Skip to content

feat: make rpm-ostree use oci-dir + rootless CI #261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
renner0e merged 3 commits into from
Aug 14, 2026
+17 −15
Merged

feat: make rpm-ostree use oci-dir + rootless CI #261

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
869b8a4
feat: make rpm-ostree use oci-dir + rootless CI
renner0e Aug 2, 2026
d0036b7
add rpm-ostree oci dir to gitignore
renner0e Aug 13, 2026
cd98ea3
feat: output to oci-archive instead
renner0e Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,15 +70,15 @@ jobs:
- name: Build Image
id: build-image
run: |
sudo -E $(command -v just) build \
just build \
${IMAGE_NAME} \
${DEFAULT_TAG}

# This is optional, this provides smaller delta updates
- name: Rechunk with rpm-ostree
id: rechunk
run: |
sudo -E $(command -v just) ostree-rechunk \
just ostree-rechunk \
${IMAGE_NAME} \
${DEFAULT_TAG}

Expand All @@ -88,7 +88,7 @@ jobs:
#- name: Rechunk with Chunkah
# id: rechunk
# run: |
# sudo -E $(command -v just) rechunk \
# just rechunk \
# ${IMAGE_NAME} \
# ${DEFAULT_TAG}

Expand All @@ -108,7 +108,7 @@ jobs:
env:
ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
run: |
sudo -E $(command -v just) tag-images \
just tag-images \
"${IMAGE_NAME}" \
"${DEFAULT_TAG}" \
"${ALIAS_TAGS}"
Expand All @@ -131,7 +131,7 @@ jobs:
run: |
set -euox pipefail
for tag in ${ALIAS_TAGS}; do
sudo -E podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
podman push --digestfile=/tmp/digestfile ${IMAGE_NAME}:${tag} ${IMAGE_REGISTRY}/${IMAGE_NAME}:${tag}
done

digest=$(< /tmp/digestfile)
Expand Down
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,4 @@ _build_*
output
_build-*/**
*_chunkah_*
*_rpm-ostree_*
21 changes: 11 additions & 10 deletions Justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,28 +168,29 @@ ostree-rechunk $target_image=image_name $tag=default_tag:

set -xeuo pipefail

# TODO: This is the only blocker for rootless CI
# https://github.com/coreos/rpm-ostree/issues/5346
if [[ ! "${UID}" -eq "0" ]]; then
echo "This needs to run as root."
exit 1
fi

# Use the already-built local image to avoid pulling from a remote registry
RPM_OSTREE_CHUNKER_IMAGE="localhost/${target_image}:${tag}"

RPM_OSTREE_OUTPUT_DIR="$(mktemp -d ./"${target_image}"_rpm-ostree_XXXXXX)"

trap 'rm -rf "${RPM_OSTREE_OUTPUT_DIR}"' EXIT

podman run --rm \
--pull=never \
--mount=type=image,src="${target_image}:${tag}",target=/rpm-ostree \
--privileged \
-v "/var/lib/containers:/var/lib/containers" \

@TheMDev TheMDev Aug 14, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Out of curiosity could this line just have been -v "~/.local/share/containers/storage:/var/lib/containers" \ and then we wouldnt have to mess around with the oci archive?

@renner0e renner0e Aug 14, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no, I would have preferred it this way actually IF IT WORKED, try what happens if you use ~/.local/share/containers/storage in any capacity

@TheMDev TheMDev Aug 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are actually able to specify a driver to make container storage work. See MDev-Linux@ecf2b3b

@renner0e renner0e Aug 15, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

huh, really good to know that you can actually make this work, was this documented somewhere?

@TheMDev TheMDev Aug 15, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/containers/image/blob/main/docs/containers-transports.5.md
Would you like me to open a PR for that?

@renner0e renner0e Aug 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/containers/image/blob/main/docs/containers-transports.5.md Would you like me to open a PR for that?

If it faster then I think it might me worth looking at, it doesn't matter super much anyway, although we would be losing out on the potential of pushing the oci archive as a workflow artifact (without additional steps)

@TheMDev TheMDev Aug 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm thinking it may be better to do it in a later step, because it seems wastefull to compress the image into an archive and then decompress it back to container storage just to push it to the registry. CHUNKED_IMAGE="$(podman pull oci-archive:"${RPM_OSTREE_OUTPUT_DIR}/${target_image}.oci")"
Ill open a PR here shortly.

-v "${RPM_OSTREE_OUTPUT_DIR}:/run/out:Z" \
--entrypoint /usr/bin/rpm-ostree \
"${RPM_OSTREE_CHUNKER_IMAGE}" \
compose build-chunked-oci \
--max-layers 127 \
--format-version=2 \
--bootc \
--from "localhost/${target_image}:${tag}" \
--output containers-storage:"localhost/${target_image}:${tag}"
--rootfs /rpm-ostree \
--output oci-archive:/run/out/"${target_image}.oci"

@renner0e renner0e Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with the oci-archive I get this now sometimes when running it locally and yeah it definitely takes longer than oci-dir

Copying config 8aebf9f31a done   |
Writing manifest to image destination
+ CHUNKED_IMAGE=8aebf9f31ac8f7ebc95270507de2edf6ed1fb44ffbde7e2c4a5dc656725e2fb2
+ podman tag 8aebf9f31ac8f7ebc95270507de2edf6ed1fb44ffbde7e2c4a5dc656725e2fb2 image-template:latest
+ rm -rf ./image-template_rpm-ostree_OvEZzt
error: interrupted by SIGINT


CHUNKED_IMAGE="$(podman pull oci-archive:"${RPM_OSTREE_OUTPUT_DIR}/${target_image}.oci")"
podman tag "${CHUNKED_IMAGE}" "${target_image}:${tag}"

# Generate Default Tag
[group('Utility')]
Expand Down