Composing a customized RHEL system image

Procedure

1. Install RHEL image builder and other necessary packages:

   # dnf install osbuild-composer composer-cli cockpit-composer

   • osbuild-composer - A service to build customized RHEL operating system images.
   • composer-cli- This package enables access to the CLI interface.
   • cockpit-composer - This package enables access to the Web UI interface. The web console is installed as a dependency of the cockpit-composer package.

2. Enable and start RHEL image builder socket:

   # systemctl enable --now osbuild-composer.socket

3. If you want to use RHEL image builder in the web console, enable and start it.

   # systemctl enable --now cockpit.socket

   The osbuild-composer and cockpit services start automatically on first access.

4. Load the shell configuration script so that the autocomplete feature for the composer-cli command starts working immediately without logging out and in:

   $ source /etc/bash_completion.d/composer-cli

5. Restart the running osbuild-composer service on your RHEL host.

   # systemctl restart osbuild-composer

Procedure

1. Create a repository source file, such as /root/repo.toml. For example:

   id = "k8s"
   name = "Kubernetes"
   type = "yum-baseurl"
   url = "https://server.example.com/repos/company_internal_packages/"
   check_gpg = false
   check_ssl = false
   system = false

   The type field accepts the following valid values: yum-baseurl, yum-mirrorlist, and yum-metalink.

2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

2. Check the new source content:

   $ composer-cli sources info <source_id>

Procedure

1. Create a repository source file, such as /root/repo.toml. For example, to specify the distribution:

   check_gpg = true
   check_ssl = true
   distros = ["rhel-9"]
   id = "rh9-local"
   name = "packages for RHEL"
   system = false
   type = "yum-baseurl"
   url = "https://local/repos/rhel9/projectrepo/"

2. Save the file in the TOML format.

3. Add the new third-party source to RHEL image builder:

   $ composer-cli sources add <file-name>.toml

Verification

1. Check if the new source was successfully added:

   $ composer-cli sources list

2. Check the new source content:

   $ composer-cli sources info <source_id>

Procedure

1. Access the folder where you want to create a repository:

   $ cd repo/

2. Run the createrepo_c to create a repository from RPM packages:

   $ createrepo_c .

3. Access the directory where the repodata is:

   $ cd repodata/

4. Sign your repomd.xml file:

   $ gpg -u <_gpg-key-email_> --yes --detach-sign --armor /srv/repo/example/repomd.xml

5. To enable GPG signature checks in the repository:

   1. Set check_repogpg = true in the repository source.

   2. Enter the gpgkey that you want to do the check. If your key is available over https, set the gpgkeys field with the key URL for the key. You can add as many URL keys as you need.

      The following is an example:

      check_gpg = true
      check_ssl = true
      id = "signed local packages"
      name = "repository_name"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      check_repogpg = true
      gpgkeys=["https://local/keys/repokey.pub"]

      As an alternative, add the GPG key directly in the gpgkeys field, for example:

      check_gpg = true
      check_ssl = true
      check_repogpg
      id = "custom-local"
      name = "signed local packages"
      type = "yum-baseurl"
      url = "https://local/repos/projectrepo/"
      gpgkeys=["https://remote/keys/other-repokey.pub",
      '''-----BEGIN PGP PUBLIC KEY BLOCK-----
      …​
      -----END PGP PUBLIC KEY BLOCK-----''']

      • If the test does not find the signature, the GPG tool shows an error similar to the following one:

        $ GPG verification is enabled, but GPG signature is not available.
        This may be an error or the repository does not support GPG verification:
        Status code: 404 for http://repo-server/rhel/repodata/repomd.xml.asc (IP: 192.168.1.3)

      • If the signature is invalid, the GPG tool shows an error similar to the following one:

        repomd.xml GPG signature verification error: Bad GPG signature

Procedure

1. Create the /etc/osbuild-composer/repositories/ directory to store your repository overrides:

   $ sudo mkdir -p /etc/osbuild-composer/repositories

2. Create a JSON file, using a name corresponding to your RHEL version. Alternatively, you can copy the file for your distribution from /usr/share/osbuild-composer/ and modify its content.

   For RHEL 9.3, use /etc/osbuild-composer/repositories/rhel-93.json.

3. Add the following structure to your JSON file. Specify only one of the following attributes, in the string format:

   • baseurl - The base URL of the repository.
   • metalink - The URL of a metalink file that contains a list of valid mirror repositories.

   • mirrorlist - The URL of a mirrorlist file that contains a list of valid mirror repositories. The remaining fields, such as gpgkey, and metadata_expire, are optional.

     For example:

     {
          "x86_64": [
             {
                 "name": "baseos",
                 "baseurl": "http://mirror.example.com/composes/released/RHEL-9/9.0/BaseOS/x86_64/os/",
                 "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
                 "check_gpg": true
             }
         ]
     }

     Alternatively, you can copy the JSON file for your distribution, by replacing rhel-version.json with your RHEL version, for example: rhel-9.json.

     $  cp /usr/share/osbuild-composer/repositories/rhel-version.json /etc/osbuild-composer/repositories/

4. Optional: Verify the JSON file:

   $ json_verify  /etc/osbuild-composer/repositories/<file>.json

5. Edit the baseurl paths in the rhel-9.json file and save it. For example:

   $ /etc/osbuild-composer/repositories/rhel-version.json

6. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

Procedure

1. Get the baseurl from the /etc/yum.repos.d/redhat.repo file:

   # cat /etc/yum.repos.d/redhat.repo
   [AppStream]
   name = AppStream mirror example
   baseurl = https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/
   enabled = 1
   gpgcheck = 0
   sslverify = 1
   sslcacert = /etc/pki/ca1/ca.crt
   sslclientkey = /etc/pki/ca1/client.key
   sslclientcert = /etc/pki/ca1/client.crt
   metadata_expire = 86400
   enabled_metadata = 0

2. Configure the repository override to use the same baseurl and set rhsm to true:

   {
       "x86_64": [
           {
               "name": "AppStream mirror example",
               "baseurl": "https://mirror.example.com/RHEL-9/9.0/AppStream/x86_64/os/",
               "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\n (…​)",
               "check_gpg": true,
               "rhsm": true
           }
       ]
   }

3. Restart the osbuild-composer.service:

   $ sudo systemctl restart osbuild-composer.service

Procedure

1. Find the repository URL from your currently configured repositories:

   $ sudo yum -v repolist rhel-8-for-x86_64-baseos-rpms | grep repo-baseurl
     Repo-baseurl :

   The following output is an example:

   https://satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV/content/dist/rhel8/8/x86_64/baseos/os

2. Modify the hard-coded repositories to a Satellite Server.

   1. Create a repository directory with the 0755 permission:

      $ sudo mkdir -pvm 0755 /etc/osbuild-composer/repositories

   2. Copy the content from /usr/share/osbuild-composer/repositories/*.json to the directory that you created:

      $ sudo cp /usr/share/osbuild-composer/repositories/*.json /etc/osbuild-composer/repositories/

   3. Update the Satellite URL and the file contents through the /content/dist/* line:

      $ sudo sed -i -e 's|cdn.redhat.com|satellite6.example.com/pulp/content/YourOrg/YourEnv/YourCV|' /etc/osbuild-composer/repositories/*.json

   4. Verify that the configuration was correctly replaced:

      $ sudo vi /etc/osbuild-composer/repositories/rhel-8.json

3. Restart the services:

   $ sudo systemctl restart osbuild-worker@1.service osbuild-composer.service

4. Override the required system repository in Red Hat image builder configuration and use the URL of your Satellite repository as a baseurl. See Overriding a system repository.

Procedure

1. In the Satellite web UI, navigate to Content > Products, select your Product and click the repository you want to use.
2. Search for the secured URL (HTTPS) in the Published field and copy it.
3. Use the URL that you copied as a baseurl for the Red Hat image builder repository. See Adding custom third-party repositories to RHEL image builder.

1. Create a blueprint or export (save) an existing blueprint definition to a plain text file
2. Edit this file in a text editor
3. Import the blueprint text file back into image builder
4. Run a compose to build an image from the blueprint
5. Export the image file to download it

Procedure

1. Create a plain text file with the following contents:

   name = "BLUEPRINT-NAME"
   description = "LONG FORM DESCRIPTION TEXT"
   version = "0.0.1"
   modules = []
   groups = []

   Replace BLUEPRINT-NAME and LONG FORM DESCRIPTION TEXT with a name and description for your blueprint.

   Replace 0.0.1 with a version number according to the Semantic Versioning scheme.

2. For every package that you want to be included in the blueprint, add the following lines to the file:

   [[packages]]
   name = "package-name"
   version = "package-version"

   Replace package-name with the name of the package, such as httpd, gdb-doc, or coreutils.

   Optionally, replace package-version with the version to use. This field supports dnf version specifications:

   • For a specific version, use the exact version number such as 8.7.0.
   • For the latest available version, use the asterisk *.
   • For the latest minor version, use formats such as 8.*.

3. Customize your blueprints to suit your needs. For example, disable Simultaneous Multi Threading (SMT), add the following lines to the blueprint file:

   [customizations.kernel]
   append = "nosmt=force"

   For additional customizations available, see Supported Image Customizations.

4. Save the file, for example, as BLUEPRINT-NAME.toml and close the text editor.

5. Push the blueprint:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Replace BLUEPRINT-NAME with the value you used in previous steps.

   Note

   To create images using composer-cli as non-root, add your user to the weldr or root groups.

   # usermod -a -G weldr user
   $ newgrp weldr

Procedure

1. List the existing blueprints:

   # composer-cli blueprints list

2. Save the blueprint to a local text file:

   # composer-cli blueprints save BLUEPRINT-NAME

3. Edit the BLUEPRINT-NAME.toml file with a text editor and make your changes.

4. Before finishing the edits, verify that the file is a valid blueprint:

   1. Remove the following line from the blueprint, if present:

      packages = []

   2. Increase the version number, for example, from 0.0.1 to 0.1.0. Remember that RHEL image builder blueprint versions must use the Semantic Versioning scheme. Note also that if you do not change the version, the patch version component increases automatically.
5. Save the file and close the text editor.

6. Push the blueprint back into RHEL image builder:

   # composer-cli blueprints push BLUEPRINT-NAME.toml

   Note

   To import the blueprint back into RHEL image builder, supply the file name including the .toml extension, while in other commands use only the blueprint name.

Verification

1. To verify that the contents uploaded to RHEL image builder match your edits, list the contents of blueprint:

   # composer-cli blueprints show BLUEPRINT-NAME

2. Check whether the components and versions listed in the blueprint and their dependencies are valid:

   # composer-cli blueprints depsolve BLUEPRINT-NAME

Procedure

1. Optional: List the image formats you can create:

   # composer-cli compose types

2. Start the compose:

   # composer-cli compose start BLUEPRINT-NAME IMAGE-TYPE

   Replace BLUEPRINT-NAME with the name of the blueprint, and IMAGE-TYPE with the type of the image. For the available values, see the output of the composer-cli compose types command.

   The compose process starts in the background and shows the composer Universally Unique Identifier (UUID).

3. The image creation can take up to ten minutes to complete.

   To check the status of the compose:

   # composer-cli compose status

   A finished compose shows the FINISHED status value. To identify your compose in the list, use its UUID.

4. After the compose process is finished, download the resulting image file:

   # composer-cli compose image UUID

   Replace UUID with the UUID value shown in the previous steps.

Procedure

1. On the host, open https://<_localhost_>:9090/ in a web browser.
2. Log in to the web console as the root user.

3. To display the RHEL image builder controls, click the Image Builder button, in the upper-left corner of the window.

   The RHEL image builder dashboard opens, listing existing blueprints, if any.

Procedure

1. Click Create Blueprint in the upper-right corner.

   A dialog wizard with fields for the blueprint name and description opens.

2. On the Details page:

   1. Enter the name of the blueprint and, optionally, its description.
   2. Click Next.

3. Optional: In the Packages page:

   1. On the Available packages search, enter the package name
   2. Click the > button to move it to the Chosen packages field.
   3. Repeat the previous steps to search and include as many packages as you want.

   4. Click Next.

      Note

      These customizations are all optional unless otherwise specified.

4. On the Kernel page, enter a kernel name and the command-line arguments.

5. On the File system page, you can select Use automatic partitioning or Manually configure partitions for your image file system. For manually configuring the partitions, complete the following steps:

   1. Click the Manually configure partitions button.

      The Configure partitions section opens, showing the configuration based on Red Hat standards and security guides.

   2. From the dropdown menu, provide details to configure the partitions:

      1. For the Mount point field, select one of the following mount point type options:

         • / - the root mount point
         • /var
         • /home
         • /opt
         • /srv
         • /usr
         • /app
         • /data
         • /tmp

         • /usr/local

           You can also add an additional path to the Mount point, such as /tmp. For example: /var as a prefix and /tmp as an additional path results in /var/tmp.

           Note

           Depending on the Mount point type you choose, the file system type changes to xfs.

      2. For the Minimum size partition field of the file system, enter the needed minimum partition size. In the Minimum size dropdown menu, you can use common size units such as GiB, MiB, or KiB. The default unit is GiB.

         Note

         Minimum size means that RHEL image builder can still increase the partition sizes, in case they are too small to create a working image.

   3. To add more partitions, click the Add partition button. If you see the following error message: Duplicate partitions: Only one partition at each mount point can be created., you can:

      1. Click the Remove button to remove the duplicated partition.
      2. Choose a new mount point for the partition you want to create.
   4. After you finish the partitioning configuration, click Next.

6. On the Services page, you can enable or disable services:

   1. Enter the service names you want to enable or disable, separating them by a comma, by space, or by pressing the Enter key. Click Next.

7. On the Firewall page, set up your firewall setting:

   1. Enter the Ports, and the firewall services you want to enable or disable.
   2. Click the Add zone button to manage your firewall rules for each zone independently. Click Next.

8. On the Users page, add a users by following the steps:

   1. Click Add user.
   2. Enter a Username, a password, and a SSH key. You can also mark the user as a privileged user, by clicking the Server administrator checkbox. Click Next.

9. On the Groups page, add groups by completing the following steps:

   1. Click the Add groups button:

      1. Enter a Group name and a Group ID. You can add more groups. Click Next.

10. On the SSH keys page, add a key:

    1. Click the Add key button.

       1. Enter the SSH key.
       2. Enter a User. Click Next.

11. On the Timezone page, set your time zone settings:

    1. On the Timezone field, enter the time zone you want to add to your system image. For example, add the following time zone format: "US/Eastern".

       If you do not set a time zone, the system uses Universal Time, Coordinated (UTC) as default.

    2. Enter the NTP servers. Click Next.

12. On the Locale page, complete the following steps:

    1. On the Keyboard search field, enter the package name you want to add to your system image. For example: ["en_US.UTF-8"].
    2. On the Languages search field, enter the package name you want to add to your system image. For example: "us". Click Next.

13. On the Others page, complete the following steps:

    1. On the Hostname field, enter the hostname you want to add to your system image. If you do not add a hostname, the operating system determines the hostname.
    2. Mandatory only for the Simplifier Installer image: On the Installation Devices field, enter a valid node for your system image. For example: dev/sda1. Click Next.

14. Mandatory only when building FIDO images: On the FIDO device onboarding page, complete the following steps:

    1. On the Manufacturing server URL field, enter the following information:

       1. On the DIUN public key insecure field, enter the insecure public key.
       2. On the DIUN public key hash field, enter the public key hash.
       3. On the DIUN public key root certs field, enter the public key root certs. Click Next.

15. On the OpenSCAP page, complete the following steps:

    1. On the Datastream field, enter the datastream remediation instructions you want to add to your system image.
    2. On the Profile ID field, enter the profile_id security profile you want to add to your system image. Click Next.

16. Mandatory only when building Ignition images: On the Ignition page, complete the following steps:

    1. On the Firstboot URL field, enter the package name you want to add to your system image.
    2. On the Embedded Data field, drag or upload your file. Click Next.
17. . On the Review page, review the details about the blueprint. Click Create.

Procedure

1. On the RHEL image builder dashboard, click Import blueprint. The Import blueprint wizard opens.
2. From the Upload field, either drag or upload an existing blueprint. This blueprint can be in either TOML or JSON format.
3. Click Import. The dashboard lists the blueprint you imported.

Procedure

1. On the image builder dashboard, select the blueprint you want to export.
2. Click Export blueprint. The Export blueprint wizard opens.

3. Click the Export button to download the blueprint as a file or click the Copy button to copy the blueprint to the clipboard.

   1. Optional: Click the Copy button to copy the blueprint.

Procedure

1. In the RHEL image builder dashboard, click the blueprint tab.
2. On the blueprint table, find the blueprint you want to build an image.
3. On the right side of the chosen blueprint, click Create Image. The Create image dialog wizard opens.

4. On the Image output page, complete the following steps:

   1. From the Select a blueprint list, select the image type you want.

   2. From the Image output type list, select the image output type you want.

      Depending on the image type you select, you need to add further details.

5. Click Next.

6. On the Review page, review the details about the image creation and click Create image.

   The image build starts and takes up to 20 minutes to complete.

Procedure

1. Create the ISO image:

   # composer-cli compose start BLUEPRINT-NAME image-installer

   • BLUEPRINT-NAME with name of the blueprint you created

   • image-installer is the image type

     The compose process starts in the background and the UUID of the compose is shown. Wait until the compose is finished. This might take several minutes.

2. Check the status of the compose:

   # composer-cli compose status

   A finished compose shows a status value of FINISHED.

3. Identify the compose in the list by its UUID.

   # composer-cli compose list

4. After the compose is finished, download the created image file to the current directory:

   # composer-cli compose image UUID

   Replace UUID with the UUID value obtained in the previous steps.

   RHEL image builder builds a .iso file that contains a .tar file. The .tar file is the image that will be installed for the Operating system. The . iso is set up to boot Anaconda and install the .tar file to set up the system.

1. Locate the .iso image you downloaded.

2. Mount the ISO.

   $ mount -o ro path_to_ISO /mnt

   You can find the .tar file at the /mnt/liveimg.tar.gz directory.

3. List the .tar file content:

   $ tar ztvf /mnt/liveimg.tar.gz

Procedure

1. On the RHEL image builder dashboard, locate the blueprint that you want to use to build your image. Optionally, enter the blueprint name or a part of it into the search box at upper left, and click Enter.

2. On the right side of the blueprint, click the corresponding Create Image button.

   The Create image dialog wizard opens.

3. On the Create image dialog wizard:

   1. In the Image Type list, select "RHEL Installer (.iso)".
   2. Click Next.

   3. On the Review tab, click Create.

      RHEL image builder adds the compose of a RHEL ISO image to the queue.

      After the process is complete, you can see the image build complete status. RHEL image builder creates the ISO image.

1. Click Download to save the "RHEL Installer (.iso)" image to your system.
2. Navigate to the folder where you downloaded the "RHEL Installer (.iso)" image.
3. Locate the .tar image you downloaded.

4. Extract the "RHEL Installer (.iso)" image content.

   $ tar -xf content.tar

Procedure

1. Write the bootable ISO image directly to the USB drive using the dd tool. For example:

   dd if=installer.iso of=/dev/sdX

   Where installer.iso is the ISO image file name and /dev/sdX is your USB flash drive device path.

2. Insert the flash drive into a USB port of the computer you want to boot.

3. Boot the ISO image from the USB flash drive.

   When the installation environment starts, you might need to complete the installation manually, similarly to the default Red Hat Enterprise Linux installation.

Procedure

1. Install OpenSCAP on your system:

   # dnf install openscap-scanner

2. Install scap-security-guide package:

   # dnf install scap-security-guide

   After the installation is completed you can start using the oscap command line tool. The SCAP content with security profiles will be installed in the /usr/share/xml/scap/ssg/content/ directory.

Procedure

1. Create a hardening blueprint in the TOML format, using OpenSCAP tool and scap-security-guide content, and modify it if necessary:

   # oscap xccdf generate fix --profile=cis --fix-type=blueprint /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml > cis.toml

2. Push the blueprint to osbuild-composer by using the composer-cli tool:

   # composer-cli blueprints push cis.toml

3. Start the build of hardened image:

   # composer-cli compose start hardened_xccdf_org.ssgproject.content_profile_cis qcow2

   After the image build is ready, you can use your pre-hardened image on your deployments. See Creating a virtual machine.

1. Connect to the virtual machine by using SSH.

2. Run the oscap scanner.

   # oscap xccdf eval --profile=cis --report=/tmp/compliance-report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

3. Fetch compliance-report.html and inspect the results.

Procedure

1. Create a hardening blueprint in the TOML format, using OpenSCAP tool and scap-security-guide content, and modify it if necessary:

   # oscap xccdf generate fix --profile=cis --fix-type=blueprint /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml > cis_tailored.toml

2. Append the tailoring section with the customized rule set to the blueprint:

   # Blueprint for CIS Red Hat Enterprise Linux 9 Benchmark for Level 2 - Server
   # ...
   [customizations.openscap.tailoring]
   selected = [ "xccdf_org.ssgproject.content_bind_crypto_policy" ]
   unselected = [ "grub2_password" ]

3. Push the blueprint to osbuild-composer by using the composer-cli tool:

   # composer-cli blueprints push cis_tailored.toml

4. Start the build of hardened image:

   # composer-cli compose start hardened_xccdf_org.ssgproject.content_profile_cis qcow2

   After the image build is ready, use your pre-hardened image on your deployments to create a VM. For more information, see Creating a virtual machine.

   After you deploy your pre-hardened image in a VM, you can perform a configuration compliance scan to verify that the image is aligned with the selected security profile.

   Important

   Performing a configuration compliance scanning does not guarantee the system is compliant. For more information, see Configuration compliance scanning.

1. Connect to the virtual machine by using SSH.

2. Run the oscap scanner.

   # oscap xccdf eval --profile=cis --report=/tmp/compliance-report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

3. Fetch compliance-report.html and inspect the results.

Procedure

1. Click the blueprint name you created.
2. Select the tab Images.
3. Click Create Image to create your customized image. The Create Image window opens.
4. From the Type drop-down menu list, select QEMU Image(.qcow2).
5. Set the size that you want the image to be when instantiated and click Create.
6. A small pop-up on the upper right side of the window informs you that the image creation has been added to the queue. After the image creation process is complete, you can see the Image build complete status.

Procedure

1. Move the .qcow2 image that you created by using RHEL image builder to the /var/lib/libvirt/images/ directory.

2. Create a directory, for example, cloudinitiso and navigate to this newly created directory:

   $ mkdir cloudinitiso
   $ cd cloudinitiso

3. Create a file named meta-data. Add the following information to this file:

   instance-id: citest
   local-hostname: vmname

4. Create a file named user-data. Add the following information to the file:

   #cloud-config
   user: admin
   password: password
   chpasswd: {expire: False}
   ssh_pwauth: True
   ssh_authorized_keys:
     - ssh-rsa AAA...fhHQ== your.email@example.com

   ssh_authorized_keys is your SSH public key. You can find your SSH public key in ~/.ssh/<id_rsa.pub>\.

5. Use the genisoimage utility to create an ISO image that includes the user-data and meta-data files.

   # genisoimage -output cloud-init.iso -volid cidata -joliet -rock user-data meta-data
   
   I: -input-charset not specified, using utf-8 (detected in locale settings)
   Total translation table size: 0
   Total rockridge attributes bytes: 331
   Total directory bytes: 0
   Path table size(bytes): 10
   Max brk space used 0
   183 extents written (0 MB)

6. Create a new VM from the KVM Guest Image using the virt-install command. Include the ISO image you created on step 4 as an attachment to the VM image.

   # virt-install \
       --memory 4096 \
       --vcpus 4 \
       --name myvm \
       --disk rhel-9-x86_64-kvm.qcow2,device=disk,bus=virtio,format=qcow2 \
       --disk cloud-init.iso,device=cdrom \
       --os-variant rhel 9 \
       --virt-type kvm \
       --graphics none \
       --import

   • --graphics none - means it is a headless RHEL 9 VM.
   • --vcpus 4 - means that it uses 4 virtual CPUs.
   • --memory 4096 - means it uses 4096 MB RAM.

7. The VM installation starts:

   Starting install...
   Connected to domain mytestcivm
   ...
   [  OK  ] Started Execute cloud user/final scripts.
   [  OK  ] Reached target Cloud-init target.
   
   Red Hat Enterprise Linux 9 (Ootpa)
   Kernel 4.18.0-221.el8.x86_64 on an x86_64

1. Enter admin as a username and press Enter.

2. Enter password as password and press Enter.

   After the login authentication is complete, you have access to the VM using the CLI.

Procedure

1. Set up a registry-config.toml file to select the container provider. The credentials are optional.

   provider = "container_provider"
   [settings]
   tls_verify = false
   username = "admin"
   password = "your_password"

2. Create a blueprint in the .toml format. This is a blueprint for the container in which you install an nginx package into the blueprint.

   name = "simple-container"
   description = "Simple RHEL container"
   version = "0.0.1"
   [[packages]]
   name = "nginx"
   version = "*"

3. Push the blueprint:

   # composer-cli blueprints push blueprint.toml

4. Build the container image, by passing the registry and the repository to the composer-cli tool as arguments.

   # composer-cli compose start simple-container container "quay.io:8080/osbuild/repository" registry-config.toml

   • simple-container - is the blueprint name.
   • container - is the image type.

   • "quay.io:8080/osbuild/repository" - quay.io is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building. Optionally, you can set a tag. If you do not set a value for :tag, it uses :latest tag by default.

     Note

     Building the container image takes time because of resolving dependencies of the customized packages.

5. After the image build finishes, the container you created is available in quay.io.

Verification

1. Open quay.io. and click Repository Tags.

    You can see details about the container you created, such as:
   - last modified
   - image size
   - the `manifest ID`, that you can copy to the clipboard.

2. Copy the manifest ID value to build the image in which you want to embed a container.

Procedure

1. Create a blueprint to build a qcow2 image. The blueprint must contain the "" customization.

   name = "image"
   description = "A qcow2 image with a container"
   version = "0.0.1"
   distro = "rhel-90"
   [[packages]]
   name = "podman"
   version = "*"
   [[containers]]
   source = "registry.access.redhat.com/ubi9:8080/osbuild/container/container-image@sha256:manifest-ID-from-Repository-tag: tag-version"
   name =  "source-name"
   tls-verify = true

2. Push the blueprint:

   # composer-cli blueprints push blueprint-image.toml

3. Build the container image:

   # composer-cli start compose image qcow2

   • image is the blueprint name.

   • qcow2 is the image type.

     Note

     Building the image takes time because it checks the container on quay.io registry.

4. To check the status of the compose:

   # composer-cli compose status

   A finished compose shows the FINISHED status value. To identify your compose in the list, use its UUID.

5. After the compose process is finished, download the resulting image file to your default download location:

   # composer-cli compose image UUID

   Replace UUID with the UUID value shown in the previous steps.

   You can use the qcow2 image you created and downloaded to create a VM.

1. Start the qcow2 image in a VM. See Creating a virtual machine from a KVM guest image.

2. The qemu wizard opens. Login in to the qcow2 image.

   1. Enter the username and password. These can be the username and password you set up in the .qcow2 blueprint in the "customizations.user" section, or created at boot time with cloud-init.

3. Run the container image and open a shell prompt inside the container:

   # podman run -it registry.access.redhat.com/ubi9:8080/osbuild/repository /bin/bash/

   registry.access.redhat.com is the target registry, osbuild is the organization and repository is the location to push the container when it finishes building.

4. Check that the packages you added to the blueprint are available:

   # type -a nginx

   The output shows you the nginx package path.