2.3. Equivalence between blueprint customizations and Containerfile customizations

distro = "rhel-10."

FROM rhel-bootc:10

[[packages]]

name = "openssh-server" version = "8.*"

RUN dnf install <package name>

[[groups]]

name = "anaconda-tools"

RUN dnf group install <group_name>

[[containers]]

source = "quay.io/rhel/rhel:latest"

RUN podman pull docker.io/library/postgres:alpine

[customizations.kernel]

name = "kernel-debug" append = "nosmt=force"

RUN mkdir -p /usr/lib/bootc/kargs.d RUN cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["console=ttyS0,114800n8","kernel-debug"] match-architectures = ["x86_64"] EOF

[customizations.rhsm.config.dnf_plugins.product_id]

enabled = true [customizations.rhsm.config.dnf_plugins.subscription_manager]

enabled = true [customizations.rhsm.config.subscription_manager.rhsm]

manage_repos = true [customizations.rhsm.config.subscription_manager.rhsmcertd]

auto_registration = true

COPY ./rhsm.conf /etc/rhsm/rhsm.conf

[customizations.rpm.import_keys]

files = [ "/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-18-primary", "/etc/pki/rpm-gpg/RPM-GPG-KEY-fedora-19-primary" ]

RUN mkdir -p /etc/pki/rpm-gpg/ COPY <host_path>/gpg_key /etc/pki/rpm-gpg//gpg_key

[[customizations.sshkey]]

user = "root" key = "PUBLIC SSH KEY"

# SSH keys COPY test.pub container_key.pub RUN mkdir -p .ssh && \ cat container_key.pub >> .ssh/authorized_keys && \ chmod 600 .ssh/authorized_keys && \ rm -f container_path_to_key.pub

[customizations.timezone]

timezone = "US/Eastern" ntpservers = ["0.north-america.pool.ntp.org", "1.north-america.pool.ntp.org"]

RUN ln -sf /usr/share/zoneinfo/Asia/Bangkok /etc/localtime

[customizations.locale]

languages = ["en_US.UTF-8"] keyboard = "us"

RUN cat <<`EOF` >> /etc/locale.conf LANG="en_US.UTF-8" EOF && \ cat <<`EOF` >> /etc/vconsole.conf KEYMAP=us EOF

[customizations.firewall]

ports = ["22:tcp", "80:tcp", "imap:tcp", "53:tcp", "53:udp", "30000-32767:tcp", "30000-32767:udp"]

RUN dnf install -y firewalld && \ dnf clean all && \ firewall-offline-cmd --new-zone=customzone && \ firewall-offline-cmd --zone=customzone --set-description="Custom firewall rules for the container" && \ firewall-offline-cmd --zone=customzone --add-service=ftp && \ firewall-offline-cmd --zone=customzone --add-service=ntp && \ firewall-offline-cmd --zone=customzone --add-service=dhcp && \ firewall-offline-cmd --zone=customzone --add-port=22/tcp && \ firewall-offline-cmd --zone=customzone --add-port=80/tcp && \ firewall-offline-cmd --zone=customzone --add-port=53/tcp && \ firewall-offline-cmd --zone=customzone --add-port=53/udp && \ firewall-offline-cmd --zone=customzone --add-port=30000-32767/tcp && \ firewall-offline-cmd --zone=customzone --add-port=30000-32767/udp && \ firewall-offline-cmd --set-default-zone=customzone

[[customizations.directories]]

path = "/etc/<dir-name>" mode = "0755" user = "root" group = "root" ensure_parents = false

#Directory: RUN mkdir /etc/<dir> RUN chown -R admin:wheel /etc/<dir> && \ chmod -R 644 /etc/<dir> #Files: RUN touch /etc/<myfile> RUN chown :widget /etc/<myfile> && \ chmod 600 /etc/<myfile>

[customizations]

installation_device = "/dev/sda"

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["inst.device=/dev/sda"] EOF

[customizations.ignition.embedded]

config = "eyJpZ25pdG…​.xIn1dfX0="

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/console.toml kargs = ["ignition.config.url=http://192.168.122.1/fiot.ign","rd.neednet=1"] EOF

[customizations.fdo]

manufacturing_server_url = "http://192.168.122.199:8080" diun_pub_key_insecure = "true" di_mfg_string_type_mac_iface = "enp2s0"

RUN dnf install -y fdo-init fdo-client && \ systemctl enable fdo-client-linuxapp.service

[customizations.openscap]

datastream = "/usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml" profile_id = "xccdf_org.ssgproject.content_profile_cis"

[customizations.openscap.json_tailoring] profile_id = "<name-of-profile-used-in-json-tailoring>-file" filepath = "/some/path/tailoring-file.json"

[[customizations.files]] path = "/the/path/tailoring-file.json" data = "<json-tailoring-file-contents>"

RUN dnf install -y openscap-utils && \ autotailor --output /some/path/tailoring-file.json \ --new-profille-id xccdf_org.ssgproject.content_profile_cis

[customizations]

fips = true

RUN mkdir -p /usr/lib/bootc/kargs.d && \ cat <<`EOF` >> /usr/lib/bootc/kargs.d/01-fips.toml kargs = ["fips=1"] EOF && \ update-crypto-policies --no-reload --set FIPS