DRAFT: Use image-builder generic-iso to build coreos live iso by Roshan-R · Pull Request #4325 · coreos/fedora-coreos-config

Roshan-R · 2026-08-27T11:06:15Z

Build CoreOS ISOs using image-builder's generic-iso

The image-builder used to build the ISO comes from an unmerged image-builder fork containing the changes from osbuild/image-builder#2414.

This PR builds on @jbtrystram 's work to get CoreOS ISOs working with image-builder's generic-iso pipeline. It adds the Fedora CoreOS-specific configuration needed to build a bootable live ISO using image-builder instead of coreos-assembler.

The generated ISO currently boots successfully when SELinux is disabled with selinux=0. There are still a number of workarounds in place, and the resulting ISO has several limitations that need to be addressed before this can provide a complete replacement for the existing CoreOS ISO build.

This PR adds the FCOS-specific pieces needed on top of image-builder's generic ISO infrastructure:

Add the GRUB CD bootloader, EROFS, dracut-live, and shim packages required by the generic ISO.
Provide the EFI layout expected by image-builder's GRUB ISO stage.
Add an FCOS-specific iso.yaml with the required live ISO kernel arguments and serial console configuration.
Disable composefs for the live image, since the EROFS/overlayfs root setup is incompatible with composefs.
Adapt the FCOS live dracut modules to image-builder's ISO layout, including avoiding the boot partition and rootfs.img paths used by coreos-assembler media.
Dynamically size the root partition based on the generated rootfs instead of using a fixed disk size.

Limitations

Offline installation is not supported.

The ISO does not currently contain the CoreOS .osmet files required for offline installation with coreos-installer.
See: joelcapitao/bib-fcos-experimentation#9

coreos-installer iso * customization is not supported.

The ISO is missing the CoreOS-specific embed areas required by coreos-installer for ISO customization.
See: joelcapitao/bib-fcos-experimentation#102

Only x86_64 has been tested.

The configuration includes support for other architectures, but aarch64 and other architectures have not yet been tested.

SELinux must currently be disabled.

~~The generated ISO only boots successfully with selinux=0. Without this, lot of systemd services fail due to selinux permission issues.~~

The live-image stamp file is created in the dracut module.

The stamp file checked by is-live-image is currently created from within the dracut module itself. Ideally, this file should be created as part of the ISO build process rather than being added by the initramfs module.

Add the total size of the disk image to the image-builder partition table. This will have the side effect of increasing the metal image to the same 10G size of the cloud images. See coreos/fedora-coreos-tracker#2188

Then inject it into the image-builder partition table. This avoids hard-coding the rootfs size and restore the same functionality we have in COSA. See coreos/fedora-coreos-tracker#2188

This way we have a default disk that is fitted to the partition size. We will override that with a size hint in blueprints. If i understand coreos/fedora-coreos-tracker#2188 (comment) that should be possible.

…age-builder Add packages and postprocess steps required by osbuild/image-builder for live ISO builds, including EFI binaries, erofs, Python, and composefs configuration.

Adapt the coreos-live dracut module for image-builder generic ISOs: - Use dmsquash-live to mount LiveOS/squashfs.img. - Avoid generating conflicting sysroot.mount units. - Set up /sysroot/etc after the ephemeral filesystem is ready. - HACK: Add the coreos-live-initramfs marker for live image detection. - Skip cosa-specific osmet persistence when rootfs.img is unavailable.

Add a custom image-builder iso.yaml to configure the Fedora CoreOS label, kernel arguments, GRUB timeout, and Live boot menu entry.

Roshan-R · 2026-08-31T17:01:25Z

I was able to get SELinux working. The issue was caused by systemd-etc.mount failing because dmsquash-live mounts the full overlayfs at /sysroot, which means /sysroot/etc is already covered by the overlayfs mount.

When sysroot-etc.mount subsequently tries to bind mount /run/ephemeral/etc over /sysroot/etc, systemd detects that the path is already covered by the existing overlayfs mount. As a result, the mount condition evaluates to false and systemd skips the bind mount entirely.

To work around this, I replaced systemd-etc.mount with a systemd-etc-setup.service that explicitly unmounts the existing /sysroot/etc mount before setting up the bind mount. This allows the /run/ephemeral/etc bind mount to be applied correctly and makes SELinux work as expected.

jbtrystram · 2026-09-02T14:28:35Z

+  # erofs-utils provides mkfs.erofs, needed by osbuild when building live ISOs
+  - erofs-utils
+  # python is needed by osbuild runners
+  - python3


why do we need this ? Aren´t we using another container as the build environment ?

jbtrystram · 2026-09-02T14:29:24Z

+  - grub2-efi-*-cdboot
+  - grub2-efi-x64-cdboot


One of those two is redundant

jbtrystram · 2026-09-02T14:30:44Z

+  # shim and grub2-efi-x64-cdboot install EFI binaries into /usr/lib/efi/
+  # but mark /boot/efi/EFI/ entries as ghost (not present in the container
+  # filesystem). osbuild's grub2.iso stage expects files under
+  # /boot/efi/EFI/fedora/, so populate that directory with symlinks to the
+  # real files from both /usr/lib/efi/shim/ and /usr/lib/efi/grub2/.
+  - |
+    #!/usr/bin/bash
+    set -eux -o pipefail
+    mkdir -p /boot/efi/EFI/fedora
+    for f in /usr/lib/efi/shim/*/EFI/fedora/* /usr/lib/efi/grub2/*/EFI/fedora/*; do
+      ln -sfn "${f}" /boot/efi/EFI/fedora/"$(basename "${f}")"
+    done
+  # Disable composefs for ostree as it is incompatible with the erofs rootfs
+  # used by the bootc-generic-iso pipeline.
+  - |
+    #!/usr/bin/bash
+    set -eux -o pipefail
+    printf '[composefs]\nenabled = no\n[sysroot]\nreadonly = false\n' > /usr/lib/ostree/prepare-root.conf


These are prime examples of "why we can't do this in the base FCOS image"

jbtrystram · 2026-09-02T14:37:51Z

+    # HACK: Create the stamp file that is-live-image checks to detect a live boot.
+    # In cosa-built ISOs this is created by buildextend-live;
+    # This should be created inside while creating the ISO
+    # by the image-builder
+    mkdir -p "${initdir}/etc"
+    : > "${initdir}/etc/coreos-live-initramfs"


We already have

fedora-coreos-config/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-live/live-generator

Lines 27 to 28 in 6afed2b

# Create stamp file that everything else should use to detect a live boot

> /run/ostree-live

What does having this stamp burned at build-time brings ?

jbtrystram · 2026-09-02T14:38:44Z

+        # Commenting out the old bind mount to /dev/null
+        # mount --bind /dev/null /usr/lib/ostree/prepare-root.conf


why is this necessary ?

jbtrystram · 2026-09-02T14:40:57Z

 # image-builder requires the dracut dmsquash-live to build the live iso
-#add_dracutmodules+=" dmsquash-live livenet ostree"
+add_dracutmodules+=" qemu qemu-net dmsquash-live livenet ostree"
+early_microcode="no"


why do we need this ?

added this as it was documented in https://github.com/brlane-rht/images/blob/dff612d79cdc7ee082f6857daa0822da70c76984/doc/20-advanced/20-bootc/10-isos.md

jbtrystram · 2026-09-02T14:42:14Z

+  - console=tty0
+  - console=ttyS0


these should be set via blueprint

jbtrystram · 2026-09-02T14:44:55Z

I am closing this since this should live in bib-fcos-experimentation for now as an extra container build.

jbtrystram added 5 commits July 30, 2026 14:25

disk-images: Add disk image size and rootfs size

a32933a

Add the total size of the disk image to the image-builder partition table. This will have the side effect of increasing the metal image to the same 10G size of the cloud images. See coreos/fedora-coreos-tracker#2188

Don't grow the root partition to use the whole available space

7563f7c

build-rootfs: dynamically compute rootfs size

dca04c0

Then inject it into the image-builder partition table. This avoids hard-coding the rootfs size and restore the same functionality we have in COSA. See coreos/fedora-coreos-tracker#2188

disk.yaml: don't specify any disk size.

ede1afa

This way we have a default disk that is fitted to the partition size. We will override that with a size hint in blueprints. If i understand coreos/fedora-coreos-tracker#2188 (comment) that should be possible.

WIP: add missing bits for image-builder generic ISO

9c85272

Roshan-R force-pushed the image-builder-generic-iso branch from d302b68 to 020a1e8 Compare August 28, 2026 13:15

Roshan-R added 5 commits August 31, 2026 22:19

fix(image-builder): add packages and postprocess steps required by im…

5530e26

…age-builder Add packages and postprocess steps required by osbuild/image-builder for live ISO builds, including EFI binaries, erofs, Python, and composefs configuration.

fix(image-builder): add required dracut modules by dmsquash-live

a2e2bb6

fix(image-builder): add Fedora CoreOS generic ISO boot config

3f51b42

Add a custom image-builder iso.yaml to configure the Fedora CoreOS label, kernel arguments, GRUB timeout, and Live boot menu entry.

feat(image-builder): update manifest files

8187414

Roshan-R force-pushed the image-builder-generic-iso branch from b4d4414 to 8187414 Compare August 31, 2026 16:55

jbtrystram reviewed Sep 2, 2026

View reviewed changes

jbtrystram closed this Sep 2, 2026

Navigation Menu

Uh oh!

DRAFT: Use image-builder generic-iso to build coreos live iso - #4325

DRAFT: Use image-builder generic-iso to build coreos live iso#4325
Roshan-R wants to merge 10 commits into
coreos:testing-develfrom
Roshan-R:image-builder-generic-iso

Roshan-R commented Aug 27, 2026 •

edited

Loading

Uh oh!

Roshan-R commented Aug 31, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

Roshan-R Sep 2, 2026

Uh oh!

jbtrystram Sep 2, 2026

Uh oh!

jbtrystram commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	# Create stamp file that everything else should use to detect a live boot
	> /run/ostree-live

		# Commenting out the old bind mount to /dev/null
		# mount --bind /dev/null /usr/lib/ostree/prepare-root.conf

Uh oh!

Conversation

Roshan-R commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Limitations

Offline installation is not supported.

coreos-installer iso * customization is not supported.

Only x86_64 has been tested.

SELinux must currently be disabled.

The live-image stamp file is created in the dracut module.

Uh oh!

Roshan-R commented Aug 31, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jbtrystram commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Roshan-R commented Aug 27, 2026 •

edited

Loading