rpm-ostree/ostree-ext: harden container detection after #5635 #53

Activity

1. cgwalters-bot

   added this to Workstreamon Sep 24, 2026
2. cgwalters-bot

   converted this from a draft issue on Sep 26, 2026
3. cgwalters-bot

   added a sub-issue on Sep 26, 2026

   • Where does the hardened container check go? #119
4. cgwalters-bot

   added

   P1

   target:coreos

   target:bootc-dev

   and removed

   target:coreos

   on Sep 26, 2026
5. cgwalters-bot

   added this to Workstreamon Sep 30, 2026
6. cgwalters-bot

   moved this to In Progress in Workstreamon Sep 30, 2026
7. cgwalters-bot

   added a parent issue on Oct 3, 2026

   • Epic: bootc and ostree family (parked) #333
8. cgwalters-bot

   added

   P2

   and removed

   P1

   on Oct 3, 2026
9. cgwalters-forge

   locked as resolved and limited conversation to collaborators on Oct 17, 2026
10. cgwalters-bot commented on Oct 22, 2026

    

    cgwalters-bot

    on Oct 22, 2026

    Last edited by cgwalters-bot

    CollaboratorAuthor

    More actions

    ✅ dispatch ended well. Result: #53 (comment)
11. cgwalters-bot commented on Oct 22, 2026

    

    cgwalters-bot

    on Oct 22, 2026

    CollaboratorAuthor

    More actions

    Still valid, not done, and blocked on an operator decision: which repository a run may change. No fix has landed since #5635 merged on 24 Sep. The recommended fix is in rpm-ostree only; bootc needs no change.

    Evidence. rpm-ostree main (e5f67f1) still has the check #5635 introduced: maybe_container() is running_in_container() || (!running_in_systemd() && !ostree_booted) (client.rs#L273-L276), and it gates libmain, install/uninstall, override, cleanup and the kernel-install wrap. The container flow still hardcodes the rpmdb to /usr/share/rpm (rpmostree-core.cxx#L259), so the two cases the bot measured in the matrix on the PR still hold: a plain fedora:44 container with rpm-ostree gets a second rpmdb and base packages reinstalled over /, and a booted host with a leaked container= installs into / instead of going through the daemon. cgwalters agreed the plain-container case is an important corner, and the bot's reply set it aside as this follow-up. Not re-run here (no podman in this sandbox); the matrix is the reproduction.

    Where the fix goes: rpm-ostree, not ostree-ext. ostree-ext already exports ostree_booted() and running_in_container() (container_utils.rs), so maybe_container() can be rewritten in place with no bootc change and no bump of rpm-ostree's git pin on ostree-ext (Cargo.toml#L76). The rpmdb-layout half is rpm knowledge ostree-ext has none of today. bootc's is_ostree_container() is unchanged, still requires the bare-split-xattrs repo config, and its only caller is ostree container commit, which is deprecated in favour of bootc container lint (commit.rs#L105); whether that command fails on chunkah images is untested and not worth a change.

    What the fix takes: one small PR. Rewrite maybe_container() as: false if /run/ostree-booted exists; false if /usr/share/rpm does not exist; else running_in_container() || !/run/systemd/system exists (the last keeps BuildKit working, where no container markers are set). Add a unit test next to test_running_in_container that fakes the inputs, and extend ci/test-container.sh (run by just test-container-integration in container-build.yml) with a plain-Fedora negative case: rpm-ostree install must refuse rather than create /usr/share/rpm.

    Unclear. The issue's "or /usr/lib/sysimage/rpm" is unsafe as written: plain Fedora has kept its rpmdb there since F36 (RelocateRPMToUsr), so that path does not tell an ostree image from a plain one. Today ostree images have the real db at /usr/share/rpm with sysimage a symlink to it (rpmostree-rpm-util.cxx#L780-L792), so /usr/share/rpm alone is the signal. When rpm-ostree converts to sysimage (open as coreos/rpm-ostree#5455 and #3397) this check needs a different layout marker; that is the separate issue cgwalters mentioned, and it should link back here.

    Decision for cgwalters. An implement run cannot do this today: coreos/rpm-ostree and the existing fork cgwalters-forge/rpm-ostree are not in dispatch.toml's repos, only the bootc fork is, and this item sits in the parked epic #333 (P2, target:bootc-dev, which is misleading since the change is in rpm-ostree). Options: (a) add cgwalters-forge/rpm-ostree to the dispatch bounds as a staged-PR fork like bootc and pull this item forward, after which a planning pass writes the plan above against that fork; (b) do the ~10-line change by hand upstream; (c) leave it parked. Not recommended: landing it via the bootc fork by moving the check into ostree-ext, since that is two PRs plus a pin bump for logic rpm-ostree can hold itself.

    Generated-by: https://github.com/cgwalters/#llms

    Generated by dispatch · ◷