UKI Cleanup by Johan-Liebert1 · Pull Request #2200 · bootc-dev/bootc

Johan-Liebert1 · 2026-05-15T07:22:34Z

ukify: Allow passing custom kernel, initramfs

While building a sealed UKI image we'd want to remove the original
kernel + initramfs from the final image and have only the final UKI
present. This was not possible before as bootc container ukify
expected kernel + initramfs to be present in usr/lib/modules of
container root

Fixes: #2185

dockerfile/uki: Rework to remove kernel + initrd

Now that we can pass kernel and initrd paths to bootc ukify, rework
our UKI Dockerfile to remove kernel + initrd from the final layer
and only keep the UKI

This still will not remove the kernel + initrd from the tarball but
have whiteout instead

See #2027 (comment)

test/integration: Test vmlinuz non-existence with UKI

vmlinuz and intrd should not be present in UKI images; add test for the
same

gemini-code-assist

Code Review

This pull request refactors the UKI (Unified Kernel Image) build process to support passing explicit kernel and initramfs paths via CLI arguments, reducing reliance on auto-discovery within the rootfs. Key changes include updating the seal-uki and finalize-uki scripts to use named arguments, modifying Dockerfile stages to extract and clean up kernel components, and extending the Rust library and CLI to handle the new parameters. Review feedback identified a potential path resolution bug in the Rust file existence checks, a filename mismatch in the upgrade test Dockerfile, and suggested improvements for error handling and validation in the seal-uki script.

travier · 2026-05-20T07:48:38Z

I think we should have the kernel and initrd as required arguments and thus only support the case where they are not in the rootfs anymore as I don't see a use case where someone would want a sealed image with both a UKI and split out kernel and initrd.

Edit: That would break the current bootc container ukify signature but I don't think we've declared it stable yet?

cgwalters · 2026-05-20T21:55:58Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

travier · 2026-05-21T14:21:29Z

Failures are transient & volatile related. Maybe from #2201?

Johan-Liebert1 · 2026-05-28T10:30:54Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

Don't know if clap has a way to do this, if it does I couldn't find it. We just print our custom warning if --kernel and --initramfs are not passed in

Johan-Liebert1 · 2026-06-16T11:08:04Z

Converting to draft. Still needs a bit more work

Now that we can pass kernel and initrd paths to `bootc ukify`, rework our UKI Dockerfile to remove kernel + initrd from the final layer and only keep the UKI This still will not *remove* the kernel + initrd from the tarball but have whiteout instead See bootc-dev#2027 (comment) Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 · 2026-06-22T08:48:31Z

This one's also ready for review

cgwalters · 2026-06-22T12:34:14Z

+
+rootfs=${1:-/}
+
+# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.


This can probably be dropped

f44 still seems to ship with 7.0

cgwalters · 2026-06-22T21:51:15Z

+        umount /target-rootfs/etc/resolv.conf
+    }
+
+    # All network-fetching operations: package installs from distro repos, Copr, Koji.


On this topic also...since we're building the base image from scratch here, we can just use --install nowadays too instead.

We could, but we have a lot of conditional installs for uki/bls which makes it a bit messy

Since we do not want kernel + initrd in the final UKI dockerfile, we now build the initrd inside the `target-rootfs` generated by `bootc-base-imagectl`. Instead of rebuilding the initrd ourselves, now we add `/var/usr` directory to the target-rootfs with `--add-dir` cli option to bootc-base-imagectl. This directory contains our rpms and other configs required for building the initramfs After that's done we split the rootfs and vmlinuz + initrd into /target-rootfs and /kernel/$kver respectively Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 requested a review from cgwalters May 15, 2026 07:22

Johan-Liebert1 added the ci/merge Run full CI suite (all OSes) — equivalent to merge queue label May 15, 2026

gemini-code-assist Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/lib/src/ukify.rs Outdated

Comment thread tmt/tests/Dockerfile.upgrade Outdated

Comment thread contrib/packaging/seal-uki Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from cb42d78 to 8a3ed64 Compare May 15, 2026 08:09

github-actions Bot added the area/documentation Updates to the documentation label May 15, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch 7 times, most recently from 66dc0e3 to 3a9dc2b Compare May 18, 2026 10:09

cgwalters reviewed May 18, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Comment thread tmt/plans/integration.fmf

Johan-Liebert1 force-pushed the uki-cleanup branch from 3a9dc2b to 8e581d4 Compare May 19, 2026 09:35

Johan-Liebert1 requested a review from cgwalters May 19, 2026 10:13

Johan-Liebert1 force-pushed the uki-cleanup branch from 8e581d4 to 503b07a Compare May 19, 2026 13:00

cgwalters reviewed May 19, 2026

View reviewed changes

Comment thread crates/lib/src/bootc_composefs/status.rs Outdated

Comment thread crates/lib/src/bootc_composefs/status.rs Outdated

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh

Comment thread Dockerfile Outdated

travier reviewed May 21, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from 503b07a to 8a5c7ae Compare May 21, 2026 10:10

Johan-Liebert1 force-pushed the uki-cleanup branch from 8a5c7ae to cc8a2d8 Compare May 28, 2026 06:48

github-actions Bot added area/install Issues related to `bootc install` area/ostree Issues related to ostree labels May 28, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch from f2c3424 to 667a0fd Compare May 28, 2026 10:30

Johan-Liebert1 force-pushed the uki-cleanup branch 2 times, most recently from 4d6bed6 to 20e2fed Compare May 28, 2026 13:11

cgwalters requested changes May 28, 2026

View reviewed changes

Comment thread crates/lib/src/cli.rs Outdated

Comment thread crates/lib/src/cli.rs Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch 3 times, most recently from 3e9a91e to 135915e Compare June 16, 2026 08:27

Johan-Liebert1 mentioned this pull request Jun 16, 2026

Handle UKI/Type1 boot entries properly #2144

Open

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from 866acdc to c41bdc8 Compare June 16, 2026 11:04

Johan-Liebert1 marked this pull request as draft June 16, 2026 11:07

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from f5c48ad to e2b3c1d Compare June 17, 2026 13:39

Johan-Liebert1 added 4 commits June 22, 2026 11:55

test/integration: Test vmlinuz non-existence with UKI

2a3fd82

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cli: Add cmd bootc internals uki-extract

1608308

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cli: Add cmd bootc container split-kernel-and-rootfs

0bb5231

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch from e2b3c1d to 4df1993 Compare June 22, 2026 06:27

Johan-Liebert1 marked this pull request as ready for review June 22, 2026 08:48

bootc-bot Bot requested a review from henrywang June 22, 2026 08:48

cgwalters requested changes Jun 22, 2026

View reviewed changes

Johan-Liebert1 force-pushed the uki-cleanup branch 3 times, most recently from 1630c09 to d7e40d7 Compare June 23, 2026 09:58

Johan-Liebert1 added 2 commits June 23, 2026 16:05

justfile: Build packages as deps for stage fetch

3538344

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch from d7e40d7 to 3538344 Compare June 23, 2026 10:35

Johan-Liebert1 requested a review from cgwalters June 23, 2026 13:17


		rootfs=${1:-/}

		# Temporary: downgrade kernel to last 6.x when 7.0 or 7.1 is present.

Conversation

Johan-Liebert1 commented May 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

travier commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cgwalters commented May 20, 2026

Uh oh!

Uh oh!

travier commented May 21, 2026

Uh oh!

Johan-Liebert1 commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Johan-Liebert1 commented Jun 16, 2026

Uh oh!

Johan-Liebert1 commented Jun 22, 2026

Uh oh!

cgwalters Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cgwalters Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 Jun 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

travier commented May 20, 2026 •

edited

Loading

Johan-Liebert1 commented May 28, 2026 •

edited

Loading