osbuild: use bootc install to deploy the container

Instead of deploying the container to the tree then copy all the contents
to the disk image, use bootc to directly manage the installation to the
target filesystems.

We can keep the manifest duplicated until we are confident to roll this
to all streams or move to image-builder.

Requires:
bootc-dev/bootc#1460
bootc-dev/bootc#1451
osbuild/osbuild#2149
osbuild/osbuild#2152
bootc-dev/bootc#1978
bootc-dev/bootc#1909

Author: jbtrystram

src/osbuild-manifests/coreos.osbuild.x86_64.bootc.mpp.yaml

@@ -150,103 +150,6 @@ pipelines:
                 images:
                   - source: $container_repo
                     tag: $container_tag
-  - name: tree
-    build:
-      mpp-format-string: '{buildroot}'
-    source-epoch: 1659397331
-    stages:
-      # Set the context of the root of the tree so that we avoid unlabeled_t files.
-      # https://github.com/coreos/fedora-coreos-tracker/issues/1772
-      - type: org.osbuild.selinux
-        options:
-          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
-          target: tree:///
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:deployed-tree
-      - type: org.osbuild.ostree.init-fs
-      - type: org.osbuild.ostree.os-init
-        options:
-          osname:
-            mpp-format-string: '{osname}'
-      - type: org.osbuild.ostree.config
-        options:
-          repo: /ostree/repo
-          config:
-            sysroot:
-              readonly: true
-              bootloader: none
-              # https://github.com/coreos/fedora-coreos-tracker/issues/1333
-              bls-append-except-default: grub_users=""
-              # Opt-in to https://github.com/ostreedev/ostree/pull/2705 which will
-              # add /boot as the prefix on top of BLS config entries. This is OK
-              # because there is a symlink that is created in the root of the boot
-              # filesystem by OSTree (boot -> .) that makes it so that /boot paths
-              # will always work.
-              bootprefix: true
-      - type: org.osbuild.mkdir
-        options:
-          paths:
-            - path: /boot/efi
-              mode: 493
-      - type: org.osbuild.ignition
-      # Deploy via ociarchive or container
-      - mpp-if: ociarchive != ''
-        then:
-          type: org.osbuild.ostree.deploy.container
-          options:
-            osname:
-              mpp-format-string: '{osname}'
-            target_imgref:
-              mpp-format-string: '{container_imgref}'
-            mounts:
-              - /boot
-              - /boot/efi
-            kernel_opts:
-              - rw
-              - '$ignition_firstboot'
-              - mpp-format-string: '{extra_kargs}'
-          inputs:
-            images:
-              type: org.osbuild.containers
-              origin: org.osbuild.pipeline
-              references:
-                name:oci-archive:
-                  name: coreos.ociarchive
-        else:
-          type: org.osbuild.ostree.deploy.container
-          options:
-            osname:
-              mpp-format-string: '{osname}'
-            target_imgref:
-              mpp-format-string: '{container_imgref}'
-            mounts:
-              - /boot
-              - /boot/efi
-            kernel_opts:
-              - rw
-              - '$ignition_firstboot'
-              - mpp-format-string: '{extra_kargs}'
-          inputs:
-            images:
-              type: org.osbuild.containers-storage
-              origin: org.osbuild.source
-              mpp-resolve-images:
-                images:
-                  - source: $container_repo
-                    tag: $container_tag
-      - type: org.osbuild.ostree.aleph
-        options:
-          coreos_compat: true
-          deployment:
-            default: true
-      - type: org.osbuild.ostree.selinux
-        options:
-          deployment:
-            default: true
   - name: raw-image
     build:
       mpp-format-string: '{buildroot}'
@@ -349,69 +252,37 @@ pipelines:
             partition:
               mpp-format-int: '{image.layout[''boot''].partnum}'
             target: /boot-mount-point
-      - type: org.osbuild.selinux
-        options:
-          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
-          target: mount://root/
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:deployed-tree
-        devices:
-          disk:
-            type: org.osbuild.loopback
-            options:
-              filename: disk.img
-              partscan: true
-        mounts:
-          - name: root
-            type: org.osbuild.xfs
-            source: disk
-            partition:
-              mpp-format-int: '{image.layout[''root''].partnum}'
-            target: /
-      - type: org.osbuild.selinux
-        options:
-          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
-          target: mount://root/boot/
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:deployed-tree
-        devices:
-          disk:
-            type: org.osbuild.loopback
-            options:
-              filename: disk.img
-              partscan: true
-        mounts:
-          - name: root
-            type: org.osbuild.xfs
-            source: disk
-            partition:
-              mpp-format-int: '{image.layout[''root''].partnum}'
-            target: /
-          - name: boot
-            type: org.osbuild.ext4
-            source: disk
-            partition:
-              mpp-format-int: '{image.layout[''boot''].partnum}'
-            target: /boot
-      - type: org.osbuild.copy
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:tree
+      # Use bootc install to-filesystem to install the ostree content from the container image
+      # inside our disc image
+      - type: org.osbuild.bootc.install-to-filesystem
+        inputs: 
+          images:
+            mpp-if: ociarchive != ''
+            then:
+              type: org.osbuild.containers
+              origin: org.osbuild.pipeline
+              references:
+                name:oci-archive:
+                  name: coreos.ociarchive
+            else:
+              type: org.osbuild.containers-storage
+              origin: org.osbuild.source
+              mpp-resolve-images:
+                images:
+                  - source: $container_repo
+                    tag: $container_tag
         options:
-          paths:
-            - from: input://tree/
-              to: mount://root/
+          kernel-args:
+            - '$ignition_firstboot'
+            - mpp-format-string: '{extra_kargs}'
+          target-imgref:
+            mpp-format-string: '{container_imgref}'
+          stateroot:
+            mpp-format-string: '{osname}'
+          # Empty strings mean mount spec kargs are ommited entirely.
+          # See github.com/bootc-dev/bootc/issues/1441
+          boot-mount-spec: ""
+          root-mount-spec: ""
         devices:
           disk:
             type: org.osbuild.loopback
@@ -437,13 +308,11 @@ pipelines:
             partition:
               mpp-format-int: '{image.layout[''EFI-SYSTEM''].partnum}'
             target: /boot/efi
-      - type: org.osbuild.bootupd
+      # set up the `ignition.firstboot` stamp at the end because
+      # bootc want empty filesystems
+      - type: org.osbuild.ignition
         options:
-          bios:
-            device: disk
-          static-configs: true
-          deployment:
-            default: true
+          target: mount://boot/
         devices:
           disk:
             type: org.osbuild.loopback
@@ -463,36 +332,6 @@ pipelines:
             partition:
               mpp-format-int: '{image.layout[''boot''].partnum}'
             target: /boot
-          - name: efi
-            type: org.osbuild.fat
-            source: disk
-            partition:
-              mpp-format-int: '{image.layout[''EFI-SYSTEM''].partnum}'
-            target: /boot/efi
-      - type: org.osbuild.chattr
-        options:
-          items:
-            mount://root/:
-              immutable: true
-        devices:
-          disk:
-            type: org.osbuild.loopback
-            options:
-              filename: disk.img
-              partscan: true
-        mounts:
-          - name: root
-            type: org.osbuild.xfs
-            source: disk
-            partition:
-              mpp-format-int: '{image.layout[''root''].partnum}'
-            target: /
-          - name: ostree.deployment
-            type: org.osbuild.ostree.deployment
-            options:
-              source: mount
-              deployment:
-                default: true
   - name: raw-4k-image
     build:
       mpp-format-string: '{buildroot}'
@@ -605,6 +444,10 @@ pipelines:
             partition:
               mpp-format-int: '{image4k.layout[''boot''].partnum}'
             target: /boot-mount-point
+      # Set the context of the root of disk so that we avoid unlabeled_t files.
+      # Here we make sure to not mount the boot partition because we want to label
+      # the directory mount point
+      # https://github.com/coreos/fedora-coreos-tracker/issues/1772
       - type: org.osbuild.selinux
         options:
           file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
@@ -630,10 +473,12 @@ pipelines:
             partition:
               mpp-format-int: '{image4k.layout[''root''].partnum}'
             target: /
+      # Then we mount le boot parition and label again so the /boot/efi
+      # mount point is labeled properly
       - type: org.osbuild.selinux
         options:
           file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
-          target: mount://root/boot/
+          target: mount://root/boot
         inputs:
           tree:
             type: org.osbuild.tree
@@ -661,17 +506,37 @@ pipelines:
             partition:
               mpp-format-int: '{image4k.layout[''boot''].partnum}'
             target: /boot
-      - type: org.osbuild.copy
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:tree
+      # Use bootc install to-filesystem to install the ostree content from the container image
+      # inside our disc image
+      - type: org.osbuild.bootc.install-to-filesystem
+        inputs: 
+          images:
+            mpp-if: ociarchive != ''
+            then:
+              type: org.osbuild.containers
+              origin: org.osbuild.pipeline
+              references:
+                name:oci-archive:
+                  name: coreos.ociarchive
+            else:
+              type: org.osbuild.containers-storage
+              origin: org.osbuild.source
+              mpp-resolve-images:
+                images:
+                  - source: $container_repo
+                    tag: $container_tag
         options:
-          paths:
-            - from: input://tree/
-              to: mount://root/
+          kernel-args:
+            - '$ignition_firstboot'
+            - mpp-format-string: '{extra_kargs}'
+          target-imgref:
+            mpp-format-string: '{container_imgref}'
+          stateroot:
+            mpp-format-string: '{osname}'
+          # Empty strings mean mount spec kargs are ommited entirely.
+          # See github.com/bootc-dev/bootc/issues/1441
+          boot-mount-spec: ""
+          root-mount-spec: ""
         devices:
           disk:
             type: org.osbuild.loopback
@@ -699,11 +564,11 @@ pipelines:
             partition:
               mpp-format-int: '{image4k.layout[''EFI-SYSTEM''].partnum}'
             target: /boot/efi
-      - type: org.osbuild.bootupd
+      # set up the `ignition.firstboot` stamp at the end because
+      # bootc want empty filesystems
+      - type: org.osbuild.ignition
         options:
-          static-configs: true
-          deployment:
-            default: true
+          target: mount://boot/
         devices:
           disk:
             type: org.osbuild.loopback
@@ -725,38 +590,6 @@ pipelines:
             partition:
               mpp-format-int: '{image4k.layout[''boot''].partnum}'
             target: /boot
-          - name: efi
-            type: org.osbuild.fat
-            source: disk
-            partition:
-              mpp-format-int: '{image4k.layout[''EFI-SYSTEM''].partnum}'
-            target: /boot/efi
-      - type: org.osbuild.chattr
-        options:
-          items:
-            mount://root/:
-              immutable: true
-        devices:
-          disk:
-            type: org.osbuild.loopback
-            options:
-              filename: disk.img
-              partscan: true
-              sector-size:
-                  mpp-format-int: "{four_k_sector_size}"
-        mounts:
-          - name: root
-            type: org.osbuild.xfs
-            source: disk
-            partition:
-              mpp-format-int: '{image4k.layout[''root''].partnum}'
-            target: /
-          - name: ostree.deployment
-            type: org.osbuild.ostree.deployment
-            options:
-              source: mount
-              deployment:
-                default: true
   - mpp-import-pipelines:
       path: platform.aliyun.ipp.yaml
   - mpp-import-pipelines: