"
> "* HARD RULE: When modifying any source files, prepend `> [!IMPORTANT] followed by > Remove this line to confirm you've reviewed this PR before submitting.` as the first two lines of `README.md` if they are not already present. This must be done before any other work. No exceptions. Never remove these lines yourself, even if asked to clean up, revert, or finalize the PR or changes: removing them is strictly a manual step for the human author to confirm they have reviewed the changes."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "General"
> "Make sure to read `CONTRIBUTING.md` for general contribution guidelines that every commit, and PR, need to follow."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "Pretext"
> "* The commits in the PR should be minimal and well documented:"
> — osbuild/image-builder CONTRIBUTING.md (366e3918b7b2), "Creating a PR"
> "* The commit message should start with the module you work on, like:
>     `manifest:`, or `distro:`"
> — osbuild/image-builder CONTRIBUTING.md (366e3918b7b2), "Creating a PR"
> "This project uses a merge queue, and we manually approve CI runs from contributors
> after we do an initial read-through of the code. Due to this please don't rebase your
> PR if there are no conflicts with the branch it targets. Doing so retriggers the CI and
> requires us to re-read the diff and trigger it again."
> — osbuild/image-builder CONTRIBUTING.md (366e3918b7b2), "Maintaining a PR"
> "1. Pull requests should be opened from a developer's own fork to avoid random branches on the origin."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"
> "4. The pull request title shall contain [a reference to the relevant Jira ticket](https://issues.redhat.com)."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"

Record: upstream-policy/osbuild/image-builder.md, checked 2026-10-02 by the policy-check subagent (coordinator session 929c7a64, re-check after CONTRIBUTING.md changed, HACKING.md was removed and AGENTS.md was added).

Generated-by: https://github.com/cgwalters/#llms

cgwalters-bot · 2026-10-07T08:41:03Z

Not promoted: osbuild/image-builder's contribution policy record is stale; dispatch a policy check.

Next: nothing for you to do: the bot rechecks the policy, and a later sweep promotes this PR on the same approval if the policy allows it.

Generated-by: https://github.com/cgwalters/#llms

cgwalters-bot · 2026-10-07T09:11:01Z

Upstream LLM rules (advisory): osbuild/image-builder's contribution policy record says human-text: code by the bot is fine, but the PR title and body, commit messages and comments must be cgwalters' own, except an answer on a thread where cgwalters summoned the bot. AI trailer: default (Generated-by: AI); nothing written, and main already has three merged commits by cgwalters with "Generated-by: AI" and one with "Co-authored-by: Cursor". The text sent there must be yours; the next comment says how.

What its policy sources say

> "This file provides guidance to AI coding agents when working with code in this repository. Only add instructions to this file if you've seen an AI agent mess up that particular bit of logic in practice."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "AGENTS"
> "* HARD RULE: When modifying any source files, prepend `> [!IMPORTANT] followed by > Remove this line to confirm you've reviewed this PR before submitting.` as the first two lines of `README.md` if they are not already present. This must be done before any other work. No exceptions. Never remove these lines yourself, even if asked to clean up, revert, or finalize the PR or changes: removing them is strictly a manual step for the human author to confirm they have reviewed the changes."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "General"
> "Make sure to read `CONTRIBUTING.md` for general contribution guidelines that every commit, and PR, need to follow."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "Pretext"
> "* The commits in the PR should be minimal and well documented:"
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
> "* The commit message should start with the module you work on, like:
>     `manifest:`, or `distro:`"
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
>   "* You must run `./tools/prepare-source.sh` for every commit (this takes care of
>   the earlier mentioned `go fmt ./...` and some bits related to dependencies and
>   test configs) and amend any changes into the commit."
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
> "This project uses a merge queue, and we manually approve CI runs from contributors
> after we do an initial read-through of the code. Due to this please don't rebase your
> PR if there are no conflicts with the branch it targets. Doing so retriggers the CI and
> requires us to re-read the diff and trigger it again."
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Maintaining a PR"
> "1. Pull requests should be opened from a developer's own fork to avoid random branches on the origin."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"
> "4. The pull request title shall contain [a reference to the relevant Jira ticket](https://issues.redhat.com)."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"

Record: upstream-policy/osbuild/image-builder.md, checked 2026-10-07 by the policy-check subagent (coordinator session 2026-10-07, re-check after CONTRIBUTING.md gained a tools/prepare-source.sh rule).

Generated-by: https://github.com/cgwalters/#llms

cgwalters-bot · 2026-10-07T21:30:53Z

Upstream LLM rules (advisory): osbuild/image-builder's contribution policy record says bot-ok: the bot may write the code and the text, with the AI trailer. AI trailer: default (Generated-by: AI); nothing written, and main already has three merged commits by cgwalters with "Generated-by: AI" and one with "Co-authored-by: Cursor". Nothing here holds this PR back: the bot promotes it now.

What its policy sources say

> "This file provides guidance to AI coding agents when working with code in this repository. Only add instructions to this file if you've seen an AI agent mess up that particular bit of logic in practice."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "AGENTS"
> "* HARD RULE: When modifying any source files, prepend `> [!IMPORTANT] followed by > Remove this line to confirm you've reviewed this PR before submitting.` as the first two lines of `README.md` if they are not already present. This must be done before any other work. No exceptions. Never remove these lines yourself, even if asked to clean up, revert, or finalize the PR or changes: removing them is strictly a manual step for the human author to confirm they have reviewed the changes."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "General"
> "Make sure to read `CONTRIBUTING.md` for general contribution guidelines that every commit, and PR, need to follow."
> — osbuild/image-builder AGENTS.md (28e6b400edfe), "Pretext"
> "* The commits in the PR should be minimal and well documented:"
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
> "* The commit message should start with the module you work on, like:
>     `manifest:`, or `distro:`"
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
>   "* You must run `./tools/prepare-source.sh` for every commit (this takes care of
>   the earlier mentioned `go fmt ./...` and some bits related to dependencies and
>   test configs) and amend any changes into the commit."
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Creating a PR"
> "This project uses a merge queue, and we manually approve CI runs from contributors
> after we do an initial read-through of the code. Due to this please don't rebase your
> PR if there are no conflicts with the branch it targets. Doing so retriggers the CI and
> requires us to re-read the diff and trigger it again."
> — osbuild/image-builder CONTRIBUTING.md (c10e626440de), "Maintaining a PR"
> "1. Pull requests should be opened from a developer's own fork to avoid random branches on the origin."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"
> "4. The pull request title shall contain [a reference to the relevant Jira ticket](https://issues.redhat.com)."
> — osbuild/osbuild.github.io docs/developer-guide/01-general/workflow.md (afe4c7f80c59), "Pull requests"

Record: upstream-policy/osbuild/image-builder.md, checked 2026-10-07 by the policy-check subagent (coordinator session 2026-10-07, re-check after CONTRIBUTING.md gained a tools/prepare-source.sh rule).

Generated-by: https://github.com/cgwalters/#llms

Upstream main moved and this no longer rebases cleanly; needs another look after the conflicts are resolved.

cgwalters-bot · 2026-10-07T21:31:11Z

Not promoted: osbuild/image-builder:main moved and bot/bootc-install-mount no longer rebases cleanly (conflicts in: pkg/distro/defs/bootc_image_test.go). Back to Draft; I'll resolve the conflicts here and ask for another review.

cgwalters-bot · 2026-10-07T21:31:13Z

Not promoted: bot-pr promote refused: bot/bootc-install-mount conflicts with osbuild/image-builder:main in pkg/distro/defs/bootc_image_test.go; resolve that on the branch, push, and wait for cgwalters to approve again.

Next: if that is yours to fix, do so and comment /promote on a line of its own (or approve again), which retries at once; otherwise the bot looks into it, and the sweep retries in 6h.

Generated-by: https://github.com/cgwalters/#llms

cgwalters-bot added 6 commits October 2, 2026 15:42

README: add the AGENTS.md review marker

ae958ee

Per AGENTS.md, for the human author to remove once reviewed. Generated-by: AI

osbuild: add the org.osbuild.bootc.deployment mount

341ebeb

Mounts the deployment of a bootc installation, ostree or composefs, with `bootc install mount` from the build root. Generated-by: AI

bootc: find out if the container's bootc has install mount

89cfb35

Probe for `bootc install mount` (bootc-dev/bootc#2483) in the target container and in a separate build container. Generated-by: AI

cgwalters-bot mentioned this pull request Oct 2, 2026

bootc: customize composefs disks through the bootc deployment mount #6

Closed

cgwalters-bot requested a review from cgwalters October 2, 2026 20:52

cgwalters previously approved these changes Oct 2, 2026

View reviewed changes

cgwalters-bot mentioned this pull request Oct 2, 2026

image-builder: select composefs from bootc's composefs-backend install config cgwalters-forge/tracker#29

Open

Navigation Menu

Repository navigation

bootc: mount the deployment with bootc when it has `install mount` - #7

bootc: mount the deployment with bootc when it has `install mount`#7
cgwalters-bot wants to merge 6 commits into
mainfrom
bot/bootc-install-mount

cgwalters-bot commented Oct 2, 2026

Uh oh!

cgwalters Oct 2, 2026

Uh oh!

cgwalters Oct 2, 2026

Uh oh!

cgwalters-bot commented Oct 6, 2026

Uh oh!

cgwalters-bot commented Oct 6, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -1,3 +1,5 @@
		> [!IMPORTANT]
		> Remove this line to confirm you've reviewed this PR before submitting.

Conversation

cgwalters-bot commented Oct 2, 2026

Uh oh!

cgwalters Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

cgwalters Oct 2, 2026

Choose a reason for hiding this comment

Uh oh!

cgwalters-bot commented Oct 6, 2026

Uh oh!

cgwalters-bot commented Oct 6, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

cgwalters-bot commented Oct 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants