feat(iso): embed installer payload as OCI layout inside the live root image - #5
Merged
Merged
Conversation
Instead of image-builder's containers-storage payload embed (which forces bootc install to re-tar ~2.5 GiB into a RAM-backed /var/tmp), the -iso container now carries the payload as an OCI layout at /usr/lib/luminusos/payload.oci, exported into the build context with skopeo beforehand (Justfile locally, a workflow step in CI) and COPYed into the live root. bootc install streams the blobs straight to disk, so the RAM floor drops to what the live GNOME session needs; a full install was verified in a 4 GB RAM VM. This also removes the osbuild manifest patching entirely: packaging is a plain image-builder bootc-generic-iso run again, with no --bootc-installer-payload-ref, so it keeps working even if upstream drops payload embedding from the generic ISO (osbuild/image-builder#2414). The final container verification asserts the embedded index.json carries the :latest ref name annotation that bootc resolves against. Redundant comments in the touched scripts and Containerfile were trimmed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Moves the installer payload embedding from an osbuild manifest patch into the
-isocontainer image itself: the payload is exported as an OCI layout withskopeo copybefore the container build (Justfile locally, a workflow step in CI) andCOPYed into the live root at/usr/lib/luminusos/payload.oci.Upstream discussion: osbuild/image-builder#2536: this implements the container-side embedding suggested by @supakeen and is compatible with osbuild/image-builder#2414 (generic ISO rework that drops
--bootc-installer-payload-ref): we no longer pass any payload flag to image-builder at all.Supersedes the manifest-patch approach from #4:
package isoandci-package.share plainimage-builder build bootc-generic-iso --bootc-refinvocations again, andtools/patch-iso-payload-to-oci.shis removed.Why
The containers-storage payload embed forces
bootc installto re-diff and re-tar every layer into a RAM-backed/var/tmp(~2.5 GiB) on the live ISO. With the OCI layout, install streams the ready-made blobs straight to disk:The ISO growth is the dedup tradeoff: with containers-storage the payload lives unpacked inside the squashfs and mksquashfs dedups it against the nearly identical live rootfs; pre-compressed OCI blobs can be neither recompressed nor deduped. Worth it: a full install completed successfully in a 4 GB RAM VM.
Details
Containerfile.installercopies.test/payload.ociinto the live root and the final verification asserts the OCIindex.jsoncarries theorg.opencontainers.image.ref.name: "latest"annotation thatbootc install --source-imgref oci:...:latestresolves against (an untaggedskopeo copy oci:writes no ref name and fails withno descriptor found for reference "latest").just build workstation-isoexports the payload from local containers-storage beforebuildah bud.publish.ymlstep exports the payload from GHCR with skopeo (reusing thedocker/login-actioncredentials); the ISO job uses the simplifiedci-package.sh.Testing
tests/run.shpasses.just build workstation-iso+just package iso→ ISO boots to Sirius → full install completed in a 4 GB RAM QEMU VM (UEFI).