Add support for Unified Kernel Images and Ephemeral Encryption Keys by arnaldo2792 · Pull Request #701 · bottlerocket-os/twoliter

arnaldo2792 · 2026-08-11T01:54:34Z

Description of changes:

This adds support to build Unified Kernel Images for Bottlerocket. It also includes changes to support ephemeral encryption keys to encrypt the private and data partitions at runtime with LUKS.

Unlike GRUB based images, UKIs must be installed in a VFAT filesystem as systemd-boot lacks ext4 support. The UKIs are installed in the XBOOTLDR partition rather than the EFI partition. This is to be as close as possible to the GRUB based support, where the kernel is shipped as a separate partition.

In-place upgrades are not supported. And there is a pending change to update the re-pack workflow and pcrsys measurements. They will come as separate PRs.

Testing done:

UKIs were build with: Prepare to support UKIs bottlerocket-kernel-kit#523 and Prepare to support UKIs bottlerocket-core-kit#1007
Pending testing on encryption keys, they were tested independently by @piyush-jena , but we need to test both features together.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

arnaldo2792 · 2026-08-11T06:50:26Z

(Forced push simplifies commit history and adds missing changes lost in rebase)

jmt-lab

If some of these are inaccurate feel free to comment with explanation. I think if they aren't accurate it will help me get through my second pass if i know why since this is a rather large change.

sam-berning · 2026-08-12T02:05:39Z

+            // the sections of the existing UKI so that the kernel command line
+            // carries the new dm-verity root hash, and recreates the partition.
+            // See `repack_uki` in `twoliter/embedded/img2img`.
+            Some(ImageFormat::Uki) => {}


nit: why is this on its own line? can be lumped in with the other supported formats

sam-berning · 2026-08-12T05:06:42Z

-       -- \\
-       systemd.log_target=journal-or-kmsg \\
-       systemd.log_color=0 \\
+   linux (\$root)/vmlinuz \


this change seems strange. since IIUC this only affects grub, I'd prefer not to touch this unless it fixes some known bug

Yup, the AI was fixing shellchecks, I'll drop it.

piyush-jena · 2026-08-12T18:17:47Z

The force push above addresses missing unit tests for ephemeral-encryption-keys and a formatting issue.

arnaldo2792 · 2026-08-14T18:22:15Z

(Forced push includes a change to generate the correct hmac for the UKIs)

Introduce a new opt-in image feature that skips seeding a persistent boot configuration, so encryption keys used for encrypted storage do not survive a reboot. This feature depends on encrypted storage being enabled and is rejected for EIF and standalone images, which lack the private data partition it relies on. Signed-off-by: Piyush Jena <jepiyush@amazon.com>

arnaldo2792 · 2026-08-14T21:25:20Z

(Forced push to fix conflict)

sam-berning · 2026-08-14T21:54:20Z

+///   error the moment the user
+///   opts into EIF.


nit: this comment should remain on one line

sam-berning · 2026-08-14T22:02:39Z


+# Copy the systemd-boot configuration onto the EFI system partition.
+#
+# systemd-boot reads exactly one configuration file, `\loader\loader.conf`, and


nit:

Suggested change

# systemd-boot reads exactly one configuration file, `\loader\loader.conf`, and

# systemd-boot reads exactly one configuration file, `/loader/loader.conf`, and

Introduce a new image-format option, uki, for building Unified Kernel Image based Bottlerocket variants using systemd-boot instead of GRUB. Since UKI images use a single-bank boot layout with no B partition set, in-place updates are rejected for this format at manifest validation time. Image builds gain support for the systemd-boot chain-loading path, including secure boot signing, an XBOOTLDR partition for boot entry discovery, and a runtime image-format file so consumers can distinguish UKI images from the rest of the A/B partition logic they otherwise rely on. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Fail the UKI builds when none of the packages provided a systemd-boot configuration. Add integration test to validate the error. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

Generate hard-coded boot parameters for UKI-based variants, until parsing bootconfigs in twoliter is supported. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 · 2026-08-14T22:35:21Z

Forced push includes:

Address feedback on menuentry generation shellcheck fixes
re-format comment
Use / instead of \ in comment

arnaldo2792 requested a review from jmt-lab August 11, 2026 01:54

arnaldo2792 force-pushed the uki-support/twoliter branch from 5bbae92 to b3338cf Compare August 11, 2026 06:49

jmt-lab requested changes Aug 11, 2026

View reviewed changes

sam-berning reviewed Aug 12, 2026

View reviewed changes

arnaldo2792 force-pushed the uki-support/twoliter branch from 68aeb23 to 83475d8 Compare August 12, 2026 18:16

arnaldo2792 force-pushed the uki-support/twoliter branch from 83475d8 to ddeccaf Compare August 12, 2026 21:00

piyush-jena reviewed Aug 12, 2026

View reviewed changes

Comment thread tools/buildsys/src/manifest.rs Outdated

This was referenced Aug 12, 2026

paryplanner: set_partition_uuids eaks partition_plan` into the caller's scope #703

Open

UKI dm-verity uses PARTNROFF=1/2 — hardcodes BOOT-A / ROOT-A / HASH-A partition adjacency. #704

Open

arnaldo2792 mentioned this pull request Aug 13, 2026

Re-pack support for UKIs #724

Draft

arnaldo2792 force-pushed the uki-support/twoliter branch from ddeccaf to 9953c46 Compare August 13, 2026 17:32

jmt-lab approved these changes Aug 13, 2026

View reviewed changes

arnaldo2792 force-pushed the uki-support/twoliter branch from 898e4bc to fce19ac Compare August 14, 2026 21:25

arnaldo2792 marked this pull request as ready for review August 14, 2026 21:25

sam-berning reviewed Aug 14, 2026

View reviewed changes

arnaldo2792 force-pushed the uki-support/twoliter branch from fce19ac to ac7a6bc Compare August 14, 2026 22:16

arnaldo2792 added 5 commits August 14, 2026 22:33

fix: remove unnecessary vmlinuz artifact

420f3a8

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

fix: fail UKI build when bootloader config is missing

9986cbb

Fail the UKI builds when none of the packages provided a systemd-boot configuration. Add integration test to validate the error. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

fix: generate HMAC for UKI instead of vmlinuz

4babe9d

Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

fix: include additional boot parameters

a7b0306

Generate hard-coded boot parameters for UKI-based variants, until parsing bootconfigs in twoliter is supported. Signed-off-by: Arnaldo Garcia Rincon <agarrcia@amazon.com>

arnaldo2792 force-pushed the uki-support/twoliter branch from ac7a6bc to a7b0306 Compare August 14, 2026 22:34

sam-berning approved these changes Aug 14, 2026

View reviewed changes

arnaldo2792 merged commit 89907d1 into bottlerocket-os:develop Aug 14, 2026
3 checks passed

	# systemd-boot reads exactly one configuration file, `\loader\loader.conf`, and
	# systemd-boot reads exactly one configuration file, `/loader/loader.conf`, and

Uh oh!

Conversation

arnaldo2792 commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

arnaldo2792 commented Aug 11, 2026

Uh oh!

jmt-lab left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sam-berning Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sam-berning Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

arnaldo2792 Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

piyush-jena commented Aug 12, 2026

Uh oh!

Uh oh!

arnaldo2792 commented Aug 14, 2026

Uh oh!

arnaldo2792 commented Aug 14, 2026

Uh oh!

sam-berning Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

sam-berning Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

arnaldo2792 commented Aug 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

arnaldo2792 commented Aug 11, 2026 •

edited

Loading