Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 8. Using RHEL system roles to build and manage immutable systems (ostree)

Use Red Hat Enterprise Linux (RHEL) system roles to automate and manage RHEL for Edge (rpm-ostree) immutable systems. This integration provides a consistent management interface across different backend technologies, allowing you to use the same roles for both traditional and immutable environments.

For example, you can use the Podman system role to automate configuration and deploy production-ready container workloads. By using unified roles, you ensure environment consistency while reducing the complexity of managing ostree-based systems.

Important

This feature is incompatible with the nbde_client role.

Red Hat Enterprise Linux (RHEL) system roles support rpm-ostree systems by using a integrated functionality.

Because the /usr file system is read-only, roles verify pre-installed packages instead of installing them. A specialized interface ensures compatibility with rpm-ostree for seamless configuration management.

There are two separate phases for using RHEL system roles to manage RHEL image mode systems.

  1. Image build phase: Use RHEL image builder to build packages into an immutable image. During this phase, the packages are built into the image.
  2. Runtime phase: Using RHEL system roles to manage the configuration and services on the running image. You can apply tasks and processes that you use to provision your systems at run time, such as Ansible roles, at the build time of the image. Image mode for RHEL uses the ostree file system on image-based systems with support for system roles.

Each role provides a get_ostree_data.sh script to identify required packages and dependencies. This script facilitates integration into Red Hat Enterprise Linux (RHEL) image builder or other image builders.

Prerequisites

To install system role dependencies in a container build, complete the following steps.

Procedure

  1. The get_ostree_data.sh script is located in the .ostree/ sub-directory of each role. List the dependencies for a role: 

    $ /usr/share/ansible/collections/ansible_collections/redhat/rhel_system_roles/roles/<role_name>/.ostree/get_ostree_data.sh packages runtime <distro_version> <format>

    Get the list of packages needed for the SELinux system role, in the toml format that RHEL image builder accepts: 

    $ /usr/share/ansible/collections/ansible_collections/redhat/rhel_system_roles/roles/selinux/.ostree/get_ostree_data.sh packages runtime RedHat-<version> toml
  2. Add the list of packages to your image builder manifest or instructions. This differs depending on the image builder you are using.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top