Chapter 3. Creating bootc compatible base disk images with bootc-image-builder

Procedure

1. Login to authenticate to registry.redhat.io:

   $ sudo podman login registry.redhat.io

2. Install the bootc-image-builder tool:

   $ sudo podman pull registry.redhat.io/rhel9/bootc-image-builder

Procedure

1. Optional: Create a config.toml to configure user access, for example:

   [[blueprint.customizations.user]]
   name = "user"
   password = "pass"
   key = "ssh-rsa AAA ... user@email.com"
   groups = ["wheel"]

2. Run bootc-image-builder. Optionally, if you want to use user access configuration, pass the config.toml as an argument.

   Note

   If you do not have the container storage mount and --local image options, your image must be public.

   1. The following is an example of creating a public QCOW2 image:

      $ sudo podman run \
          --rm \
          -it \
          --privileged \
          --pull=newer \
          --security-opt label=type:unconfined_t \
          -v ./config.toml:/config.toml \
          -v ./output:/output \
          -v /var/lib/containers/storage:/var/lib/containers/storage \ registry.redhat.io/rhel9/bootc-image-builder:latest \
          --type qcow2 \
          --config config.toml \
        quay.io/<namespace>/<image>:<tag>

   2. The following is an example of creating a private QCOW2 image:

      $ sudo podman run \
          --rm \
          -it \
          --privileged \
          --pull=newer \
          --security-opt label=type:unconfined_t \
          -v ./config.toml:/config.toml \
          -v ./output:/output \
          registry.redhat.io/rhel9/bootc-image-builder:latest \
          --type qcow2 \
          --config config.toml \
        quay.io/<namespace>/<image>:<tag>

      You can find the .qcow2 image in the output folder.

Procedure

1. Create a disk image from the bootable container image.

   • Configure the user details in the Containerfile. Make sure that you assign it with sudo access.
   • Build a customized operating system image with the configured user from the Containerfile. It creates a default user with passwordless sudo access.

2. Optional: Configure the machine image with cloud-init. See Injecting users and SSH keys by using cloud-init. The following is an example:

   FROM registry.redhat.io/rhel9/rhel-bootc:9.4
   
   RUN dnf -y install cloud-init && \
       ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && \
       rm -rf /var/{cache,log} /var/lib/{dnf,rhsm}

   Note

   You can also use cloud-init to add users and additional configuration by using instance metadata.

3. Build the bootable container image. For example, to deploy the image to an x86_64 AWS machine, use the following commands:

   $ podman build -t quay.io/<namespace>/<image>:<tag> .
   $ podman push quay.io/<namespace>/<image>:<tag> .

4. Use the bootc-image-builder tool to create an AMI from the bootc container image.

   $ sudo podman run \
     --rm \
     -it \
     --privileged \
     --pull=newer \
     -v $HOME/.aws:/root/.aws:ro \
     --env AWS_PROFILE=default \
     registry.redhat.io/rhel9/bootc-image-builder:latest \
     --type ami \
     --aws-ami-name rhel-bootc-x86 \
     --aws-bucket rhel-bootc-bucket \
     --aws-region us-east-1 \
   quay.io/<namespace>/<image>:<tag>

   Note

   The following flags must be specified all together. If you do not specify any flag, the AMI is exported to your output directory.

   • --aws-ami-name - The name of the AMI image in AWS
   • --aws-bucket - The target S3 bucket name for intermediate storage when you are creating the AMI

   • --aws-region - The target region for AWS uploads

     The bootc-image-builder tool builds an AMI image and uploads it to your AWS s3 bucket by using your AWS credentials to push and register an AMI image after building it.

Procedure

1. Optional: Create a config.toml to configure user access, for example:

   [[blueprint.customizations.user]]
   name = "user"
   password = "pass"
   key = "ssh-rsa AAA ... user@email.com"
   groups = ["wheel"]

2. Run bootc-image-builder. If you want to use user access configuration, pass the config.toml as an argument:

   $ sudo podman run \
       --rm \
       -it \
       --privileged \
       --pull=newer \
       --security-opt label=type:unconfined_t \
       -v /var/lib/containers/storage:/var/lib/containers/storage \
       -v ./config.toml:/config.toml \
       -v ./output:/output \
       registry.redhat.io/rhel9/bootc-image-builder:latest \
       --local \
       --type raw \
       --config config.toml \
     quay.io/<namespace>/<image>:<tag>

   You can find the .raw image in the output folder.