UKI Cleanup by Johan-Liebert1 · Pull Request #2200 · bootc-dev/bootc

Johan-Liebert1 · 2026-05-15T07:22:34Z

ukify: Allow passing custom kernel, initramfs

While building a sealed UKI image we'd want to remove the original
kernel + initramfs from the final image and have only the final UKI
present. This was not possible before as bootc container ukify
expected kernel + initramfs to be present in usr/lib/modules of
container root

Fixes: #2185

dockerfile/uki: Rework to remove kernel + initrd

Now that we can pass kernel and initrd paths to bootc ukify, rework
our UKI Dockerfile to remove kernel + initrd from the final layer
and only keep the UKI

This still will not remove the kernel + initrd from the tarball but
have whiteout instead

See #2027 (comment)

test/integration: Test vmlinuz non-existence with UKI

vmlinuz and intrd should not be present in UKI images; add test for the
same

gemini-code-assist

Code Review

This pull request refactors the UKI (Unified Kernel Image) build process to support passing explicit kernel and initramfs paths via CLI arguments, reducing reliance on auto-discovery within the rootfs. Key changes include updating the seal-uki and finalize-uki scripts to use named arguments, modifying Dockerfile stages to extract and clean up kernel components, and extending the Rust library and CLI to handle the new parameters. Review feedback identified a potential path resolution bug in the Rust file existence checks, a filename mismatch in the upgrade test Dockerfile, and suggested improvements for error handling and validation in the seal-uki script.

cgwalters · 2026-05-18T12:53:24Z

+    cat >> /tmp/Containerfile.drop-lbis <<-EOF
+FROM base as kernel
+RUN <<-RUNEOF
+    objcopy -O binary --only-section=.initrd /boot/EFI/Linux/*.efi /boot/initramfs.img


We were discussing maybe having this in bootc - bootc internals uki extract?

cgwalters · 2026-05-18T12:55:19Z

    how: fmf
    test:
      - /tmt/tests/tests/test-37-install-no-boot-dir
+  extra-fixme_skip_if_composefs: true


How is this related?

From live chat - we probably want to test at a basic level that composefs tests actually install that way

Oh, this is failing for another reason. I kinda lumped it with the bootloader=none one

Actually this is failing for composefs because bootloader=none is not supported for composefs and this test fails when trying to install bootloader for composefs. For ostree, the bootloader installation is simply skipped with bootloader=none

I did end up fixing a containers-storage permission issue while debugging this

cgwalters · 2026-05-19T13:14:13Z

-    RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp \
-        --mount=type=bind,from=sealed-uki,src=/,target=/run/sealed-uki \
-        /usr/bin/finalize-uki /run/sealed-uki/out
+    cat >> /tmp/Containerfile.drop-lbis <<-EOF


This isn't about dropping lbis?

This is kinda confusing but the original Dockerfile is for removing lbis and we just append UKI stuff to it

cgwalters · 2026-05-19T13:27:49Z

+        kver=$(bootc container inspect --rootfs /run/base-penultimate-src --json | jq -r '.kernel.version')
+
+        rm -v "/usr/lib/modules/$kver/vmlinuz"
+        rm -v "/usr/lib/modules/$kver/initramfs.img"
+    fi


Since this one would end up being closer to user-facing, I would prefer to streamline this more.

I think what would work best is to have our "base" build process be a stage that generates a single intermediate image with /rootfs and /kernel or so. This could be part of bootc-base-imagectl, or we could have it be part of something more like bootc container split-root-and-uki?

sgtm. By the "base" build process, are you referring to the Dockerfile (in bootc) or is it about something else?

The pattern we apply to this should generalize to https://github.com/cgwalters/rhel-bootc-examples/tree/sealed/sealing as well etc.

travier · 2026-05-20T07:48:38Z

I think we should have the kernel and initrd as required arguments and thus only support the case where they are not in the rootfs anymore as I don't see a use case where someone would want a sealed image with both a UKI and split out kernel and initrd.

Edit: That would break the current bootc container ukify signature but I don't think we've declared it stable yet?

cgwalters · 2026-05-20T21:55:58Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

travier · 2026-05-21T14:21:29Z

Failures are transient & volatile related. Maybe from #2201?

While building a sealed UKI image we'd want to remove the original kernel + initramfs from the final image and have only the final UKI present. This was not possible before as `bootc container ukify` expected kernel + initramfs to be present in `usr/lib/modules` of container root Fixes: bootc-dev#2185 Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com> Mark `bootc container ukify` without `--kernel` and `--initramfs` as deprecated

Now that we can pass kernel and initrd paths to `bootc ukify`, rework our UKI Dockerfile to remove kernel + initrd from the final layer and only keep the UKI This still will not *remove* the kernel + initrd from the tarball but have whiteout instead See bootc-dev#2027 (comment) Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Bootloader set to none is not supported with the composefs backend so we skip tests with this option for composefs backend Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

We were defaulting to unprivileged user "nobody" when pulling an image, but pulling from containers-storage was failing as it requires extra privileges. Default to the current user, usually root, when pulling from containers-storage Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 · 2026-05-28T10:30:54Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

Don't know if clap has a way to do this, if it does I couldn't find it. We just print our custom warning if --kernel and --initramfs are not passed in

Baseconfigs tests were failing in CI because the initrd which had the expected baseconfigs was being deleted in the same layer it was being created in. Move the deletion to a completely separate layer Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cgwalters · 2026-05-28T14:02:53Z

+                    }),
+
+                    (None, None) => {
+                        eprintln!(


I am having second thoughts, it should not be too onerous for us to just continue to support what we shipped before. I think we can drop the eprintln!

cgwalters · 2026-05-28T14:04:22Z

+
+        /// Path to the kernel
+        #[clap(long, requires = "initramfs", requires = "kver")]
+        kernel: Option<Utf8PathBuf>,


What I am thinking here is we could make this --kernel-dir which is defined to be a path to something like /usr/lib/modules/$kver.

That solves three problems:

We expect kernel+initramfs in one place, so we don't need separate args for them

We also require the directory to be named the same as a modules dir, so we don't need a separate kver argument

Johan-Liebert1 requested a review from cgwalters May 15, 2026 07:22

Johan-Liebert1 added the ci/merge Run full CI suite (all OSes) — equivalent to merge queue label May 15, 2026

gemini-code-assist Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/lib/src/ukify.rs Outdated

Comment thread tmt/tests/Dockerfile.upgrade Outdated

Comment thread contrib/packaging/seal-uki Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from cb42d78 to 8a3ed64 Compare May 15, 2026 08:09

github-actions Bot added the area/documentation Updates to the documentation label May 15, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch 7 times, most recently from 66dc0e3 to 3a9dc2b Compare May 18, 2026 10:09

cgwalters reviewed May 18, 2026

View reviewed changes

Johan-Liebert1 force-pushed the uki-cleanup branch from 3a9dc2b to 8e581d4 Compare May 19, 2026 09:35

Johan-Liebert1 requested a review from cgwalters May 19, 2026 10:13

Johan-Liebert1 force-pushed the uki-cleanup branch from 8e581d4 to 503b07a Compare May 19, 2026 13:00

cgwalters reviewed May 19, 2026

View reviewed changes

travier reviewed May 21, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from 503b07a to 8a5c7ae Compare May 21, 2026 10:10

Johan-Liebert1 force-pushed the uki-cleanup branch from 8a5c7ae to cc8a2d8 Compare May 28, 2026 06:48

github-actions Bot added area/install Issues related to `bootc install` area/ostree Issues related to ostree labels May 28, 2026

Johan-Liebert1 added 5 commits May 28, 2026 15:59

test/integration: Test vmlinuz non-existence with UKI

c2caca8

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

test/tmt: Don't run bootloader-none test for composefs

f4fb7b9

Bootloader set to none is not supported with the composefs backend so we skip tests with this option for composefs backend Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch from f2c3424 to 667a0fd Compare May 28, 2026 10:30

Johan-Liebert1 force-pushed the uki-cleanup branch from 667a0fd to 4d6bed6 Compare May 28, 2026 12:36

Johan-Liebert1 force-pushed the uki-cleanup branch from 4d6bed6 to 20e2fed Compare May 28, 2026 13:11

cgwalters requested changes May 28, 2026

View reviewed changes

Conversation

Johan-Liebert1 commented May 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

travier commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cgwalters commented May 20, 2026

Uh oh!

Uh oh!

travier commented May 21, 2026

Uh oh!

Johan-Liebert1 commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

travier commented May 20, 2026 •

edited

Loading

Johan-Liebert1 commented May 28, 2026 •

edited

Loading