SupportConsoleDevelopersStart a trialContact

Chapter 2. Migrating from rpm-ostree systems to bootc-based systems

Starting with RHEL 10.0, image mode for RHEL replaces RHEL image builder to create edge images. To create bootable container images for edge deployments, you must now use image mode.

Note

You can still use RHEL image builder on RHEL 9 to build RHEL for Edge images.

To use image mode for RHEL, upgrade from RHEL 9 image builder to image mode for RHEL 10. Then, use image mode to build bootable container images for your edge deployments.

Use image mode to customize your operating system with the registry.redhat.io/rhel10/rhel-bootc container image. You can also build a smaller bootc base image from scratch, similar in size and content to the standard RHEL for Edge OSTree commit.

2.1. Image mode for RHEL
Copy link

With image mode for RHEL, you can use containers to build, deploy, and manage the operating system as a bootable image (rhel-bootc). The rhel-bootc image contains the necessary components for a bootable operating system, such as kernel, firmware, and boot loader.

Use image mode for RHEL to build, test, and deploy operating systems by using the same tools and techniques as application containers. Image mode for RHEL is available by using the registry.redhat.io/rhel10/rhel-bootc bootc image. The RHEL bootc images differ from the existing application Universal Base Images (UBI) in that they contain additional components necessary to boot that were traditionally excluded, such as kernel, initrd, boot loader, firmware, among others.

Important

Image mode for RHEL does not support rpm-ostree file system with blueprint customization. You cannot build disk images from bootc images by using osbuild-composer. Instead, use bootc-image-builder to generate disk images from bootc images.

2.2. Building customized images from a base image
Copy link

To build and test your customized container image, use Podman.

Prerequisites

  • The container-tools meta-package is installed.

Procedure

  1. Create a Containerfile with the following structure: 

    FROM registry.redhat.io/rhel10/rhel-bootc:latest

RUN dnf -y install [software] [dependencies] && dnf clean all

ADD [application]
ADD [configuration files]

RUN [config scripts]

  2. Build the <image> image by using the Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

Verification

  • List all images: 

    $ podman images

Map your blueprint customization options and their equivalent Containerfile commands.

Expand
BlueprintContainerfile command instruction

distro = "rhel-10."

FROM rhel-bootc:10

[[packages]]

name = "openssh-server" version = "8.*"

RUN dnf install <package name>

[[groups]]

name = "anaconda-tools"

RUN dnf group install <group_name>

[[containers]]

source = "quay.io/rhel/rhel:latest"

RUN podman pull docker.io/library/postgres:alpine

[customizations.kernel]

name = "kernel-debug" append = "nosmt=force"

RUN mkdir -p /usr/lib/bootc/kargs.d RUN cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["console=ttyS0,114800n8","kernel-debug"] match-architectures = ["x86_64"] EOF

[customizations.rhsm.config.dnf_plugins.product_id]

enabled = true [customizations.rhsm.config.dnf_plugins.subscription_manager]

enabled = true [customizations.rhsm.config.subscription_manager.rhsm]

manage_repos = true [customizations.rhsm.config.subscription_manager.rhsmcertd]

auto_registration = true

COPY ./rhsm.conf /etc/rhsm/rhsm.conf

[customizations.rpm.import_keys]

files = [ "/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-18-primary", "/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-19-primary" ]

RUN mkdir -p /etc/pki/rpm-gpg/ COPY <host_path>/gpg_key /etc/pki/rpm-gpg//gpg_key

[[customizations.sshkey]]

user = "root" key = "PUBLIC SSH KEY"

# SSH keys COPY test.pub container_key.pub RUN mkdir -p .ssh && \ cat container_key.pub >> .ssh/authorized_keys && \ chmod 600 .ssh/authorized_keys && \ rm -f container_path_to_key.pub

[customizations.timezone]

timezone = "US/Eastern" ntpservers = ["0.north-america.pool.ntp.org", "1.north-america.pool.ntp.org"]

RUN ln -sf /usr/share/zoneinfo/Asia/Bangkok /etc/localtime

[customizations.locale]

languages = ["en_US.UTF-8"] keyboard = "us"

RUN cat <<`EOF` >> /etc/locale.conf LANG="en_US.UTF-8" EOF && \ cat <<`EOF` >> /etc/vconsole.conf KEYMAP=us EOF

[customizations.firewall]

ports = ["22:tcp", "80:tcp", "imap:tcp", "53:tcp", "53:udp", "30000-32767:tcp", "30000-32767:udp"]

RUN dnf install -y firewalld && \ dnf clean all && \ firewall-offline-cmd --new-zone=customzone && \ firewall-offline-cmd --zone=customzone --set-description="Custom firewall rules for the container" && \ firewall-offline-cmd --zone=customzone --add-service=ftp && \ firewall-offline-cmd --zone=customzone --add-service=ntp && \ firewall-offline-cmd --zone=customzone --add-service=dhcp && \ firewall-offline-cmd --zone=customzone --add-port=22/tcp && \ firewall-offline-cmd --zone=customzone --add-port=80/tcp && \ firewall-offline-cmd --zone=customzone --add-port=53/tcp && \ firewall-offline-cmd --zone=customzone --add-port=53/udp && \ firewall-offline-cmd --zone=customzone --add-port=30000-32767/tcp && \ firewall-offline-cmd --zone=customzone --add-port=30000-32767/udp && \ firewall-offline-cmd --set-default-zone=customzone

[[customizations.directories]]

path = "/etc/<dir-name>" mode = "0755" user = "root" group = "root" ensure_parents = false

#Directory: RUN mkdir /etc/<dir> RUN chown -R admin:wheel /etc/<dir> && \ chmod -R 644 /etc/<dir> #Files: RUN touch /etc/<myfile> RUN chown :widget /etc/<myfile> && \ chmod 600 /etc/<myfile>

[customizations]

installation_device = "/dev/sda"

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["inst.device=/dev/sda"] EOF

[customizations.ignition.embedded]

config = "eyJpZ25pdG…​.xIn1dfX0="

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["ignition.config.url=http://192.168.122.1/fiot.ign","rd.neednet=1"] EOF

[customizations.fdo]

manufacturing_server_url = "http://192.168.122.199:8080" diun_pub_key_insecure = "true" di_mfg_string_type_mac_iface = "enp2s0"

RUN dnf install -y fdo-init fdo-client && \ systemctl enable fdo-client-linuxapp.service

[customizations.openscap]

datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml" profile_id = "xccdf_org.ssgproject.content_profile_cis"

[customizations.openscap.json_tailoring] profile_id = "<name-of-profile-used-in-json-tailoring>-file" filepath = "/some/path/tailoring-file.json"

[[customizations.files]] path = "/the/path/tailoring-file.json" data = "<json-tailoring-file-contents>"

RUN dnf install -y openscap-utils && \ autotailor --output /some/path/tailoring-file.json \ --new-profille-id xccdf_org.ssgproject.content_profile_cis

[customizations]

fips = true

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/01-fips.toml kargs = ["fips=1"] EOF && \ update-crypto-policies --no-reload --set FIPS

Standard bootc images do not include certain packages that are usually part of an OSTree commit. To match your RHEL for Edge setup, you must install these packages manually.

Missing packages to include:

  • clevis, clevis-dracut, clevis-luks
  • greenboot, greenboot-default-health-checks
  • fdo-client, fdo-owner-cli

Prerequisites

  • An existing RHEL for Edge rpm-ostree-based system.

Procedure

  1. Add the missing packages to your Containerfile: 

    FROM registry.redhat.io/rhel10/rhel-bootc:latest

RUN dnf install -y  \
    clevis  \
    clevis-dracut  \
    clevis-luks  \
    greenboot  \
    greenboot-default-health-checks  \
    fdo-client  \
    fdo-owner-cli
# (Optional) Extra packages often used in edge
# RUN dnf install -y
#     dracut-config-generic  \
#     platform-python  \
#     pinentry  \
#     firewalld  \
#     iptables  \
#     NetworkManager-wifi  \
#     NetworkManager-wwan  \
#     wpa_supplicant  \
#     traceroute  \
#     rootfiles  \
#     policycoreutils-python-utils  \
#     setools-console  \
#     rsync  \
#     usbguard
RUN systemctl enable NetworkManager.service  \
    greenboot-grub2-set-counter.service  \
    greenboot-grub2-set-success.service  \
    greenboot-healthcheck.service  \
    greenboot-rpm-ostree-grub2-check-fallback.service  \
    greenboot-status.service  \
    greenboot-task-runner.service
    redboot-auto-reboot.service  \
    redboot-task-runner.service"

  2. Build your customized RHEL for Edge bootc image: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

  3. Optional: Push the image. 

    $ podman push quay.io/<namespace>/<image>:<tag>

Verification

  • List all images: 

    $ podman images

In RHEL 9.6 and later, use image mode to compose bootable container images and generate disk images for edge deployments. Define your configuration in a Containerfile, then use the bootc-image-builder tool to output a deployable artifact for the edge host.

Note

Image mode is the recommended path for container-native workflows, but you can still use RHEL image builder to create standard RHEL 9.6 and later Edge images. See Composing, installing, and managing RHEL for Edge images.

Prerequisites

  • Podman is installed on your host.
  • Root access to run the bootc-image-builder tool, and run the containers in --privileged mode, to build the images.

Procedure

  1. Create a Containerfile. The following example contains required packages and kernel arguments: 

    $ cat Containerfile
FROM registry.redhat.io/rhel9/rhel-bootc:9.6

# Packages
RUN dnf install -y zsh && dnf clean all

# Group install
RUN dnf group -y install "Development Tools"

# Hostname
RUN echo "rock.paper.scissor" > /etc/hostname

# Kernel
RUN mkdir -p /usr/lib/bootc/kargs.d
RUN cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
kargs = ["console=ttyS0,114800n8","kernel-debug"]
match-architectures = ["x86_64"]
EOF

# Subscription-manager
RUN dnf install subscription-manager

# RPM config
RUN mkdir -p /etc/pki/rpm-gpg/
COPY <host_path>/gpg_key /etc/pki/rpm-gpg/gpg_key

# Timezones
RUN cat <<EOF >> /etc/localtime
Asia/Bangkok
EOF

# Locale
RUN cat <<EOF >> /etc/locale.conf
LANG="en_US.UTF-8"
EOF && \
cat <<EOF >> /etc/vconsole.conf
KEYMAP=us
EOF

# firewall
RUN dnf install -y firewalld && \
    mkdir -p /etc/firewalld/zones
RUN cat <<EOF >> /etc/firewalld/zones/customzone.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
    <short>Customzone</short>
    <description>Custom firewall rules for the container.</description>

    <!-- Allowed services -->
    <service name="ftp"/>
    <service name="ntp"/>
    <service name="dhcp"/>

    <!-- Blocked services (not explicitly listed) -->
    <!-- Removing telnet explicitly is unnecessary if it is not included -->

    <!-- Open specific ports -->
    <port protocol="tcp" port="22"/>
    <port protocol="tcp" port="80"/>
    <port protocol="tcp" port="53"/>
    <port protocol="udp" port="53"/>
    <port protocol="tcp" port="30000-32767"/>
    <port protocol="udp" port="30000-32767"/>
</zone>
EOF
RUN firewall-offline-cmd --set-default-zone=customzone

# systemd services
RUN systemctl enable sshd

#ignition
RUN mkdir -p /usr/lib/bootc/kargs.d && \
cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
kargs = ["ignition.config.url=http://192.168.122.1/fiot.ign","rd.neednet=1"]
EOF

#fdo
RUN dnf install -y fdo-init fdo-client && \
systemctl enable fdo-client-linuxapp.service

#Repositories
RUN mkdir -p /etc/yum.repos.d
COPY custom.repo /etc/yum.repos.d/custom.repo

#fips
RUN mkdir -p /usr/lib/bootc/kargs.d && \
cat <<EOF >>  /usr/lib/bootc/kargs.d/01-fips.toml
kargs = ["fips=1"]
EOF
RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

  2. Build the <image> . Use the Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

Verification

  • List all images: 

    $ podman images
REPOSITORY                                  TAG      IMAGE ID       CREATED              SIZE
quay.io/<namespace>/<image>                          latest   b28cd00741b3   About a minute ago   2.1 GB

To build, deploy, and manage bootable container RHEL for Edge images in RHEL 10 images for edge computing environments, use image mode.

Note

You cannot create certain image types by using bootc-image-builder. This is because not all the RHEL image builder types are available in image mode for RHEL. Notably, the simplified-installer no longer exists. Instead, use the bootc-image-builder Anaconda ISO.

Prerequisites

  • Podman is installed on your host machine.
  • Root access to run containers in --privileged mode.

Procedure

  1. Create a Containerfile. For example: 

    $ cat Containerfile
FROM registry.redhat.io/rhel10/rhel-bootc:10.0

# Packages
RUN dnf install -y zsh && dnf clean all

# Group install
RUN dnf group -y install "Development Tools"

# Kernel
RUN mkdir -p /usr/lib/bootc/kargs.d
RUN cat <<EOF >> /usr/lib/bootc/kargs.d/console.toml
kargs = ["console=ttyS0,114800n8","kernel-debug"]
match-architectures = ["x86_64"]
EOF

# Subscription-manager
COPY ./rhsm.conf /etc/rhsm/rhsm.conf

# RPM config
RUN mkdir -p /etc/pki/rpm-gpg/
COPY <host_path>/gpg_key /etc/pki/rpm-gpg/gpg_key

# Additional groups
RUN groupadd -g 1001 widget

# Timezones
RUN ln -sf /usr/share/zoneinfo/Asia/Bangkok /etc/localtime

# Locale
RUN cat <<EOF >> /etc/locale.conf
LANG="en_US.UTF-8"
EOF && \
cat <<EOF >> /etc/vconsole.conf
KEYMAP=us
EOF


# firewall
RUN dnf install -y firewalld && \
    dnf clean all && \
    firewall-offline-cmd --new-zone=customzone && \
    firewall-offline-cmd --zone=customzone --set-description="Custom firewall rules for the container" && \
    firewall-offline-cmd --zone=customzone --add-service=ftp && \
    firewall-offline-cmd --zone=customzone --add-service=ntp && \
    firewall-offline-cmd --zone=customzone --add-service=dhcp && \
    firewall-offline-cmd --zone=customzone --add-port=22/tcp && \
    firewall-offline-cmd --zone=customzone --add-port=80/tcp && \
    firewall-offline-cmd --zone=customzone --add-port=53/tcp && \
    firewall-offline-cmd --zone=customzone --add-port=53/udp && \
    firewall-offline-cmd --zone=customzone --add-port=30000-32767/tcp && \
    firewall-offline-cmd --zone=customzone --add-port=30000-32767/udp && \
    firewall-offline-cmd --set-default-zone=customzone

# systemd services
RUN systemctl enable httpd sshd && \
systemctl disable telnetd && \
systemctl mask rcpbind

  2. Build the <image> . Use the Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

Verification

  • List all images: 

    $ podman images
REPOSITORY                                  TAG      IMAGE ID       CREATED              SIZE
quay.io/<namespace>/<image>                           latest   b28cd00741b3   About a minute ago   2.1 GB

2.5. Installing bootc-image-builder
Copy link

To install the bootc-image-builder, use the Red Hat Container Registry. The bootc-image-builder is intended to be used as a container and it is not available as an RPM package in RHEL.

Prerequisites

  • The container-tools meta-package is installed. The meta-package contains all container tools, such as Podman, Buildah, and Skopeo.
  • You are authenticated to registry.redhat.io. For details, see Red Hat Container Registry Authentication.

Procedure

  1. Log in to authenticate to registry.redhat.io: 

    $ sudo podman login registry.redhat.io

  2. Install the bootc-image-builder tool: 

    $ sudo podman pull registry.redhat.io/rhel10/bootc-image-builder

Verification

  • List all images pulled to your local system: 

    $ sudo podman images
REPOSITORY                                    TAG         IMAGE ID      CREATED       SIZE
registry.redhat.io/rhel10/bootc-image-builder  latest      b361f3e845ea  24 hours ago  676 MB

To create bootable disk images from existing container images, you can use bootc-image-builder. You can then deploy these disk images by using your traditional methods for your physical or virtual hosts.

Prerequisites

  • You have Podman installed on your host machine.
  • You have root access to run the bootc-image-builder tool and run the containers in --privileged mode, to build the images.

Procedure

  1. Optional: Create a config.toml to configure user access. For example: 

    [[customizations.user]]
name = "user"
password = "pass"
key = "ssh-rsa AAA ... user@email.com"
groups = ["wheel"]

  2. Manually pull the image: 

    $ sudo podman pull quay.io/quay.io/<_namespace_>/<_image_>:<_tag_>

  3. Create the output directory for the image that you are building: 

    $ mkdir output

  4. Run bootc-image-builder to create the image. If you do not want to add any configuration, omit the -v $(pwd)/config.toml:/config.toml argument. 

    $ sudo podman run \
    --rm \
    -it \
    --privileged \
    --pull=newer \
    --security-opt label=type:unconfined_t \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    -v $(pwd)/config.toml:/config.toml \
    -v $(pwd)/output:/output \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type iso \
    --config /config.toml \
  quay.io/<namespace>/<image>:<tag>

    You can find the .iso image in the output folder.

Starting with RHEL 10 and later, RHEL image builder no longer supports composing customized RHEL rpm-ostree images optimized for Edge. To create new RHEL images for Edge environments as part of RHEL 10, you must use image mode for RHEL.

Note

Not all the available RHEL image builder artifacts are available in image mode. That means that you cannot create certain image types by using bootc-image-builder. The simplified-installer no longer exists. Instead, use the bootc-image-builder Anaconda ISO for the FDO workflow.

Prerequisites

  • You have Podman installed on your host machine.
  • You have root access to run the bootc-image-builder tool and run the containers in --privileged mode, to build the images.

Procedure

  1. Optional: Create a config.toml to configure user access. For example: 

    [[customizations.user]]
name = "user"
password = "pass"
key = "ssh-rsa AAA ... user@email.com"
groups = ["wheel"]

  2. Manually pull the image: 

    $ sudo podman pull quay.io/<namespace>/<image>:_<tag>_

  3. Create the output directory for the image that you are building: 

    $ mkdir output

  4. Run bootc-image-builder to create the image. If you do not want to add any configuration, omit the -v $(pwd)/config.toml:/config.toml argument. 

    $ sudo podman run \
    --rm \
    -it \
    --privileged \
    --pull=newer \
    --security-opt label=type:unconfined_t \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    -v $(pwd)/config.toml:/config.toml \
    -v $(pwd)/output:/output \
    registry.redhat.io/rhel10/bootc-image-builder:latest \
    --type iso \
    --config /config.toml \
  quay.io/<namespace>/<image>:<tag>

    You can find the .iso image in the output folder.

To maintain consistent permissions across your infrastructure, define persistent users and groups in your Containerfile. This ensures permissions remain intact when you perform a bootc switch to migrate hosts.

Important

User and group IDs differ between rhel-bootc images and RHEL for Edge. This affects several groups and users, such as ssh_keys. As a consequence, the private keys belong to a group with a misconfigured ID, and you will not be able to use public keys to access the edge system.

Prerequisites

Procedure

  1. Extract the users and groups information from your RHEL for Edge system: 

    $ mkdir -p ./usr/lib
$ ssh admin@192.168.100.50 'cat /lib/passwd' > ./usr/lib/passwd
$ ssh admin@192.168.100.50 'cat /lib/group' > ./usr/lib/group

  2. Include the missing RHEL for Edge packages in the bootc-based system by specifying them in a Containerfile. Additionally, use the COPY command to include the group and passwd content that was extracted from the RHEL for Edge system. The following is an example: 

    FROM registry.redhat.io/rhel9/rhel-bootc
WORKDIR /tmp
RUN dnf -y install ModemManager \
                   NetworkManager-wifi \
                   NetworkManager-wwan \
                   audit \
                   checkpolicy \
                   clevis \
                   clevis-dracut \
                   clevis-luks \
                   clevis-pin-tpm2 \
                   clevis-systemd \
                   containernetworking-plugins \
                   dnsmasq \
                   dracut-config-generic \
                   fdo-client \
                   fdo-owner-cli \
                   firewalld \
                   firewalld-filesystem \
                   greenboot \
                   greenboot-default-health-checks \
                   grubby \
                   ignition \
                   ignition-edge \
                   ipset \
                   iwl100-firmware \
                   iwl1000-firmware \
                   iwl105-firmware \
                   iwl135-firmware \
                   iwl2000-firmware \
                   iwl2030-firmware \
                   iwl3160-firmware \
                   iwl5000-firmware \
                   iwl5150-firmware \
                   iwl6050-firmware \
                   iwl7260-firmware \
                   libsecret \
                   pinentry \
                   policycoreutils-python-utils \
                   python3-distro \
                   python3-setools \
                   rsync \
                   setools-console \
                   tmux \
                   traceroute \
                   usbguard \
                   usbguard-selinux \
                   wireless-regdb \
                   wpa_supplicant

COPY etc /etc
# You can find the passwd and group content that were extracted from the RHEL for Edge system usr/lib/ in your current working directory. You can copy the content into the container image with the following step:
COPY usr /usr

  3. Build the bootc image and push it to the registry: 

    $ podman build -f Containerfile -t quay.io/<namespace>/<image>:<tag> .
$ podman push quay.io/<namespace>/<image>:<tag>

  4. Switch the edge host to the new image and reboot: 

    $ ssh admin@192.168.100.50
$ sudo bootc switch quay.io/<namespace>/<image>:<tag>
$ sudo reboot

Verification

Confirm that the contents of /lib/passwd and /lib/group match the original OSTree system.

  1. Check the content of /lib/passwd. 

    $ cat /lib/passwd

  2. Check the content of /lib/group. 

    $ cat /lib/group

2.7. Troubleshooting SSH and ownership issues
Copy link

When switching a RHEL for Edge system to an image-mode based system, you might encounter identity drift.

This means that the User IDs (UID) or Group IDs (GID) in the new bootable container do not match the IDs on the original system. This impacts SSH access and file ownership in the /var directory.

In image mode systems, the system uses altfiles to manage users at /usr/lib/passwd and groups at /usr/lib/ group. If the IDs in these files differ from the existing system, services might fail or files might become inaccessible.

Prerequisites

If you cannot log in by using SSH after a bootc switch operation, the ssh_keys group ID changed. For example, if the ID drifts from 101 to 999, the edge system might become unreachable.

Procedure

  1. Identify GID mismatches for SSH:

    1. On the device, check the current ID of the ssh_keys group: 

      $ getent group ssh_keys

    2. Compare the current ID to the owner of your authorized keys: 

      $ ls -ln /home/admin/.ssh/authorized_keys

      If the numeric GID in the ls output does not match the getent output, SSH authentication fails.

      • Fix persistent permission issues in /var.

        The /var directory is persistent across updates. If your Containerfile uses different UIDs than the previous operating system, the files in /var are owned by orphaned IDs.

    3. Identify files owned by unknown numeric IDs: 

      $ find /var -nouser -o -nogroup

    4. If the previous step displays any files, resolve the drift by using one of the following methods:

      • Update the Containerfile: Extract the group and user information from the existing RHEL for Edge system and fix the IDs as part of the Containerfile. Configure the Containerfile to copy a local lib/group file to the container image to ensure ID parity.

      • Manually fix permissions on the host: 

        $ sudo chown -R admin:admin /var/lib/<application>

When you convert a raw image of RHEL to image mode, you can rebase your current operating system onto a bootable container image. Then, you can use the bootc update workflow for future lifecycle management.

Prerequisites

  • An existing 9.6 RHEL for Edge installed with a raw image.

Procedure

  1. Update your image. See Updating RHEL for Edge images.

  2. Switch your existing image from RHEL image builder to image mode.

    1. Build an image from rhel-bootc. For example: 

      $ cat Containerfile
FROM registry.redhat.io/rhel9/rhel-bootc:latest
RUN dnf install -y  \
    clevis  \
    clevis-dracut  \
    clevis-luks  \
    fdo-client  \
    fdo-owner-cli

  3. Build the <image> image by using Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

  4. Push the image to a registry. 

    $ podman push quay.io/<namespace>/<image>:_<tag>_

  5. Run bootc switch on the device. 

    $ bootc switch quay.io/<namespace>/<image>:_<tag>_

  6. Run systemctl reboot. 

    $ sudo systemctl reboot

Verification

  • Connect to your RHEL for Edge system and run bootc status: 

    # bootc status

You can convert existing RHEL 9.6 and later for Edge systems, deployed by using the simplified-installer, to image mode for RHEL. The resulting bootable container image turns into a dynamic bootc workflow without requiring a physical re-installation.

Prerequisites

  • An existing 9.6 or later RHEL for Edge installed with a simplified-installer image.

Procedure

  1. Check if bootc is installed: 

    $ rpm -qa | bootc

    Update your image to the latest rpm-ostree installation. See Updating RHEL for Edge images.

    1. Build an image from rhel-bootc. For example: 

      $ cat Containerfile
FROM registry.redhat.io/rhel9/rhel-bootc:latest
RUN dnf install -y  \
    clevis  \
    clevis-dracut  \
    clevis-luks  \
    fdo-client  \
    fdo-owner-cli

  2. Build the <image> image by using Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

    1. Push the image to a registry. 

      $ podman push quay.io/<namespace>/<image>:_<tag>_

    2. Run bootc switch to switch the device to the image you pushed to the registry. 

      $ bootc switch quay.io/<namespace>/<image>:_<tag>_

    3. Run systemctl reboot. 

      $ sudo systemctl reboot

Verification

  • Connect to your RHEL for Edge system and use bootc status: 

    # bootc status

You can upgrade an existing RHEL for Edge 9.6 system to RHEL 10.0 by using image mode for RHEL. By converting your current systems to a bootc workflow, you can manage host updates by using container images while retaining your existing edge deployments.

Prerequisites

  • An existing 9.6 or later RHEL for Edge system.

Procedure

  1. Update your image. See Updating RHEL for Edge images. 

    $ sudo rpm-ostree upgrade
$ sudo systemctl reboot

  2. Build a bootc image that uses RHEL 10.0. For example: 

    $ cat Containerfile
FROM registry.redhat.io/rhel10/rhel-bootc:10.0
RUN dnf install -y  \
    clevis  \
    clevis-dracut  \
    clevis-luks  \
    fdo-client  \
    fdo-owner-cli

  3. Build the <image> image by using Containerfile in the current directory: 

    $ podman build -t quay.io/<namespace>/<image>:<tag> .

  4. Push the image to a registry. 

    $ podman push quay.io/<namespace>/<image>:_<tag>_

  5. Run bootc switch on the device. 

    $ bootc switch quay.io/<namespace>/<image>:_<tag>_

  6. Reboot the system. 

    $ sudo systemctl reboot

Verification

  • Connect to your RHEL for Edge system and use bootc status: 

    # bootc status
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top