Chapter 15. System configuration

You can perform a dynamic reconfiguration of the base image configuration. For example, you can run the firewall-cmd --permanent command to achieve persistent changes across a reboot.

In the default configuration, first make the changes in the base image, then queue the changes without restarting running systems, and then simultaneously write to apply the changes to existing systems only in memory.

You can configure the /etc directory to be transient by using bind mounts. In this case, the etc directory is a part of the machine’s local root filesystem. For example, if you inject static IP addresses by using Anaconda kickstarts, they persist across upgrades.

A 3-way merge is applied across upgrades and each "deployment" has its own copy of /etc.

In the Push model, some workloads are implemented by tooling such as Ansible.

The rhel9/rhel-bootc container image includes the dnf package manager. You can use dnf for several use cases:

You can use the bootc-usr-overlay command to create a writable overlay filesystem for /usr directory. The dnf install writes to this overlay. You can use this feature for installing debugging tools. Note that changes will be lost on reboot.

You can add other storage packages to the host system.

Storage with bootc install You can use the bootc install to-disk command for flat storage configurations and bootc install to-filesytem command for more advanced installations. For more information see Advanced installation with to-filesystem.

The default images include the NetworkManager dynamic network control and configuration system, and bootc attempts to connect by using DHCP on every interface with a cable plugged in. You can apply a temporary network configuration, by setting up the /run/NetworkManager/conf.d directory.

However, if you need to use static addressing or more complex networking such as VLANs, bonds, bridges, teams, among others, you can use different ways. Regardless of the way you choose to configure networking, it results as a configuration for NetworkManager, which takes the form of NetworkManager keyfiles.

See the settings man page for a list of the properties that can be specified by using nmcli. Bash autocompletion is available.

The command generates three keyfiles for each interface: bond0, ens3, and ens2. You can use the generated output, add more settings or modify existing settings, and then commit the files into a container image.

ip=${ip}::${gateway}:${netmask}:${hostname}:${interface}:none:${nameserver}

ip=${ip}::${gateway}:${netmask}:${hostname}:${interface}:none:${nameserver}

Example:

ip=10.10.10.10::10.10.10.1:255.255.255.0:myhostname:ens2:none:8.8.8.8

ip=10.10.10.10::10.10.10.1:255.255.255.0:myhostname:ens2:none:8.8.8.8

The keyfiles must have the 600 root-only access permissions, otherwise NetworkManager ignores them.

To set a custom hostname for your system, modify the /etc/hostname file. You can set the hostname by using Anaconda, or with a privileged container.

Once you boot a system, you can verify the hostname by using the hostnamectl command.

If you are deploying to an environment that requires internet access by using a proxy, you need to configure services so that they can access resources as intended.

To do this, define a single file with required environment variables in your configuration, and to reference this by using systemd drop-in unit files for all such services.

/etc/example-proxy.env

# /etc/example-proxy.env
https_proxy="http://example.com:8080"
all_proxy="http://example.com:8080"
http_proxy="http://example.com:8080"
HTTP_PROXY="http://example.com:8080"
HTTPS_PROXY="http://example.com:8080"
no_proxy="*.example.com,127.0.0.1,0.0.0.0,localhost"

/usr/lib/systemd/system/bootc-fetch-apply-updates.service.d/99-proxy.conf

# /usr/lib/systemd/system/bootc-fetch-apply-updates.service.d/99-proxy.conf
[Service]
EnvironmentFile=/etc/example-proxy.env

Using the Podman systemd configuration, similarly add EnvironmentFile=/etc/example-proxy.env. You can set the configuration for proxy and environment settings of podman and containers in the /etc/containers/containers.conf configuration file as a root user or in the $HOME/.config/containers/containers.conf configuration file as a non-root user.