Containerfile.fedora

# composefs-os:fedora-44 — Base images for composefs-rs bootable Fedora 44 systems.
#
# Two named targets are available (default: grub):
#   --target grub  GRUB-based boot (shim → grub2, BLS Type 1)
#   --target uki   systemd-boot + UKI (BLS Type 2, cmdline embedded at build time)
#
# Build:
#   podman build -t composefs-os:fedora-44       -f Containerfile.fedora .          # GRUB
#   podman build -t composefs-os:fedora-44-uki   --target uki -f Containerfile.fedora .

# ---------------------------------------------------------------------------
# Stage 0a: Build cbootc
# ---------------------------------------------------------------------------
FROM rust:1-slim AS cbootc-builder
WORKDIR /build
COPY Cargo.toml Cargo.lock ./
COPY src/ src/
RUN cargo build --release

# ---------------------------------------------------------------------------
# Stage 0b: Build composefs-rs tools (cfsctl + composefs-setup-root)
# ---------------------------------------------------------------------------
FROM rust:1-slim AS composefs-builder
RUN apt-get update && apt-get install -y git pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*
WORKDIR /build
RUN git clone --depth=1 https://github.com/containers/composefs-rs .
RUN cargo build --release -p composefs-ctl && \
    cargo build --release -p composefs-setup-root --no-default-features

# ---------------------------------------------------------------------------
# Stage 1: Bootstrap Fedora 44 rootfs (common to both boot styles)
# ---------------------------------------------------------------------------
FROM quay.io/fedora/fedora:44 AS rootfs-common

# Install dracut on the builder for 'dracut --sysroot /rootfs'
RUN dnf install -y dracut && dnf clean all

RUN dnf install -y \
        --installroot /rootfs \
        --use-host-config \
        --releasever 44 \
        --setopt=install_weak_deps=False \
        fedora-repos \
        kernel kernel-modules kernel-modules-core linux-firmware \
        systemd systemd-udev systemd-resolved dbus-broker \
        util-linux util-linux-core coreutils bash rootfiles shadow-utils \
        NetworkManager iproute iputils hostname \
        dnf5 rpm \
        e2fsprogs dosfstools btrfs-progs \
        fsverity-utils \
        dracut \
        podman skopeo \
        vim-minimal less \
    && dnf clean all --installroot /rootfs --use-host-config \
    && rm -rf /rootfs/var/cache/dnf /rootfs/var/log/dnf*

# ---------------------------------------------------------------------------
# PAM configuration
# pam installs /etc/pam.d/system-auth and password-auth as symlinks into
# /etc/authselect/ which only exists after 'authselect select' runs.
# authselect cannot run in a --installroot container build, so replace the
# broken symlinks with real pam_unix configs for local password auth.
# ---------------------------------------------------------------------------
RUN mkdir -p /rootfs/etc/authselect && \
    cat > /rootfs/etc/authselect/system-auth <<'EOF'
#%PAM-1.0
auth        required    pam_env.so
auth        sufficient  pam_unix.so nullok
auth        required    pam_deny.so

account     required    pam_unix.so

password    sufficient  pam_unix.so sha512 shadow nullok
password    required    pam_deny.so

session     required    pam_limits.so
-session    optional    pam_systemd.so
session     required    pam_unix.so
EOF
RUN cp /rootfs/etc/authselect/system-auth /rootfs/etc/authselect/password-auth
RUN cat > /rootfs/etc/authselect/postlogin <<'EOF'
#%PAM-1.0
session  optional   pam_keyinit.so revoke
session  include    system-auth
EOF
RUN printf '#%%PAM-1.0\nauth required pam_deny.so\n' \
        > /rootfs/etc/authselect/fingerprint-auth && \
    cp /rootfs/etc/authselect/fingerprint-auth \
       /rootfs/etc/authselect/smartcard-auth

# Allow root login on serial console (Fedora 44 securetty omits ttyS*)
RUN echo 'ttyS0' >> /rootfs/etc/securetty

# Disable SELinux — no policy installed in this minimal image
RUN mkdir -p /rootfs/etc/selinux && \
    printf 'SELINUX=disabled\n' \
        > /rootfs/etc/selinux/config

# ---------------------------------------------------------------------------
# composefs dracut module (37composefs → module name 'composefs')
# ---------------------------------------------------------------------------
RUN mkdir -p /rootfs/usr/lib/dracut/modules.d/37composefs
COPY --from=composefs-builder \
    /build/target/release/composefs-setup-root \
    /rootfs/usr/lib/dracut/modules.d/37composefs/composefs-setup-root
RUN cat > /rootfs/usr/lib/dracut/modules.d/37composefs/module-setup.sh <<'EOF'
#!/usr/bin/bash
check() { return 0; }
depends() { return 0; }
install() {
    inst "${moddir}/composefs-setup-root" /bin/composefs-setup-root
    inst "${moddir}/composefs-setup-root.service" \
        "${systemdsystemunitdir}/composefs-setup-root.service"
    $SYSTEMCTL -q --root "${initdir}" add-wants \
        initrd-root-fs.target composefs-setup-root.service
}
EOF
RUN chmod +x /rootfs/usr/lib/dracut/modules.d/37composefs/module-setup.sh
RUN cat > /rootfs/usr/lib/dracut/modules.d/37composefs/composefs-setup-root.service <<'EOF'
[Unit]
DefaultDependencies=no
ConditionKernelCommandLine=composefs
ConditionPathExists=/etc/initrd-release
After=sysroot.mount
Requires=sysroot.mount
Before=initrd-root-fs.target
Before=initrd-switch-root.target
OnFailure=emergency.target
OnFailureJobMode=isolate

[Service]
Type=oneshot
ExecStart=/bin/composefs-setup-root
StandardInput=null
StandardOutput=journal
StandardError=journal+console
RemainAfterExit=yes
EOF

# Build initramfs using dracut --sysroot (no chroot or bind-mounts needed)
RUN KVER=$(ls /rootfs/usr/lib/modules | head -1) && \
    dracut --sysroot /rootfs \
        --force --no-hostonly --kver "$KVER" \
        --tmpdir /tmp \
        --add "systemd systemd-initrd dbus base bash composefs" \
        --add-drivers "overlay erofs loop virtio_blk virtio_pci vfat" \
        --reproducible \
        "/rootfs/usr/lib/modules/$KVER/initramfs.img" && \
    if [ -f "/rootfs/boot/vmlinuz-$KVER" ] && \
       [ ! -f "/rootfs/usr/lib/modules/$KVER/vmlinuz" ]; then \
        cp "/rootfs/boot/vmlinuz-$KVER" \
           "/rootfs/usr/lib/modules/$KVER/vmlinuz"; \
    fi

# ---------------------------------------------------------------------------
# Install cfsctl, cbootc, and update units
# Enable services — symlinks land in /rootfs/etc/systemd (preserved in image)
# ---------------------------------------------------------------------------
COPY --from=composefs-builder /build/target/release/cfsctl /rootfs/usr/bin/cfsctl
COPY --from=cbootc-builder /build/target/release/cbootc /rootfs/usr/bin/cbootc
COPY units/cbootc-update.service units/cbootc-update.timer \
    /rootfs/usr/lib/systemd/system/

RUN systemctl --root /rootfs enable \
        NetworkManager.service systemd-resolved.service cbootc-update.timer && \
    systemctl --root /rootfs set-default multi-user.target && \
    systemctl --root /rootfs mask systemd-firstboot.service \
        authselect-apply-changes.service authselect-apply-changes.path && \
    rm -f /rootfs/usr/lib/systemd/system/authselect-apply-changes.service \
          /rootfs/usr/lib/systemd/system/authselect-apply-changes.path \
          /rootfs/usr/lib/systemd/system/systemd-firstboot.service

# ---------------------------------------------------------------------------
# composefs-required filesystem structure
# /sysroot — mount point for the underlying ext4 after switch_root
# /home /opt /srv — conventional symlinks into /var
# /var/home /var/opt /var/srv — targets for those symlinks
# These are baked into the base image so derived images need no extra steps.
# ---------------------------------------------------------------------------
RUN mkdir -p /rootfs/sysroot && \
    mkdir -p /rootfs/var/home /rootfs/var/opt /rootfs/var/srv && \
    rm -rf /rootfs/home /rootfs/opt /rootfs/srv && \
    ln -sf var/home /rootfs/home && \
    ln -sf var/opt  /rootfs/opt && \
    ln -sf var/srv  /rootfs/srv

# ---------------------------------------------------------------------------
# Stage 2a: GRUB — add bootloader packages, copy EFI binaries, clear /boot
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-grub
RUN dnf install -y \
        --installroot /rootfs \
        --use-host-config \
        --releasever 44 \
        --setopt=install_weak_deps=False \
        grub2-efi-x64 grub2-efi-x64-modules grub2-tools grub2-tools-minimal \
        shim-x64 efibootmgr \
    && dnf clean all --installroot /rootfs --use-host-config
RUN mkdir -p /rootfs/usr/share/efi && \
    cp -r /rootfs/boot/efi/EFI /rootfs/usr/share/efi/ && \
    rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Stage 2b: systemd-boot — add systemd-boot-unsigned, clear /boot
# Boot entries (BLS Type 1) are written by cfsctl oci prepare-boot at
# install time, same as the GRUB path.  No UKI pre-build is needed here:
# a pre-built UKI would embed a build-time composefs hash, but prepare-boot
# computes the hash from the OCI image (different code path, different hash).
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-uki
RUN dnf install -y \
        --installroot /rootfs \
        --use-host-config \
        --releasever 44 \
        --setopt=install_weak_deps=False \
        systemd-boot-unsigned \
        systemd-ukify \
    && dnf clean all --installroot /rootfs --use-host-config
RUN rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Stage 2c: systemd-boot + Secure Boot — adds sbsigntools and openssl so
# cbootc can sign systemd-boot and UKIs with a self-generated (or user-
# provided) key at install time.  No shim: firmware verifies binaries
# directly against the UEFI Signature Database (db).
# ---------------------------------------------------------------------------
FROM rootfs-common AS rootfs-uki-sb
RUN dnf install -y \
        --installroot /rootfs \
        --use-host-config \
        --releasever 44 \
        --setopt=install_weak_deps=False \
        systemd-boot-unsigned \
        systemd-ukify \
        sbsigntools \
        openssl \
    && dnf clean all --installroot /rootfs --use-host-config
RUN rm -rf /rootfs/boot/*

# ---------------------------------------------------------------------------
# Final stage: GRUB (default target, backward-compat)
# ---------------------------------------------------------------------------
FROM scratch AS grub
COPY --from=rootfs-grub /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL org.opencontainers.image.title="Fedora CFS Base"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Fedora 44 systems (GRUB)"
LABEL org.opencontainers.image.version="44"

CMD ["/sbin/init"]

# ---------------------------------------------------------------------------
# Final stage: UKI (--target uki)
# ---------------------------------------------------------------------------
FROM scratch AS uki
COPY --from=rootfs-uki /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL cbootc.boot-style=uki
LABEL org.opencontainers.image.title="Fedora CFS Base (UKI)"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Fedora 44 systems (systemd-boot + UKI)"
LABEL org.opencontainers.image.version="44"

CMD ["/sbin/init"]

# ---------------------------------------------------------------------------
# Final stage: UKI + Secure Boot (--target uki-secureboot)
# ---------------------------------------------------------------------------
FROM scratch AS uki-secureboot
COPY --from=rootfs-uki-sb /rootfs /

LABEL containers.bootc=1
LABEL composefs.backend=cfs-rs
LABEL cbootc.boot-style=uki-secureboot
LABEL org.opencontainers.image.title="Fedora CFS Base (UKI + Secure Boot)"
LABEL org.opencontainers.image.description="Base image for composefs-rs bootable Fedora 44 systems (systemd-boot + UKI + Secure Boot)"
LABEL org.opencontainers.image.version="44"

CMD ["/sbin/init"]