Using image mode for RHEL to build, deploy, and manage operating systems Red Hat Enterprise Linux 9 Using RHEL bootc images on Red Hat Enterprise Linux 9 Red Hat Customer Content Services

Commands:
FROM registry.redhat.io/rhel9/rhel-bootc:latest RUN dnf -y install [software] [dependencies] && dnf clean all ADD [application] ADD [configuration files] RUN [config scripts]
cat Containerfile FROM registry.redhat.io/rhel9/rhel-bootc:latest RUN dnf -y install cloud-init && ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && dnf clean all
podman build -t quay.io/ <namespace> / <image> : <tag> .
podman images REPOSITORY TAG IMAGE ID CREATED SIZE localhost/ <image> latest b28cd00741b3 About a minute ago 2.1 GB
FROM registry.access.redhat.com/ubi9/go-toolset:latest as builder RUN echo 'package main; import "fmt"; func main() { fmt.Println("hello world") }' > helloworld.go RUN go build helloworld.go FROM registry.redhat.io/rhel9/rhel-bootc:latest COPY --from=builder /opt/app-root/src/helloworld / CMD ["/helloworld"]
podman build --target build -t hello .
COPY --from=<image> <source_path> <destination_path>_
FROM ubi9 AS stage1 [...] FROM stage1 AS stage2 [...] FROM ubi9 AS final-stage [...]
podman run -it --rm --name mybootc quay.io/ <namespace> / <image> : <tag> /bin/bash
podman ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 7ccd6001166e quay.io/ <namespace> / <image> : <tag> /sbin/init 6 seconds ago Up 5 seconds ago mybootc
podman push quay.io/ <namespace> / <image> : <tag>
cat Containerfile FROM quay.io/ <namespace> / <image> :latest COPY ./ <app_1> .image /usr/share/containers/systemd/ <app_1> .image COPY ./ <app_2> .container /usr/share/containers/systemd/ <app_2> .container RUN ln -s /usr/share/containers/systemd/ <app_1> .image /usr/lib/bootc/bound-images.d/ <app_1> .image && ln -s /usr/share/containers/systemd/ <app_2> .container /usr/lib/bootc/bound-images.d/ <app_2> .container
GlobalArgs=--storage-opt=additionalimagestore=/usr/lib/bootc/storage
bootc upgrade
--storage-opt=additionalimagestore=/usr/lib/bootc/storage run <image>
sudo podman login registry.redhat.io
sudo podman pull registry.redhat.io/rhel9/bootc-image-builder
sudo podman images REPOSITORY TAG IMAGE ID CREATED SIZE registry.redhat.io/rhel9/bootc-image-builder latest b361f3e845ea 24 hours ago 676 MB
[[customizations.user]] name = "user" password = "pass" key = "ssh-rsa AAA ... user@email.com" groups = ["wheel"]
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v ./config.toml:/config.toml -v ./output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type qcow2 --config /config.toml quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type qcow2 quay.io/ <namespace> / <image> : <tag>
FROM registry.redhat.io/rhel9/rhel-bootc:9.4 RUN dnf -y install cloud-init open-vm-tools && ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && rm -rf /var/{cache,log} /var/lib/{dnf,rhsm} && systemctl enable vmtoolsd.service
podman build . -t localhost/rhel-bootc-vmdk
podman run --rm -it --privileged -v /var/lib/containers/storage:/var/lib/containers/storage -v ./output:/output --security-opt label=type:unconfined_t --pull newer registry.redhat.io/rhel9/bootc-image-builder:9.4 --local --type vmdk quay.io/ <namespace> / <image> : <tag>
podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type vmdk quay.io/ <namespace> / <image> : <tag>
[[customizations.user]] name = "user" password = "pass" key = "ssh-rsa AAA ... user@email.com" groups = ["wheel"]
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v ./config.toml:/config.toml -v ./output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type gce --config /config.toml quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type gce quay.io/ <namespace> / <image> : <tag>
FROM registry.redhat.io/rhel9/rhel-bootc:9.4 RUN dnf -y install cloud-init && ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && rm -rf /var/{cache,log} /var/lib/{dnf,rhsm}
podman build -t quay.io/ <namespace> / <image> : <tag> . podman push quay.io/ <namespace> / <image> : <tag> .
sudo podman run --rm -it --privileged --pull=newer -v USDHOME/.aws:/root/.aws:ro --env AWS_PROFILE=default registry.redhat.io/rhel9/bootc-image-builder:latest --type ami --aws-ami-name rhel-bootc-x86 --aws-bucket rhel-bootc-bucket --aws-region us-east-1 quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer -v USDHOME/.aws:/root/.aws:ro --env AWS_PROFILE=default registry.redhat.io/rhel9/bootc-image-builder:latest --type ami --aws-ami-name rhel-bootc-x86 --aws-bucket rhel-bootc-bucket --local quay.io/ <namespace> / <image> : <tag>
[[customizations.user]] name = "user" password = "pass" key = "ssh-rsa AAA ... user@email.com" groups = ["wheel"]
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v /var/lib/containers/storage:/var/lib/containers/storage -v ./config.toml:/config.toml -v ./output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --local --type raw --config /config.toml quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type raw quay.io/ <namespace> / <image> : <tag>
[[customizations.user]] name = "user" password = "pass" key = "ssh-rsa AAA ... user@email.com" groups = ["wheel"]
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v /var/lib/containers/storage:/var/lib/containers/storage -v USD(pwd)/config.toml:/config.toml -v USD(pwd)/output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type iso --config /config.toml quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type iso quay.io/ <namespace> / <image> : <tag>
[customizations.installer.kickstart] contents = """ lang en_GB.UTF-8 keyboard uk timezone CET user --name <user> --password <password> --plaintext --groups <groups> sshkey --username <user> ssh- <type> <public key> rootpw --lock zerombr clearpart --all --initlabel autopart --type=plain reboot --eject """
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v /var/lib/containers/storage:/var/lib/containers/storage -v USD(pwd)/config.toml:/config.toml -v USD(pwd)/output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type iso --config /config.toml quay.io/ <namespace> / <image> : <tag>
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type iso quay.io/ <namespace> / <image> : <tag>
[[customizations.disk.partitions]] type = "plain" label = "data" mountpoint = "/data" fs_type = "ext4" minsize = "50 GiB" [[customizations.disk.partitions]] type = "lvm" name = "mainvg" minsize = "20 GiB" [[customizations.disk.partitions.logical_volumes]] name = "rootlv" mountpoint = "/" label = "root" fs_type = "ext4" minsize = "2 GiB" [[customizations.disk.partitions.logical_volumes]] name = "homelv" mountpoint = "/home" label = "home" fs_type = "ext4" minsize = "2 GiB" [[customizations.disk.partitions.logical_volumes]] name = "swaplv" fs_type = "swap" minsize = "1 GiB"
name = "lvm" description = "A base system with custom LVM partitioning" [customizations.disk] [[customizations.disk.partitions]] mountpoint = "/var/data" minsize = "1 GiB" label = "data" fs_type = "ext4" [[customizations.disk.partitions]] mountpoint = "/" minsize = "2 GiB" label = "root" fs_type = "ext4"
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v ./config.toml:/config.toml -v ./output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type <image_type> --config config.toml quay.io/ <namespace> / <image> : <tag>
podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/output:/output -v /etc/pki:/etc/pki localhost/ <image> --type iso --config /config.toml quay.io/ <namespace>/<image>:<tag>
ls -l /etc/pki
FROM <internal_repository>/<image> RUN mkdir -p /etc/pki/ca-trust/extracted/pem/ COPY tls-ca-bundle.pem /etc/pki/ca-trust/extracted/pem/ RUN rm -rf /etc/yum.repos.d/* COPY echo-rhel9_4.repo /etc/yum.repos.d/
podman build -t <your_image> .
podman run -it --rm <your_image>
ls -l /etc/pki/ca-trust/extracted/pem/ tls-ca-bundle.pem
sudo virt-install --name bootc --memory 4096 --vcpus 2 --disk qcow2/disk.qcow2 --import --os-variant rhel9-unknown
chmod 400 <your-instance-name.pem>
ssh -i <your-instance-name.pem> ec2-user@ <your-instance-IP-address>
Basic setup text network --bootproto=dhcp --device=link --activate Basic partitioning clearpart --all --initlabel --disklabel=gpt reqpart --add-boot part / --grow --fstype xfs Reference the container image to install - The kickstart has no %packages section. A container image is being installed. ostreecontainer --url registry.redhat.io/rhel9/rhel-bootc:9.4 firewall --disabled services --enabled=sshd Only inject a SSH key for root rootpw --iscrypted locked sshkey --username root "<your key here>" reboot
inst.ks=http:// <path_to_your_kickstart>
[[blueprint.customizations.user]] name = "user" password = "pass" key = "ssh-rsa AAA ... user@email.com" groups = ["wheel"]
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml -v USD(pwd)/output:/output registry.redhat.io/rhel9/bootc-image-builder:latest --type qcow2 --config config.toml quay.io/ <namespace> / <image> : <tag>
sudo virt-install --name bootc --memory 4096 --vcpus 2 --disk qcow2/disk.qcow2 --import --os-variant rhel9
ssh -i / <path_to_private_ssh-key> <user1> @ <ip-address>
podman run --rm --privileged --pid=host -v /var/lib/containers:/var/lib/containers --security-opt label=type:unconfined_t <image> bootc install to-disk <path-to-disk>
podman run --rm --privileged -v /dev:/dev -v /var/lib/containers:/var/lib/containers -v /:/target --pid=host --security-opt label=type:unconfined_t <image> bootc install to-existing-root
podman run --rm --privileged -v /dev:/dev -v /var/lib/containers:/var/lib/containers -v /:/target --pid=host --security-opt label=type:unconfined_t <image> bootc install to-existing-root --root-ssh-authorized-keys /target/root/.ssh/authorized_keys
Enable FIPS kargs = ["fips=1"]
FROM registry.redhat.io/rhel9/rhel-bootc:latest Enable fips=1 kernel argument: https://containers.github.io/bootc/building/kernel-arguments.html COPY 01-fips.toml /usr/lib/bootc/kargs.d/ Enable the FIPS crypto policy crypto-policies-scripts is not installed by default in RHEL-10 RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
podman build -t quay.io/ <namespace> / <image> : <tag> .
*fips-mode-setup --check* FIPS mode is enabled.
Enable FIPS kargs = ["fips=1"]
FROM registry.redhat.io/rhel9/rhel-bootc:latest Enable fips=1 kernel argument: https://containers.github.io/bootc/building/kernel-arguments.html COPY 01-fips.toml /usr/lib/bootc/kargs.d/ Install and enable the FIPS crypto policy RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
sudo podman run --rm -it --privileged --pull=newer --security-opt label=type:unconfined_t -v USD(pwd)/config.toml:/config.toml:ro -v USD(pwd)/output:/output -v /var/lib/containers/storage:/var/lib/containers/storage registry.redhat.io/rhel9/bootc-image-builder:latest --local --type iso quay.io/ <namespace> / <image> : <tag>
*fips-mode-setup --check* FIPS mode is enabled.
sudo bootc switch [--apply] quay.io/ <namespace> / <image> : <tag>
FROM <baseimage> COPY <50-custom-added-modules> .conf /usr/lib/dracut/dracut.conf.d RUN set -x; kver=USD(cd /usr/lib/modules && echo *); dracut -vf /usr/lib/modules/USDkver/initramfs.img USDkver
dracutmodules = " module "
/usr/lib/dracut/dracut.conf.d/50-custom-added-modules.conf
FROM <baseimage> COPY 50-custom-added-modules.conf /usr/lib/dracut/dracut.conf.d RUN set -x; kver=USD(cd /usr/lib/modules && echo *); dracut -vf /usr/lib/modules/USDkver/initramfs.img USDkver
systemctl mask bootc-fetch-apply-updates.timer
Clear previous timers OnBootSec= OnBootSec=1w OnUnitInactiveSec=1w
mkdir -p /usr/lib/systemd/system/bootc-fetch-apply-updates.timer.d cp updates.conf /usr/lib/systemd/system/bootc-fetch-apply-updates.timer.d
bootc upgrade [--apply]
bootc rollback [-h|--help] [-V|--version]
journalctl -b
MESSAGE_ID=26f3b1eb24464d12aa5e7b544a6b5468
toolbox create <mytoolbox>
sudo toolbox create <mytoolbox> Created container: <mytoolbox> Enter with: toolbox enter
[user@toolbox ~]USD toolbox list IMAGE ID IMAGE NAME CREATED fe0ae375f149 registry.access.redhat.com/ubi{ProductVersion}/toolbox 5 weeks ago CONTAINER ID CONTAINER NAME CREATED STATUS IMAGE NAME 5245b924c2cb <mytoolbox> 7 minutes ago created registry.access.redhat.com/ubi{ProductVersion}/toolbox:8.9-6
[user@toolbox ~]USD toolbox enter <mytoolbox>
⬢ [user@toolbox ~]USD cat /run/.containerenv engine="podman-4.8.2" name=" <mytoolbox> " id="5245b924c2cb..." image="registry.access.redhat.com/ubi{ProductVersion}/toolbox" imageid="fe0ae375f14919cbc0596142e3aff22a70973a36e5a165c75a86ea7ec5d8d65c"
⬢[user@toolbox ~]USD sudo dnf install emacs gcc gdb
⬢[user@toolbox ~]USD dnf repoquery --info --installed <package_name>
⬢[root@toolbox ~]# dnf install systemd
⬢[root@toolbox ~]# j journalctl --boot -0 Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: microcode: updated ear> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: Linux version 6.6.8-10> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: Command line: BOOT_IMA> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: x86/split lock detecti> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: BIOS-provided physical>
⬢[root@toolbox ~]# journalctl --boot -0 --dmesg Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: microcode: updated ear> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: Linux version 6.6.8-10> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: Command line: BOOT_IMA> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: x86/split lock detecti> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: BIOS-provided physical> Jan 02 09:06:48 user-thinkpadp1gen4i.brq.csb kernel: BIOS-e820: [mem 0x0000>
⬢[root@toolbox ~]# dnf install nmap
⬢[root@toolbox ~]# nmap -sS scanme.nmap.org Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-02 10:39 CET Stats: 0:01:01 elapsed; 0 hosts completed (0 up), 256 undergoing Ping Scan Ping Scan Timing: About 29.79% done; ETC: 10:43 (0:02:24 remaining) Nmap done: 256 IP addresses (0 hosts up) scanned in 206.45 seconds
⬢ [user@toolbox ~]USD exit
⬢ [user@toolbox ~]USD podman stop <mytoolbox>
⬢ [user@toolbox ~]USD toolbox rm <mytoolbox>
/usr/lib/bootc/kargs.d/10-example.toml kargs = ["mitigations=auto,nosmt"]
/usr/lib/bootc/kargs.d/00-console.toml kargs = ["console=ttyS0,114800n8"] match-architectures = ["x86_64"]
FROM registry.redhat.io/rhel9/rhel-bootc:latest RUN mkdir -p /usr/lib/bootc/kargs.d RUN cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml kargs = ["console=ttyS0,114800n8"] match-architectures = ["x86_64"] EOF RUN cat <<EOF >> /usr/lib/bootc/kargs.d/01-mitigations.toml kargs = ["mitigations=on", "systemd.unified_cgroup_hierarchy=0"] match-architectures = ["x86_64", "aarch64"] EOF
bootc install to-filesystem --karg
{ "customizations": { "kernel": { "append": "mitigations=auto,nosmt" } } }
rpm-ostree kargs --help
rpm-ostree kargs --append debug Staging deployment... done Freed: 40.1 MB (pkgcache branches: 0) Changes queued for next boot. Run "systemctl reboot" to start a reboot
RUN rmdir /opt/exampleapp/logs && ln -sr /var/log/exampleapp /opt/exampleapp/logs
BindPaths=/var/log/exampleapp:/opt/exampleapp/logs
[root] transient = true
RUN useradd someuser
COPY mycustom-user.conf /usr/lib/sysusers.d
f~ /home/ user /.ssh/ authorized_keys 600 user user - <base64 encoded data>
FROM registry.redhat.io/rhel9/bootc-image-builder:latest COPY containers-auth.conf /usr/lib/tmpfiles.d/link-podman-credentials.conf RUN --mount=type=secret,id=creds,required=true cp /run/secrets/creds /usr/lib/container-auth.json && chmod 0600 /usr/lib/container-auth.json && ln -sr /usr/lib/container-auth.json /etc/ostree/auth.json
FROM quay.io/ <namespace> / <image> :_<tag>_ COPY containers-auth.conf /usr/lib/tmpfiles.d/link-podman-credentials.conf RUN --mount=type=secret,id=creds,required=true cp /run/secrets/creds /usr/lib/container-auth.json && chmod 0600 /usr/lib/container-auth.json && ln -sr /usr/lib/container-auth.json /etc/ostree/auth.json
%pre mkdir -p /etc/ostree cat > /etc/ostree/auth.json << 'EOF' { "auths": { "quay.io": { "auth": "<your secret here>" } } } EOF %end
%pre mkdir -p /etc/containers/registries.conf.d/ cat > /etc/containers/registries.conf.d/local-registry.conf << 'EOF' [[registry]] location="[IP_Address]:5000" insecure=true EOF %end
/etc/example-proxy.env https_proxy="http://example.com:8080" all_proxy="http://example.com:8080" http_proxy="http://example.com:8080" HTTP_PROXY="http://example.com:8080" HTTPS_PROXY="http://example.com:8080" no_proxy="*.example.com,127.0.0.1,0.0.0.0,localhost"
/usr/lib/systemd/system/bootc-fetch-apply-updates.service.d/99-proxy.conf [Service] EnvironmentFile=/etc/example-proxy.env