Chapter 11. Creating root-level directories and symlinks at runtime with image mode for RHEL

Procedure

1. Create a transient-root-example.service service to create the directory with read an write permissions. In the following example, /etc/afs exists.

   [Unit]
   Description=Transient Root Example - Dynamic Mount Point Creation
   After=local-fs.target
   ConditionPathExists=/etc/afs
   DefaultDependencies=no
   
   [Service]
   Type=oneshot
   RemainAfterExit=yes
   MountFlags=slave
   # LIBMOUNT_FORCE_MOUNT2=always is required for mount command compatibility
   # See: https://github.com/util-linux/util-linux/issues/3171
   Environment=LIBMOUNT_FORCE_MOUNT2=always
   ExecStart=/usr/bin/bash -c "echo 'Transient root example: Detected /etc/afs, remounting root as read-write'; mount -o remount,rw /; mkdir -p /afs; echo 'Created /afs directory for AFS mount point'"
   
   [Install]
   WantedBy=multi-user.target

2. Add the following configuration to the ContainerFile:

   # Copy the systemd service unit that demonstrates dynamic mount point creation
   # The service will:
   # 1. Check for existence of /etc/afs (ConditionPathExists)
   # 2. Use MountFlags=slave for proper mount propagation
   # 3. Set LIBMOUNT_FORCE_MOUNT2=always for mount command compatibility
   # 4. Remount root as read-write and create /afs directory when triggered
   COPY transient-root-example.service /usr/lib/systemd/system/
   
   # Enable the service to start automatically on boot
   RUN systemctl enable transient-root-example.service

3. Enable the transient-ro option. During the container build process, create the following configuration to the /usr/lib/ostree/prepare-root.conf file inside the image to enable the feature:

   RUN echo -e '[root]\ntransient=true' >> /usr/lib/ostree/prepare-root.conf && \
       set -x; kver=$(cd /usr/lib/modules && echo *); dracut -vf /usr/lib/modules/$kver/initramfs.img $kver

   Note

   When making changes to the file system configuration, you must regenerate the initramfs image.

4. Build the bootc image with the transient root file system:

   $ podman build --cap-add SYS_ADMIN -t transient-root-ro:test .

   This adds the SYS_ADMIN capability that bootc might require for ostree operations during the build.

Verification

1. Verify that transient-ro = true configuration file was correctly set in the built image:

   $ podman run --rm transient-root-ro:test cat /usr/lib/ostree/prepare-root.conf

   You should see an output similar to the following:

   [root]
   transient-ro = true

2. On the running system, verify the runtime functionality:

   1. Boot the image.

   2. Create the /etc/afs test directory.

      $ sudo mkdir -p /etc/afs

   3. Restart the service to trigger dynamic mount point creation:

      $ systemctl restart transient-root-example.service

      The service remounts root as read-write and creates the /afs directory.

3. To test the functionality without a systemd service, create a test directory as root on the running system:

   $ sudo export LIBMOUNT_FORCE_MOUNT2=always
   $ sudo unshare -m -- /bin/sh -c 'mount -o remount,rw / && mkdir /transient-test'

4. Verify if the directory was created:

   $ sudo ls -d /transient-test /transient-test

5. Verify the read-only status for other processes by attempting to write to the root filesystem:

   $ touch /another-test-file
   touch: cannot touch '/another-test-file': Read-only file system