Composing a customized RHEL system image

Procedure

1. Install RHEL image builder and other necessary packages:

   # dnf install osbuild-composer composer-cli cockpit-composer

   Copy to Clipboard Toggle word wrap
   • osbuild-composer - A service to build customized RHEL operating system images.
   • composer-cli- This package enables access to the CLI interface.
   • cockpit-composer - This package enables access to the Web UI interface. The web console is installed as a dependency of the cockpit-composer package.

2. Enable and start RHEL image builder socket:

   # systemctl enable --now osbuild-composer.socket

   Copy to Clipboard Toggle word wrap

3. If you want to use RHEL image builder in the web console, enable and start it.

   # systemctl enable --now cockpit.socket

   Copy to Clipboard Toggle word wrap

   The osbuild-composer and cockpit services start automatically on first access.

4. Load the shell configuration script so that the autocomplete feature for the composer-cli command starts working immediately without logging out and in:

   $ source /etc/bash_completion.d/composer-cli

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a repository source file, such as /root/repo.toml. For example:

   id = "k8s"
   name = "Kubernetes"
   type = "yum-baseurl"
   url = "https://server.example.com/repos/company_internal_packages/"
   check_gpg = false
   check_ssl = false
   system = false

   Copy to Clipboard Toggle word wrap

   The type field accepts the following valid values: yum-baseurl, yum-mirrorlist, and yum-metalink.

2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

   Copy to Clipboard Toggle word wrap

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

   Copy to Clipboard Toggle word wrap

2. Check the new source content:

   $ composer-cli sources info <source_id>

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a repository source file, such as /root/repo.toml. For example, to specify the distribution:

   check_gpg = true
   check_ssl = true
   distros = ["rhel-9"]
   id = "rh9-local"
   name = "packages for RHEL"
   system = false
   type = "yum-baseurl"
   url = "https://local/repos/rhel9/projectrepo/"

   Copy to Clipboard Toggle word wrap
2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

   Copy to Clipboard Toggle word wrap

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

   Copy to Clipboard Toggle word wrap

2. Check the new source content:

   $ composer-cli sources info <source_id>

   Copy to Clipboard Toggle word wrap

Procedure

1. Access the folder where you want to create a repository:

   $ cd repo/

   Copy to Clipboard Toggle word wrap

2. Run the createrepo_c to create a repository from RPM packages:

   $ createrepo_c .

   Copy to Clipboard Toggle word wrap

3. Access the directory where the repodata is:

   $ cd repodata/

   Copy to Clipboard Toggle word wrap

4. Sign your repomd.xml file:

   $ gpg -u <_gpg-key-email_> --yes --detach-sign --armor /srv/repo/example/repomd.xml

   Copy to Clipboard Toggle word wrap

5. To enable GPG signature checks in the repository:

   1. Set check_repogpg = true in the repository source.

   2. Enter the gpgkey that you want to do the check. If your key is available over https, set the gpgkeys field with the key URL for the key. You can add as many URL keys as you need.

      The following is an example:

      check_gpg = true
      check_ssl = true
      id = "signed local packages"
      name = "repository_name"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      check_repogpg = true
      gpgkeys=["https://local/keys/repokey.pub"]

      Copy to Clipboard Toggle word wrap

      As an alternative, add the GPG key directly in the gpgkeys field, for example:

      check_gpg = true
      check_ssl = true
      check_repogpg
      id = "custom-local"
      name = "signed local packages"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      gpgkeys=["https://remote/keys/other-repokey.pub",
      '''-----BEGIN PGP PUBLIC KEY BLOCK-----
      …​
      -----END PGP PUBLIC KEY BLOCK-----''']

      Copy to Clipboard Toggle word wrap

      • If the test does not find the signature, the GPG tool shows an error similar to the following one:

        $ GPG verification is enabled, but GPG signature is not available.
        This may be an error or the repository does not support GPG verification:
        Status code: 404 for http://repo-server/rhel/repodata/repomd.xml.asc (IP: 192.168.1.3)

        Copy to Clipboard Toggle word wrap

      • If the signature is invalid, the GPG tool shows an error similar to the following one:

        repomd.xml GPG signature verification error: Bad GPG signature

        Copy to Clipboard Toggle word wrap

Procedure

1. Create the /etc/osbuild-composer/repositories/ directory to store your repository overrides:

   $ sudo mkdir -p /etc/osbuild-composer/repositories

   Copy to Clipboard Toggle word wrap

2. Create a JSON file, using a name corresponding to your RHEL version. Alternatively, you can copy the file for your distribution from /usr/share/osbuild-composer/ and modify its content.

   For RHEL 9.3, use /etc/osbuild-composer/repositories/rhel-93.json.

3. Add the following structure to your JSON file. Specify only one of the following attributes, in the string format:

   • baseurl - The base URL of the repository.
   • metalink - The URL of a metalink file that contains a list of valid mirror repositories.

   • mirrorlist - The URL of a mirrorlist file that contains a list of valid mirror repositories. The remaining fields, such as gpgkey, and metadata_expire, are optional.

     For example:

     {
          "x86_64": [
             {
                 "name": "baseos",
                 "baseurl": "http://mirror.example.com/composes/released/RHEL-9/9.0/BaseOS/x86_64/os/",
                 "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
                 "check_gpg": true
             }
         ]
     }

     Copy to Clipboard Toggle word wrap

     Alternatively, you can copy the JSON file for your distribution, by replacing rhel-version.json with your RHEL version, for example: rhel-9.json.

     $  cp /usr/share/osbuild-composer/repositories/rhel-version.json /etc/osbuild-composer/repositories/

     Copy to Clipboard Toggle word wrap

4. Optional: Verify the JSON file:

   $ json_verify < /etc/osbuild-composer/repositories/rhel-version.json

   Copy to Clipboard Toggle word wrap

5. Edit the baseurl paths in the rhel-9.json file and save it. For example:

   $ /etc/osbuild-composer/repositories/rhel-version.json

   Copy to Clipboard Toggle word wrap

6. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Get the baseurl from the /etc/yum.repos.d/redhat.repo file:

   # cat /etc/yum.repos.d/redhat.repo
   [AppStream]
   name = AppStream mirror example
   baseurl = https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/
   enabled = 1
   gpgcheck = 0
   sslverify = 1
   sslcacert = /etc/pki/ca1/ca.crt
   sslclientkey = /etc/pki/ca1/client.key
   sslclientcert = /etc/pki/ca1/client.crt
   metadata_expire = 86400
   enabled_metadata = 0

   Copy to Clipboard Toggle word wrap

2. Configure the repository override to use the same baseurl and set rhsm to true:

   {
       "x86_64": [
           {
               "name": "AppStream mirror example",
               "baseurl": "https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/",
               "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
               "check_gpg": true,
               "rhsm": true
           }
       ]
   }

   Copy to Clipboard Toggle word wrap

3. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Find the repository URL from your currently configured repositories:

   $ sudo yum -v repolist "-baseos-rpms" | grep -i repo-baseurl
     Repo-baseurl :

   Copy to Clipboard Toggle word wrap

   The following output is an example:

   https://satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV/content/dist/rhel9/9/x86_64/baseos/os

   Copy to Clipboard Toggle word wrap

2. Modify the hard-coded repositories to a Satellite Server.

   1. Create a repository directory with the 0755 permission:

      $ sudo mkdir -pvm 0755 /etc/osbuild-composer/repositories

      Copy to Clipboard Toggle word wrap

   2. Copy the content from /usr/share/osbuild-composer/repositories/*.json to the directory that you created:

      $ sudo cp /usr/share/osbuild-composer/repositories/*.json /etc/osbuild-composer/repositories/

      Copy to Clipboard Toggle word wrap

   3. Update the Satellite URL and the file contents through the /content/dist/* line:

      $ sudo sed -i -e 's|cdn.redhat.com|satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV|' /etc/osbuild-composer/repositories/*.json

      Copy to Clipboard Toggle word wrap

   4. Verify that the configuration was correctly replaced:

      $ sudo vi /etc/osbuild-composer/repositories/rhel-9.json

      Copy to Clipboard Toggle word wrap

3. Restart the services:

   $ sudo systemctl restart osbuild-worker@1.service osbuild-composer.service

   Copy to Clipboard Toggle word wrap
4. Override the required system repository in Red Hat image builder configuration and use the URL of your Satellite repository as a baseurl. See Overriding a system repository.

Procedure

1. In the Satellite web UI, navigate to Content > Products, select your Product and click the repository you want to use.
2. Search for the secured URL (HTTPS) in the Published field and copy it.
3. Use the URL that you copied as a baseurl for the Red Hat image builder repository. See Adding custom third-party repositories to RHEL image builder.

1. Create a blueprint or export (save) an existing blueprint definition to a plain text file
2. Edit this file in a text editor
3. Import the blueprint text file back into image builder
4. Run a compose to build an image from the blueprint
5. Export the image file to download it

Procedure

1. Create a plain text file with the following contents:

   name = "BLUEPRINT-NAME"
   description = "LONG FORM DESCRIPTION TEXT"
   version = "0.0.1"
   modules = []
   groups = []

   Copy to Clipboard Toggle word wrap

   Replace BLUEPRINT-NAME and LONG FORM DESCRIPTION TEXT with a name and description for your blueprint.

   Replace 0.0.1 with a version number according to the Semantic Versioning scheme.

2. For every package that you want to be included in the blueprint, add the following lines to the file:

   [[packages]]
   name = "package-name"
   version = "package-version"

   Copy to Clipboard Toggle word wrap

   Replace package-name with the name of the package, such as httpd, gdb-doc, or coreutils.

   Optionally, replace package-version with the version to use. This field supports dnf version specifications:

   • For a specific version, use the exact version number such as 8.7.0.
   • For the latest available version, use the asterisk *.
   • For the latest minor version, use formats such as 8.*.

3. Customize your blueprints to suit your needs. For example, disable Simultaneous Multi Threading (SMT), add the following lines to the blueprint file:

   [customizations.kernel]
   append = "nosmt=force"

   Copy to Clipboard Toggle word wrap

   For additional customizations available, see Supported Image Customizations.

   Note that [] and [[]] are different data structures expressed in TOML.

   • The [customizations.kernel] header represents a single table that is defined by a collection of keys and their respective value pairs, for example: append = "nosmt=force".
   • The [[packages]] header represents an array of tables. The first instance defines the array and its first table element, for example, name = "package-name" and version = "package-version", and each subsequent instance creates and defines a new table element in that array, in the order that you defined them.
4. Save the file, for example, as BLUEPRINT-NAME.toml and close the text editor.

5. Optional: Check if all settings from the Blueprint TOML file have been correctly parsed. Save the blueprint and compare the saved output with the input file:

   # composer-cli blueprints save BLUEPRINT-NAME.toml

   Copy to Clipboard Toggle word wrap
   1. Compare the BLUEPRINT-NAME.toml saved file with the input file.

6. Push the blueprint:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Copy to Clipboard Toggle word wrap

   Replace BLUEPRINT-NAME with the value you used in previous steps.

   Note

   To create images using composer-cli as non-root, add your user to the weldr or root groups.

   # usermod -a -G weldr user
   $ newgrp weldr

   Copy to Clipboard Toggle word wrap

Procedure

1. List the existing blueprints:

   # composer-cli blueprints list

   Copy to Clipboard Toggle word wrap

2. Save the blueprint to a local text file:

   # composer-cli blueprints save BLUEPRINT-NAME

   Copy to Clipboard Toggle word wrap
3. Edit the BLUEPRINT-NAME.toml file with a text editor and make your changes.

4. Before finishing the edits, verify that the file is a valid blueprint:

   1. Remove the following line from the blueprint, if present:

      packages = []

      Copy to Clipboard Toggle word wrap
   2. Increase the version number, for example, from 0.0.1 to 0.1.0. Remember that RHEL image builder blueprint versions must use the Semantic Versioning scheme. Note also that if you do not change the version, the patch version component increases automatically.
5. Save the file and close the text editor.

6. Push the blueprint back into RHEL image builder:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Copy to Clipboard Toggle word wrap
   Note

   To import the blueprint back into RHEL image builder, supply the file name including the .toml extension, while in other commands use only the blueprint name.

Verification

1. To verify that the contents uploaded to RHEL image builder match your edits, list the contents of blueprint:

   # composer-cli blueprints show BLUEPRINT-NAME

   Copy to Clipboard Toggle word wrap

2. Check whether the components and versions listed in the blueprint and their dependencies are valid:

   # composer-cli blueprints depsolve BLUEPRINT-NAME

   Copy to Clipboard Toggle word wrap

Procedure

1. Optional: List the image formats you can create:

   # composer-cli compose types

   Copy to Clipboard Toggle word wrap

2. Start the compose:

   # composer-cli compose start BLUEPRINT-NAME IMAGE-TYPE

   Copy to Clipboard Toggle word wrap

   Replace BLUEPRINT-NAME with the name of the blueprint, and IMAGE-TYPE with the type of the image. For the available values, see the output of the composer-cli compose types command.

   The compose process starts in the background and shows the composer Universally Unique Identifier (UUID).

3. The image creation can take up to ten minutes to complete.

   To check the status of the compose:

   # composer-cli compose status

   Copy to Clipboard Toggle word wrap

   A finished compose shows the FINISHED status value. To identify your compose in the list, use its UUID.

4. After the compose process is finished, download the resulting image file:

   # composer-cli compose image UUID

   Copy to Clipboard Toggle word wrap

   Replace UUID with the UUID value shown in the previous steps.

Procedure

1. On the host, open https://<_localhost_>:9090/ in a web browser.
2. Log in to the web console as the root user.

3. To display the RHEL image builder controls, click the Image Builder button, in the upper-left corner of the window.

   The RHEL image builder dashboard opens, listing existing blueprints, if any.

Procedure

1. Click Create Blueprint in the upper-right corner.

   A dialog wizard with fields for the blueprint name and description opens.

2. On the Details page:

   1. Enter the name of the blueprint and, optionally, its description.
   2. Click Next.

3. Optional: In the Packages page:

   1. On the Available packages search, enter the package name
   2. Click the > button to move it to the Chosen packages field.
   3. Repeat the previous steps to search and include as many packages as you want.

   4. Click Next.

      Note

      These customizations are all optional unless otherwise specified.

4. On the Kernel page, enter a kernel name and the command-line arguments.

5. On the File system page, you can select Use automatic partitioning or Manually configure partitions for your image file system. For manually configuring the partitions, complete the following steps:

   1. Click the Manually configure partitions button.

      The Configure partitions section opens, showing the configuration based on Red Hat standards and security guides.

   2. From the dropdown menu, provide details to configure the partitions:

      1. For the Mount point field, select one of the following mount point type options:

         • / - the root mount point
         • /app
         • /boot
         • /data
         • /home
         • /opt
         • /srv
         • /usr
         • /usr/local

         • /var

           You can also add an additional path to the Mount point, such as /tmp. For example: /var as a prefix and /tmp as an additional path results in /var/tmp.

           Note

           Depending on the Mount point type you choose, the file system type changes to xfs.

      2. For the Minimum size partition field of the file system, enter the needed minimum partition size. In the Minimum size dropdown menu, you can use common size units such as GiB, MiB, or KiB. The default unit is GiB.

         Note

         Minimum size means that RHEL image builder can still increase the partition sizes, in case they are too small to create a working image.

   3. To add more partitions, click the Add partition button. If you see the following error message: Duplicate partitions: Only one partition at each mount point can be created., you can:

      1. Click the Remove button to remove the duplicated partition.
      2. Choose a new mount point for the partition you want to create.
   4. After you finish the partitioning configuration, click Next.

6. On the Services page, you can enable or disable services:

   1. Enter the service names you want to enable or disable, separating them by a comma, by space, or by pressing the Enter key. Click Next.
   2. Enter the Enabled services.
   3. Enter the Disabled services.

7. On the Firewall page, set up your firewall setting:

   1. Enter the Ports, and the firewall services you want to enable or disable.
   2. Click the Add zone button to manage your firewall rules for each zone independently. Click Next.

8. On the Users page, add a users by following the steps:

   1. Click Add user.
   2. Enter a Username, a Password, and a SSH key. You can also mark the user as a privileged user, by clicking the Server administrator checkbox. Click Next.

9. On the Groups page, add groups by completing the following steps:

   1. Click the Add groups button:

      1. Enter a Group name and a Group ID. You can add more groups. Click Next.

10. On the SSH keys page, add a key:

    1. Click the Add key button.

       1. Enter the SSH key.
       2. Enter a User. Click Next.

11. On the Timezone page, set your time zone settings:

    1. On the Timezone field, enter the time zone you want to add to your system image. For example, add the following time zone format: "US/Eastern".

       If you do not set a time zone, the system uses Universal Time, Coordinated (UTC) as default.

    2. Enter the NTP servers. Click Next.

12. On the Locale page, complete the following steps:

    1. On the Keyboard search field, enter the package name you want to add to your system image. For example: ["en_US.UTF-8"].
    2. On the Languages search field, enter the package name you want to add to your system image. For example: "us". Click Next.

13. On the Others page, complete the following steps:

    1. On the Hostname field, enter the hostname you want to add to your system image. If you do not add a hostname, the operating system determines the hostname.
    2. Mandatory only for the Simplifier Installer image: On the Installation Devices field, enter a valid node for your system image. For example: dev/sda1. Click Next.

14. Mandatory only when building images for FDO: On the FIDO device onboarding page, complete the following steps:

    1. On the Manufacturing server URL field, enter the following information:

       1. On the DIUN public key insecure field, enter the insecure public key.
       2. On the DIUN public key hash field, enter the public key hash.
       3. On the DIUN public key root certs field, enter the public key root certs. Click Next.

15. On the OpenSCAP page, complete the following steps:

    1. On the Datastream field, enter the datastream remediation instructions you want to add to your system image.
    2. On the Profile ID field, enter the profile_id security profile you want to add to your system image. Click Next.

16. Mandatory only when building images that use Ignition: On the Ignition page, complete the following steps:

    1. On the Firstboot URL field, enter the package name you want to add to your system image.
    2. On the Embedded Data field, drag or upload your file. Click Next.
17. . On the Review page, review the details about the blueprint. Click Create.

Procedure

1. On the RHEL image builder dashboard, click Import blueprint. The Import blueprint wizard opens.
2. From the Upload field, either drag or upload an existing blueprint. This blueprint can be in either TOML or JSON format.
3. Click Import. The dashboard lists the blueprint you imported.

Procedure

1. On the image builder dashboard, select the blueprint you want to export.
2. Click Export blueprint. The Export blueprint wizard opens.

3. Click the Export button to download the blueprint as a file or click the Copy button to copy the blueprint to the clipboard.

   1. Optional: Click the Copy button to copy the blueprint.

Procedure

1. In the RHEL image builder dashboard, click the blueprint tab.
2. On the blueprint table, find the blueprint you want to build an image.
3. On the right side of the chosen blueprint, click Create Image. The Create image dialog wizard opens.

4. On the Image output page, complete the following steps:

   1. From the Select a blueprint list, select the image type you want.

   2. From the Image output type list, select the image output type you want.

      Depending on the image type you select, you need to add further details.

5. Click Next.

6. On the Review page, review the details about the image creation and click Create image.

   The image build starts and takes up to 20 minutes to complete.

Procedure

1. Create the ISO image:

   # composer-cli compose start BLUEPRINT-NAME image-installer

   Copy to Clipboard Toggle word wrap
   • BLUEPRINT-NAME with name of the blueprint you created

   • image-installer is the image type

     The compose process starts in the background and the UUID of the compose is shown. Wait until the compose is finished. This might take several minutes.

2. Check the status of the compose:

   # composer-cli compose status

   Copy to Clipboard Toggle word wrap

   A finished compose shows a status value of FINISHED.

3. Identify the compose in the list by its UUID.

   # composer-cli compose list

   Copy to Clipboard Toggle word wrap

4. After the compose is finished, download the created image file to the current directory:

   # composer-cli compose image UUID

   Copy to Clipboard Toggle word wrap

   Replace UUID with the UUID value obtained in the previous steps.

   RHEL image builder builds a .iso file that contains a .tar file. The .tar file is the image that will be installed for the Operating system. The . iso is set up to boot Anaconda and install the .tar file to set up the system.

1. Locate the .iso image you downloaded.

2. Mount the ISO.

   $ mount -o ro path_to_ISO /mnt

   Copy to Clipboard Toggle word wrap

   You can find the .tar file at the /mnt/liveimg.tar.gz directory.

3. List the .tar file content:

   $ tar ztvf /mnt/liveimg.tar.gz

   Copy to Clipboard Toggle word wrap

Procedure

1. On the RHEL image builder dashboard, locate the blueprint that you want to use to build your image. Optionally, enter the blueprint name or a part of it into the search box at upper left, and click Enter.

2. On the right side of the blueprint, click the corresponding Create Image button.

   The Create image dialog wizard opens.

3. On the Create image dialog wizard:

   1. In the Image Type list, select "RHEL Installer (.iso)".
   2. Click Next.

   3. On the Review tab, click Create.

      RHEL image builder adds the compose of a RHEL ISO image to the queue.

      After the process is complete, you can see the image build complete status. RHEL image builder creates the ISO image.

1. Click Download to save the "RHEL Installer (.iso)" image to your system.
2. Navigate to the folder where you downloaded the "RHEL Installer (.iso)" image.
3. Locate the .tar image you downloaded.

4. Extract the "RHEL Installer (.iso)" image content.

   $ tar -xf content.tar

   Copy to Clipboard Toggle word wrap

Procedure

1. Write the bootable ISO image directly to the USB drive using the dd tool. For example:

   dd if=installer.iso of=/dev/sdX

   Copy to Clipboard Toggle word wrap

   Where installer.iso is the ISO image file name and /dev/sdX is your USB flash drive device path.

2. Insert the flash drive into a USB port of the computer you want to boot.

3. Boot the ISO image from the USB flash drive.

   When the installation environment starts, you might need to complete the installation manually, similarly to the default Red Hat Enterprise Linux installation.

Procedure

1. Create a hardening blueprint in the TOML format, using OpenSCAP tool and scap-security-guide content, and modify it if necessary:

   # oscap xccdf generate fix --profile=<profileID> --fix-type=<blueprint> /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml > cis.toml

   Copy to Clipboard Toggle word wrap

   Replace <profileID> with the profile ID with which the system should comply, for example, cis.

2. Push the blueprint to osbuild-composer by using the composer-cli tool:

   # composer-cli blueprints push <blueprint_name>.toml

   Copy to Clipboard Toggle word wrap

3. Start the build of hardened image:

   # composer-cli compose start <blueprint_name> <image_type>

   Copy to Clipboard Toggle word wrap

   Replace <image_type> with any image type, for example, qcow2.

   After the image build is ready, you can use your pre-hardened image on your deployments. See Creating a virtual machine.

Procedure

1. Create a hardening blueprint in the TOML format from a selected profile:

   # oscap xccdf generate fix --profile=<profileID> --fix-type=blueprint /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml > <profileID>-tailored.toml

   Copy to Clipboard Toggle word wrap

2. Append the tailoring file to the blueprint. The tailoring customization affects only the default state of the selected or unselected rules in the profile in which the customization is based on. It selects or unselects a rule in the profile, but does not change the state of other rules.

   # Blueprint for CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
   # ...
   [customizations.openscap.tailoring]
   selected = [ "xccdf_org.ssgproject.content_bind_crypto_policy" ]
   unselected = [ "grub2_password" ]

   Copy to Clipboard Toggle word wrap

3. Push the blueprint to osbuild-composer by using the composer-cli tool:

   # composer-cli blueprints push <blueprintProfileID>-tailored.toml

   Copy to Clipboard Toggle word wrap

4. Start the build of hardened image:

   # composer-cli compose start <blueprintProfileID> <image_type>

   Copy to Clipboard Toggle word wrap

   Replace <image_type> with any image type, for example, qcow2.

   After the image build is ready, use your pre-hardened image on your deployments.