UKI Cleanup by Johan-Liebert1 · Pull Request #2200 · bootc-dev/bootc

Johan-Liebert1 · 2026-05-15T07:22:34Z

ukify: Allow passing custom kernel, initramfs

While building a sealed UKI image we'd want to remove the original
kernel + initramfs from the final image and have only the final UKI
present. This was not possible before as bootc container ukify
expected kernel + initramfs to be present in usr/lib/modules of
container root

Fixes: #2185

dockerfile/uki: Rework to remove kernel + initrd

Now that we can pass kernel and initrd paths to bootc ukify, rework
our UKI Dockerfile to remove kernel + initrd from the final layer
and only keep the UKI

This still will not remove the kernel + initrd from the tarball but
have whiteout instead

See #2027 (comment)

test/integration: Test vmlinuz non-existence with UKI

vmlinuz and intrd should not be present in UKI images; add test for the
same

gemini-code-assist

Code Review

This pull request refactors the UKI (Unified Kernel Image) build process to support passing explicit kernel and initramfs paths via CLI arguments, reducing reliance on auto-discovery within the rootfs. Key changes include updating the seal-uki and finalize-uki scripts to use named arguments, modifying Dockerfile stages to extract and clean up kernel components, and extending the Rust library and CLI to handle the new parameters. Review feedback identified a potential path resolution bug in the Rust file existence checks, a filename mismatch in the upgrade test Dockerfile, and suggested improvements for error handling and validation in the seal-uki script.

cgwalters · 2026-05-19T13:27:49Z

+        kver=$(bootc container inspect --rootfs /run/base-penultimate-src --json | jq -r '.kernel.version')
+
+        rm -v "/usr/lib/modules/$kver/vmlinuz"
+        rm -v "/usr/lib/modules/$kver/initramfs.img"
+    fi


Since this one would end up being closer to user-facing, I would prefer to streamline this more.

I think what would work best is to have our "base" build process be a stage that generates a single intermediate image with /rootfs and /kernel or so. This could be part of bootc-base-imagectl, or we could have it be part of something more like bootc container split-root-and-uki?

sgtm. By the "base" build process, are you referring to the Dockerfile (in bootc) or is it about something else?

The pattern we apply to this should generalize to https://github.com/cgwalters/rhel-bootc-examples/tree/sealed/sealing as well etc.

Again - I may be missing something that's not possible - let me know if you want me to try - but I would really like to not have these rm -v type invocations be a required thing to use this feature.

I think my above comment would work.

or we could have it be part of something more like bootc container split-root-and-uki?

If I understand this correctly, this would simply call /usr/libexec/bootc-base-imagectl build-rootfs --manifest=standard /target-rootfs, then move /target-rootfs/usr/lib/modules/$kver/{vmlinuz,initramfs.img} to /kernel/$kver?

This get a bit complicated as the building of the rootfs and splitting the kernel needs to happen as the very first step, but we generate our custom initramfs much later in the build, just before the seal-uki step. We could chroot into the new root (created by bootc-base-imagectl) and install our rpms and other packages.

This get a bit complicated as the building of the rootfs and splitting the kernel needs to happen as the very first step, but we generate our custom initramfs much later in the build,

Yes...but we can and should rework the build here so the initramfs is only generated once. I'll look at a prep PR for that.

Now we generate the target-rootfs with --no-initramfs param, then install our dependencies by chrooting and then generate the initramfs. After that we split the rootfs and kernel

travier · 2026-05-20T07:48:38Z

I think we should have the kernel and initrd as required arguments and thus only support the case where they are not in the rootfs anymore as I don't see a use case where someone would want a sealed image with both a UKI and split out kernel and initrd.

Edit: That would break the current bootc container ukify signature but I don't think we've declared it stable yet?

cgwalters · 2026-05-20T21:55:58Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

travier · 2026-05-21T14:21:29Z

Failures are transient & volatile related. Maybe from #2201?

Johan-Liebert1 · 2026-05-28T10:30:54Z

Hmm. I kind of lean towards not breaking it at least right away, it seems really easy to continue to support what we have now too. We could mark it deprecated though.

Don't know if clap has a way to do this, if it does I couldn't find it. We just print our custom warning if --kernel and --initramfs are not passed in

cgwalters · 2026-06-08T13:31:30Z

How about splitting out the "prep" changes from this PR ?

Johan-Liebert1 · 2026-06-09T03:19:40Z

How about splitting out the "prep" changes from this PR ?

Opened #2240

Now that we can pass kernel and initrd paths to `bootc ukify`, rework our UKI Dockerfile to remove kernel + initrd from the final layer and only keep the UKI This still will not *remove* the kernel + initrd from the tarball but have whiteout instead See bootc-dev#2027 (comment) Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 · 2026-06-16T11:08:04Z

Converting to draft. Still needs a bit more work

Since we do not want kernel + initrd in the final UKI dockerfile, we now build the initrd inside the `target-rootfs` generated by `bootc-base-imagectl` by chrooting into it and installing the required packages. After that's done we split the rootfs and vmlinuz + initrd into /target-rootfs and /kernel/$kver respectively Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

To avoid complexity with setting up networking inside `/target-rootfs` for when we chroot and install stuff, now we make sure to only have operations that do not require networking inside the chrooted env Separate out `downgrade-kernel.sh` script and accept a rootfs parameter so we can run this from outside target-rootfs but still operate on the target-rootfs Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 requested a review from cgwalters May 15, 2026 07:22

Johan-Liebert1 added the ci/merge Run full CI suite (all OSes) — equivalent to merge queue label May 15, 2026

gemini-code-assist Bot reviewed May 15, 2026

View reviewed changes

Comment thread crates/lib/src/ukify.rs Outdated

Comment thread tmt/tests/Dockerfile.upgrade Outdated

Comment thread contrib/packaging/seal-uki Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from cb42d78 to 8a3ed64 Compare May 15, 2026 08:09

github-actions Bot added the area/documentation Updates to the documentation label May 15, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch 7 times, most recently from 66dc0e3 to 3a9dc2b Compare May 18, 2026 10:09

cgwalters reviewed May 18, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Comment thread tmt/plans/integration.fmf

Johan-Liebert1 force-pushed the uki-cleanup branch from 3a9dc2b to 8e581d4 Compare May 19, 2026 09:35

Johan-Liebert1 requested a review from cgwalters May 19, 2026 10:13

Johan-Liebert1 force-pushed the uki-cleanup branch from 8e581d4 to 503b07a Compare May 19, 2026 13:00

cgwalters reviewed May 19, 2026

View reviewed changes

travier reviewed May 21, 2026

View reviewed changes

Comment thread tmt/tests/booted/test-install-to-filesystem-var-mount.sh Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from 503b07a to 8a5c7ae Compare May 21, 2026 10:10

Johan-Liebert1 force-pushed the uki-cleanup branch from 8a5c7ae to cc8a2d8 Compare May 28, 2026 06:48

github-actions Bot added area/install Issues related to `bootc install` area/ostree Issues related to ostree labels May 28, 2026

Johan-Liebert1 force-pushed the uki-cleanup branch from f2c3424 to 667a0fd Compare May 28, 2026 10:30

Johan-Liebert1 force-pushed the uki-cleanup branch 2 times, most recently from 4d6bed6 to 20e2fed Compare May 28, 2026 13:11

cgwalters requested changes May 28, 2026

View reviewed changes

Comment thread crates/lib/src/cli.rs Outdated

Comment thread crates/lib/src/cli.rs Outdated

Johan-Liebert1 force-pushed the uki-cleanup branch from b9b57cb to 45f9bd2 Compare June 2, 2026 09:12

cgwalters previously approved these changes Jun 8, 2026

View reviewed changes

Johan-Liebert1 dismissed cgwalters’s stale review via 7a9ee13 June 16, 2026 05:02

Johan-Liebert1 force-pushed the uki-cleanup branch from 45f9bd2 to 7a9ee13 Compare June 16, 2026 05:02

Johan-Liebert1 requested a review from cgwalters June 16, 2026 05:06

Johan-Liebert1 force-pushed the uki-cleanup branch 5 times, most recently from 3e9a91e to 135915e Compare June 16, 2026 08:27

Johan-Liebert1 mentioned this pull request Jun 16, 2026

Handle UKI/Type1 boot entries properly #2144

Open

Johan-Liebert1 added 4 commits June 16, 2026 15:23

test/integration: Test vmlinuz non-existence with UKI

6ab9888

vmlinuz and intrd should not be present in UKI images; add test for the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cli: Add cmd bootc internals uki-extract

a5a2eb7

So we can just use bootc to extract the `.linux` and `.initrd` sections from the UKI and not have to use objcopy Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cli: Add cmd bootc container split-kernel-and-rootfs

e8d7a36

This command is equivalent to `mv /target-root/usr/lib/modules/$kver/{vmlinuz,initramfs.img} /out/$kver` We could just use `mv`, but having an actual bootc cmd is cleaner Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch 4 times, most recently from 866acdc to c41bdc8 Compare June 16, 2026 11:04

Johan-Liebert1 marked this pull request as draft June 16, 2026 11:07

Johan-Liebert1 force-pushed the uki-cleanup branch from c41bdc8 to 7710290 Compare June 16, 2026 12:03

Johan-Liebert1 added 2 commits June 17, 2026 15:29

justfile: Build packages as deps for stage fetch

3fe21d8

Now since we need to build our initramfs before the `fetch` build stage, we need packages built first as we need `bootc` and `bootc-initramfs-setup` binaries Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Johan-Liebert1 force-pushed the uki-cleanup branch 2 times, most recently from 045567b to f5c48ad Compare June 17, 2026 12:48

Johan-Liebert1 force-pushed the uki-cleanup branch from f5c48ad to e2b3c1d Compare June 17, 2026 13:39

Conversation

Johan-Liebert1 commented May 15, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

travier commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cgwalters commented May 20, 2026

Uh oh!

Uh oh!

travier commented May 21, 2026

Uh oh!

Johan-Liebert1 commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cgwalters commented Jun 8, 2026

Uh oh!

Johan-Liebert1 commented Jun 9, 2026

Uh oh!

Johan-Liebert1 commented Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

travier commented May 20, 2026 •

edited

Loading

Johan-Liebert1 commented May 28, 2026 •

edited

Loading