DRAFT: Use image-builder generic-iso to build coreos live iso - #4325
DRAFT: Use image-builder generic-iso to build coreos live iso#4325Roshan-R wants to merge 10 commits into
Conversation
Add the total size of the disk image to the image-builder partition table. This will have the side effect of increasing the metal image to the same 10G size of the cloud images. See coreos/fedora-coreos-tracker#2188
Then inject it into the image-builder partition table. This avoids hard-coding the rootfs size and restore the same functionality we have in COSA. See coreos/fedora-coreos-tracker#2188
This way we have a default disk that is fitted to the partition size. We will override that with a size hint in blueprints. If i understand coreos/fedora-coreos-tracker#2188 (comment) that should be possible.
d302b68 to
020a1e8
Compare
…age-builder Add packages and postprocess steps required by osbuild/image-builder for live ISO builds, including EFI binaries, erofs, Python, and composefs configuration.
Adapt the coreos-live dracut module for image-builder generic ISOs: - Use dmsquash-live to mount LiveOS/squashfs.img. - Avoid generating conflicting sysroot.mount units. - Set up /sysroot/etc after the ephemeral filesystem is ready. - HACK: Add the coreos-live-initramfs marker for live image detection. - Skip cosa-specific osmet persistence when rootfs.img is unavailable.
Add a custom image-builder iso.yaml to configure the Fedora CoreOS label, kernel arguments, GRUB timeout, and Live boot menu entry.
b4d4414 to
8187414
Compare
|
I was able to get SELinux working. The issue was caused by systemd-etc.mount failing because dmsquash-live mounts the full overlayfs at /sysroot, which means /sysroot/etc is already covered by the overlayfs mount. When sysroot-etc.mount subsequently tries to bind mount /run/ephemeral/etc over /sysroot/etc, systemd detects that the path is already covered by the existing overlayfs mount. As a result, the mount condition evaluates to false and systemd skips the bind mount entirely. To work around this, I replaced systemd-etc.mount with a systemd-etc-setup.service that explicitly unmounts the existing /sysroot/etc mount before setting up the bind mount. This allows the /run/ephemeral/etc bind mount to be applied correctly and makes SELinux work as expected. |
2 participants
Build CoreOS ISOs using image-builder's generic-iso
The image-builder used to build the ISO comes from an unmerged image-builder fork containing the changes from osbuild/image-builder#2414.
This PR builds on @jbtrystram 's work to get CoreOS ISOs working with image-builder's generic-iso pipeline. It adds the Fedora CoreOS-specific configuration needed to build a bootable live ISO using
image-builderinstead of coreos-assembler.The generated ISO currently boots successfully when SELinux is disabled with selinux=0. There are still a number of workarounds in place, and the resulting ISO has several limitations that need to be addressed before this can provide a complete replacement for the existing CoreOS ISO build.
This PR adds the FCOS-specific pieces needed on top of image-builder's generic ISO infrastructure:
dracut-live, andshimpackages required by the generic ISO.Limitations
Offline installation is not supported.
The ISO does not currently contain the CoreOS .osmet files required for offline installation with coreos-installer.
See: joelcapitao/bib-fcos-experimentation#9
coreos-installer iso * customization is not supported.
The ISO is missing the CoreOS-specific embed areas required by coreos-installer for ISO customization.
See: joelcapitao/bib-fcos-experimentation#102
Only x86_64 has been tested.
The configuration includes support for other architectures, but aarch64 and other architectures have not yet been tested.
SELinux must currently be disabled.The generated ISO only boots successfully with selinux=0. Without this, lot of systemd services fail due to selinux permission issues.The live-image stamp file is created in the dracut module.
The stamp file checked by is-live-image is currently created from within the dracut module itself. Ideally, this file should be created as part of the ISO build process rather than being added by the initramfs module.