Customize kernel, system settings, and services

Customize kernel arguments and real-time kernel support in RHEL images. You can configure system settings, including time zone, Network Time Protocol (NTP) servers, locale preferences, and firewall rules, and control which services start at boot time by using blueprint customizations.

Append a kernel argument
Copy link

You can append arguments to the boot loader kernel command line. By default, RHEL image builder builds a default kernel into the image. However, you can customize the kernel by configuring it in the blueprint.

Before you begin
Copy link

  • You have created a blueprint.

Procedure
Copy link

Append a kernel boot parameter option to the defaults: 
[customizations.kernel]
append = "<kernel_option>"

For example:

[customizations.kernel]
name = "kernel-debug"
append = "nosmt=force"

Build RHEL images by using the real-time kernel
Copy link

Build a RHEL image by using the real-time kernel (kernel-rt). Override a repository by using .json from the /usr/share/image-builder/repositories/ directory to build an image that selects kernel-rt as the default kernel. Deploy the image to a system and use the real-time kernel features.

Before you begin
Copy link

  • Your system is registered, and RHEL is attached to a RHEL for Real Time subscription.

About this task
Copy link

Note
The real-time kernel runs on AMD64 and Intel 64 server platforms that are certified to run Red Hat Enterprise Linux.

Procedure
Copy link

  1. Create a kernel.json file to include the RT kernel repository: 
        {
      "name": "kernel-rt",
      "baseurl": "https://cdn.redhat.com/content/dist/rhel10/10/x86_64/rt/os",
      "gpgkey": "
-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBEr………fg==\n=UZd/\n-----END PGP PUBLIC KEY BLOCK-----\n",
      "rhsm": true,
      "check_gpg": true
    },
  2. Create a blueprint. In the blueprint, add the "[customizations.kernel]" customization. The following is an example that contains the "[customizations.kernel]" in the blueprint: 
    name = "rt-kernel-image"
description = ""
version = "2.0.0"
modules = []
groups = []
distro = "rhel-10.0"
[[customizations.user]]
name = "admin"
password = "admin"
groups = ["users", "wheel"]
[customizations.kernel]
name = "kernel-rt"
append = ""
  3. Build your image from the blueprint you created. The following example builds a .qcow2 image: 
    # image-builder build qcow2 -- blueprint rt-kernel-image --data-dir kernel.json
  4. Deploy the image that you built to the system where you want to use the real-time kernel features.

Results
Copy link

  • After booting a VM from the image, verify that the image correctly selected kernel-rt as the default kernel. 
    $ cat /proc/cmdline
     
    BOOT_IMAGE=(hd0,got3)/vmlinuz-6.12.0-0.el10_0_.x86_64+rt...

Set time zone and NTP
Copy link

You can customize your blueprint to configure the time zone and the Network Time Protocol (NTP).

Before you begin
Copy link

  • You have created a blueprint.

About this task
Copy link

Both timezone and ntpservers attributes are optional strings. If you do not customize the time zone, the system uses Universal Time Coordinated (UTC). If you do not set NTP servers, the system uses the default distribution.

Procedure
Copy link

Customize the blueprint with the timezone and the ntpservers you want: 
[customizations.timezone]
timezone = "TIMEZONE"
ntpservers = "NTP_SERVER"

For example:

[customizations.timezone]
timezone = "US/Eastern"
ntpservers = ["0.north-america.pool.ntp.org", "1.north-america.pool.ntp.org"]
Note
Some image types, such as Google Cloud, already have NTP servers configured. You cannot override it because the image requires the NTP servers to boot in the selected environment. However, you can customize the time zone in the blueprint.

Customize the locale settings
Copy link

You can customize the locale settings for your resulting system image. Both language and keyboard attributes are mandatory. The first language you add is the primary language, and the remaining languages are secondary.

Before you begin
Copy link

  • You have created a blueprint.

Procedure
Copy link

  • Set the locale settings: 
    [customizations.locale]
languages = ["<language>"]
keyboard = "<keyboard>"

    For example:

    [customizations.locale]
languages = ["en_US.UTF-8"]
keyboard = "us"
  • List the values supported by the languages: 
    $ localectl list-locales
  • List the values supported by the keyboard: 
    $ localectl list-keymaps

Customize firewall
Copy link

Set the firewall for the resulting system image. By default, the firewall blocks incoming connections, except for services that you explicitly enabled ports, such as sshd.

Before you begin
Copy link

  • You have created a blueprint.

About this task
Copy link

If you do not want to use the [customizations.firewall] or [customizations.firewall.services], either remove the attributes or set them to an empty list []. If you only want to use the default firewall setup, you can omit the customization from the blueprint.

Note
The Google template explicitly disables the firewall for their environment. You cannot override this behavior by setting the blueprint.

Procedure
Copy link

  • Customize the blueprint with the following settings to open other ports and services: 
    [customizations.firewall]
ports = ["<ports>"]

    Where ports is an optional list of strings that contain ports or a range of ports and protocols to open. You can configure the ports by using the port:protocol format, or you can configure the port ranges by using the portA-portB:protocol format. For example:

    [customizations.firewall]
ports = ["22:tcp", "80:tcp", "imap:tcp", "53:tcp", "53:udp", "30000-32767:tcp", "30000-32767:udp"]

    You can use numeric ports or their names from the /etc/services to enable or disable port lists.

  • Specify which firewall services to enable or disable in the customizations.firewall.service section: 
    [customizations.firewall.services]
enabled = ["<services>"]
disabled = ["<services>"]
  • You can check the available firewall services: 
    $ firewall-cmd --get-services

    For example:

    [customizations.firewall.services]
enabled = ["ftp", "ntp", "dhcp"]
disabled = ["telnet"]
    Note
    The services listed in firewall.services are different from the service-names available in the /etc/services file.

Enable or disabling services
Copy link

You can control which services to enable during boot time. Some image types have preset services that you cannot override to ensure the image works correctly.

Before you begin
Copy link

  • You have created a blueprint.

About this task
Copy link

The [customizations.services] settings add to existing services in image templates but do not replace them.

Procedure
Copy link

Customize which services to enable during boot time: 
[customizations.services]
enabled = ["services"]
disabled = ["services"]

For example:

[customizations.services]
enabled = ["sshd", "cockpit.socket", "httpd"]
disabled = ["postfix", "telnetd"]