Chapter 1. Using image mode for RHEL with MicroShift You can embed MicroShift into an operating system image using image mode for Red Hat Enterprise Linux (RHEL). Important Image mode for RHEL is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope . 1.1. Image mode for Red Hat Enterprise Linux (RHEL) Image mode for Red Hat Enterprise Linux (RHEL) is a Technology Preview deployment method that uses a container-native approach to build, deploy, and manage the operating system as a bootc image. By using bootc, you can build, deploy, and manage the operating system as if it is any other container. This container image uses standard OCI or Docker containers as a transport and delivery format for base operating system updates. A bootc image includes a Linux kernel that is used to start the operating system. By using bootc containers, developers, operations administrators, and solution providers can all use the same container-native tools and techniques. Image mode splits the creation and installation of software changes into two steps: one on a build system and one on a running target system. In the build-system step, a Podman build inspects the RPM files available for installation, determines any dependencies, and creates an ordered list of chained steps to complete, with the end result being a new operating system available to install. In the running-target-system step, a bootc update downloads, unpacks, and makes the new operating system bootable alongside the currently running system. Local configuration changes are carried forward to the new operating system, but do not take effect until the system is rebooted and the new operating system image replaces the running image. 1.1.1. Using image mode for RHEL with MicroShift To use image mode for RHEL, ensure that the following resources are available: A RHEL 9.4 host with an active Red Hat subscription for building MicroShift bootc images. A remote registry for storing and accessing bootc images. You can use image mode for RHEL with a MicroShift cluster on AArch64 or x86_64 system architectures. The workflow for using image mode with MicroShift includes the following steps: Build the MicroShift bootc image. Publish the image. Run the image. This step includes configuring MicroShift networking and storage. Important The rpm-ostree file system is not supported in image mode and must not be used to make changes to deployments that use image mode. 1.2. Building the bootc image Build your Red Hat Enterprise Linux (RHEL) that contains MicroShift as a bootable container image by using a Containerfile. Important Image mode for RHEL is Technology Preview. Using a bootc image in production environments is not supported. Prerequisites A Red Hat Enterprise Linux (RHEL) 9.4 host with an active Red Hat subscription for building MicroShift bootc images and running containers. You are logged into the RHEL 9.4 host using the user credentials that have sudo permissions. The rhocp and fast-datapath repositories are accessible in the host subscription. The repositories do not necessarily need to be enabled on the host. You have a remote registry such as Red Hat quay for storing and accessing bootc images. Procedure Create a Containerfile that includes the following instructions: Example Containerfile for RHEL image mode FROM registry.redhat.io/rhel9/rhel-bootc:9.4 ARG USHIFT_VER=4.17 RUN dnf config-manager \ --set-enabled rhocp-USD{USHIFT_VER}-for-rhel-9-USD(uname -m)-rpms \ --set-enabled fast-datapath-for-rhel-9-USD(uname -m)-rpms RUN dnf install -y firewalld microshift && \ systemctl enable microshift && \ dnf clean all # Create a default 'redhat' user with the specified password. # Add it to the 'wheel' group to allow for running sudo commands. ARG USER_PASSWD RUN if [ -z "USD{USER_PASSWD}" ] ; then \ echo USER_PASSWD is a mandatory build argument && exit 1 ; \ fi RUN useradd -m -d /var/home/redhat -G wheel redhat && \ echo "redhat:USD{USER_PASSWD}" | chpasswd # Mandatory firewall configuration RUN firewall-offline-cmd --zone=public --add-port=22/tcp && \ firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 && \ firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 # Create a systemd unit to recursively make the root filesystem subtree # shared as required by OVN images RUN cat > /etc/systemd/system/microshift-make-rshared.service <<'EOF' [Unit] Description=Make root filesystem shared Before=microshift.service ConditionVirtualization=container [Service] Type=oneshot ExecStart=/usr/bin/mount --make-rshared / [Install] WantedBy=multi-user.target EOF RUN systemctl enable microshift-make-rshared.service Important Podman uses the host subscription information and repositories inside the container when building the container image. If the rhocp and fast-datapath repositories are not available on the host, the build fails. Create a local bootc image by running the following image build command: PULL_SECRET=~/.pull-secret.json USER_PASSWD=<your_redhat_user_password> 1 IMAGE_NAME=microshift-4.17-bootc USD sudo podman build --authfile "USD{PULL_SECRET}" -t "USD{IMAGE_NAME}" \ --build-arg USER_PASSWD="USD{USER_PASSWD}" \ -f Containerfile 1 Replace <your_redhat_user_password> with your password. Note How secrets are used during the image build: The podman --authfile argument is required to pull the base rhel-bootc:9.4 image from the registry.redhat.io registry. The build USER_PASSWD argument is used to set a password for the redhat user. Verification Verify that the local bootc image was created by running the following command: USD sudo podman images "USD{IMAGE_NAME}" Example output REPOSITORY TAG IMAGE ID CREATED SIZE localhost/microshift-4.17-bootc latest 193425283c00 2 minutes ago 2.31 GB 1.3. Publishing the bootc image to the remote registry Publish your bootc image to the remote registry so that the image can be used for running the container on another host, or for when you want to install a new operating system with the bootc image layer. Prerequisites You are logged in to the RHEL 9.4 host where the image was built using the user credentials that have sudo permissions. You have a remote registry such as Red Hat quay for storing and accessing bootc images. You created the Containerfile and built the image. Procedure Log in to your remote registry by running the following command: REGISTRY_URL=quay.io USD sudo podman login "USD{REGISTRY_URL}" 1 1 Replace REGISTRY_URL with the URL for your registry. Publish the image by running the following command: REGISTRY_IMG=<myorg/mypath>/"USD{IMAGE_NAME}" 1 2 IMAGE_NAME=<microshift-4.17-bootc> 3 USD sudo podman push localhost/"USD{IMAGE_NAME}" "USD{REGISTRY_URL}/USD{REGISTRY_IMG}" 1 Replace <myorg/mypath> with your remote registry organization name and path. 2 Replace <microshift-4.17-bootc> with the name of the image you want to publish. Verification Run the container using the image you pushed to your registry as described in the "Running the MicroShift bootc container" section. 1.4. Additional resources Image mode for Red Hat Enterprise Linux learning exercises Using image mode for RHEL to build, deploy, and manage operating systems

Commands:
FROM registry.redhat.io/rhel9/rhel-bootc:9.4 ARG USHIFT_VER=4.17 RUN dnf config-manager --set-enabled rhocp-USD{USHIFT_VER}-for-rhel-9-USD(uname -m)-rpms --set-enabled fast-datapath-for-rhel-9-USD(uname -m)-rpms RUN dnf install -y firewalld microshift && systemctl enable microshift && dnf clean all Create a default 'redhat' user with the specified password. Add it to the 'wheel' group to allow for running sudo commands. ARG USER_PASSWD RUN if [ -z "USD{USER_PASSWD}" ] ; then echo USER_PASSWD is a mandatory build argument && exit 1 ; fi RUN useradd -m -d /var/home/redhat -G wheel redhat && echo "redhat:USD{USER_PASSWD}" | chpasswd Mandatory firewall configuration RUN firewall-offline-cmd --zone=public --add-port=22/tcp && firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 && firewall-offline-cmd --zone=trusted --add-source=169.254.169.1 Create a systemd unit to recursively make the root filesystem subtree shared as required by OVN images RUN cat > /etc/systemd/system/microshift-make-rshared.service <<'EOF' [Unit] Description=Make root filesystem shared Before=microshift.service ConditionVirtualization=container [Service] Type=oneshot ExecStart=/usr/bin/mount --make-rshared / [Install] WantedBy=multi-user.target EOF RUN systemctl enable microshift-make-rshared.service
PULL_SECRET=~/.pull-secret.json USER_PASSWD=<your_redhat_user_password> 1 IMAGE_NAME=microshift-4.17-bootc sudo podman build --authfile "USD{PULL_SECRET}" -t "USD{IMAGE_NAME}" --build-arg USER_PASSWD="USD{USER_PASSWD}" -f Containerfile
sudo podman images "USD{IMAGE_NAME}"
REPOSITORY TAG IMAGE ID CREATED SIZE localhost/microshift-4.17-bootc latest 193425283c00 2 minutes ago 2.31 GB
REGISTRY_URL=quay.io sudo podman login "USD{REGISTRY_URL}" 1
REGISTRY_IMG=<myorg/mypath>/"USD{IMAGE_NAME}" 1 2 IMAGE_NAME=<microshift-4.17-bootc> 3 sudo podman push localhost/"USD{IMAGE_NAME}" "USD{REGISTRY_URL}/USD{REGISTRY_IMG}"