WingNews logo WingNews
top | item 47028152

(no title)

nikodunk | 14 days ago

This is based on bootc (bootable containers), so note that the OS build is described in a normal Dockerfile: https://github.com/pocketblue/pocketblue/blob/main/Container... which is then run by the Github action (or locally).

Very similar to how Universal Blue, Bazzite, Bluefin etc. build at https://github.com/ublue-os/bazzite (see their Containerfile), but for mobile.

Has a similar mission to https://postmarketos.org, but with a different build system AFAICT

discuss

order

exceptione|14 days ago

  > Dockerfile
nitpick: Containerfile. I mention it because people still think container==docker. I am sure the Fedora people focus on podman, as part of the Red Hat ecosystem. For a better dev experience they offer podman-bootc¹, which you will miss when using Docker. Personally I am convinced that we should steer people to podman instead of Docker.

1. https://docs.fedoraproject.org/en-US/bootc/getting-started/

curt15|14 days ago

Red Hat obviously wants to change people's vocabulary but "Dockerfile" is basically an industry-standard generic term by this point.

arianvanp|14 days ago

Are we really bringing OCI to freaking OS builds? Nothing about OCI is pleasant. A list of Tarballs is the most backwards boot format I can think of. Terrible for reproducibility. Terrible for security.

Boot images should be Dm-verity protected EROFS images. We should not be building new things on OCI. It's really mind-blowing to me that this is a new direction people who are supposed to be top of class OS builders are moving to as a direction.

They took the CoreOS dream and threw everything in the trash

looperhacks|14 days ago

How is OCI terrible for reproducibility and security? They are certainly more reproducible than what we had before. I haven't heard "Works on my machine for a long time". If you're talking about reproducible builds, there aren't any hard issues either that are directly caused by OCI images - except setting the clock correctly.

> Boot images should be Dm-verity protected EROFS images

Maybe I'm misunderstanding you - I gather that you think the boot images are distributed as OCI images? That's not the case, bootc is more about building the image, updating it and the overall structure. Booting an image built with bootc does not involve any container infrastructure (unless you start services that depend on containers, I guess - but that's deep in userspace). There's technically nothing preventing this from using verified read-only images.

exceptione|14 days ago

  > Dm-verity protected EROFS images
First time I hear about it. Playing the devils advocate: how does it improve over checksums + tarballs?