Skip to content
This repository was archived by the owner on Nov 5, 2025. It is now read-only.

Commit df90e78

Browse files
tulilirockztulilirockz
committed
linuxmint: init image
Signed-off-by: Tulip Blossom <tulilirockz@proton.me>
0 parents  commit df90e78

11 files changed

Lines changed: 406 additions & 0 deletions

File tree

‎.github/renovate.json5‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:best-practices",
5+
],
6+
7+
"rebaseWhen": "never",
8+
9+
"packageRules": [
10+
{
11+
"automerge": true,
12+
"matchUpdateTypes": ["pin", "pinDigest"]
13+
},
14+
{
15+
"enabled": false,
16+
"matchUpdateTypes": ["digest", "pinDigest", "pin"],
17+
"matchDepTypes": ["container"],
18+
"matchFileNames": [".github/workflows/**.yaml", ".github/workflows/**.yml"],
19+
},
20+
]
21+
}

‎.github/workflows/build.yaml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
---
2+
name: Build container image
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
schedule:
8+
- cron: "05 10 * * *" # 10:05am UTC everyday
9+
push:
10+
branches:
11+
- main
12+
paths-ignore:
13+
- "**/README.md"
14+
workflow_dispatch:
15+
16+
env:
17+
IMAGE_DESC: "Experimental ubuntu-bootc POC image"
18+
IMAGE_KEYWORDS: "bootc,ubuntu"
19+
IMAGE_LOGO_URL: "https://avatars.githubusercontent.com/u/4604537?s=200&v=4"
20+
IMAGE_NAME: "${{ github.event.repository.name }}"
21+
IMAGE_REGISTRY: "ghcr.io/${{ github.repository_owner }}"
22+
DEFAULT_TAG: "latest"
23+
24+
concurrency:
25+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
26+
cancel-in-progress: true
27+
28+
jobs:
29+
build_push:
30+
name: Build and push image
31+
runs-on: ubuntu-24.04
32+
33+
permissions:
34+
contents: read
35+
packages: write
36+
id-token: write
37+
38+
steps:
39+
- name: Prepare environment
40+
run: |
41+
# Lowercase the image uri
42+
echo "IMAGE_REGISTRY=${IMAGE_REGISTRY,,}" >> ${GITHUB_ENV}
43+
echo "IMAGE_NAME=${IMAGE_NAME,,}" >> ${GITHUB_ENV}
44+
45+
# These stage versions are pinned by https://github.com/renovatebot/renovate
46+
- name: Checkout
47+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
48+
49+
- name: Get current date
50+
id: date
51+
run: |
52+
# This generates a timestamp like what is defined on the ArtifactHub documentation
53+
# E.G: 2022-02-08T15:38:15Z'
54+
# https://artifacthub.io/docs/topics/repositories/container-images/
55+
# https://linux.die.net/man/1/date
56+
echo "date=$(date -u +%Y\-%m\-%d\T%H\:%M\:%S\Z)" >> $GITHUB_OUTPUT
57+
58+
- name: Image Metadata
59+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5
60+
id: metadata
61+
with:
62+
tags: |
63+
type=raw,value=${{ env.DEFAULT_TAG }}
64+
type=raw,value=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
65+
type=raw,value={{date 'YYYYMMDD'}}
66+
type=sha,enable=${{ github.event_name == 'pull_request' }}
67+
type=ref,event=pr
68+
labels: |
69+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
70+
org.opencontainers.image.created=${{ steps.date.outputs.date }}
71+
org.opencontainers.image.description=${{ env.IMAGE_DESC }}
72+
org.opencontainers.image.documentation=https://raw.githubusercontent.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/refs/heads/main/README.md
73+
org.opencontainers.image.source=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}/blob/main/Containerfile
74+
org.opencontainers.image.title=${{ env.IMAGE_NAME }}
75+
org.opencontainers.image.url=https://github.com/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}
76+
org.opencontainers.image.vendor=${{ github.repository_owner }}
77+
org.opencontainers.image.version=${{ env.DEFAULT_TAG }}.{{date 'YYYYMMDD'}}
78+
io.artifacthub.package.deprecated=false
79+
io.artifacthub.package.keywords=${{ env.IMAGE_KEYWORDS }}
80+
io.artifacthub.package.license=Apache-2.0
81+
io.artifacthub.package.logo-url=${{ env.IMAGE_LOGO_URL }}
82+
io.artifacthub.package.prerelease=false
83+
containers.bootc=1
84+
sep-tags: " "
85+
sep-annotations: " "
86+
87+
- name: Build Image
88+
id: build_image
89+
uses: redhat-actions/buildah-build@7a95fa7ee0f02d552a32753e7414641a04307056 # v2
90+
with:
91+
containerfiles: |
92+
./Containerfile
93+
# Postfix image name with -custom to make it a little more descriptive
94+
# Syntax: https://docs.github.com/en/actions/learn-github-actions/expressions#format
95+
image: ${{ env.IMAGE_NAME }}
96+
tags: ${{ steps.metadata.outputs.tags }}
97+
labels: ${{ steps.metadata.outputs.labels }}
98+
oci: false
99+
100+
- name: Login to GitHub Container Registry
101+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3
102+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.actor }}
106+
password: ${{ secrets.GITHUB_TOKEN }}
107+
108+
- name: Push To GHCR
109+
uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
110+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
111+
id: push
112+
env:
113+
REGISTRY_USER: ${{ github.actor }}
114+
REGISTRY_PASSWORD: ${{ github.token }}
115+
with:
116+
registry: ${{ env.IMAGE_REGISTRY }}
117+
image: ${{ env.IMAGE_NAME }}
118+
tags: ${{ steps.metadata.outputs.tags }}
119+
username: ${{ env.REGISTRY_USER }}
120+
password: ${{ env.REGISTRY_PASSWORD }}
121+
122+
- name: Install Cosign
123+
uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
124+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
125+
126+
- name: Sign container image
127+
if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
128+
run: |
129+
IMAGE_FULL="${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}"
130+
for tag in ${{ steps.metadata.outputs.tags }}; do
131+
cosign sign -y --key env://COSIGN_PRIVATE_KEY $IMAGE_FULL:$tag
132+
done
133+
env:
134+
TAGS: ${{ steps.push.outputs.digest }}
135+
COSIGN_EXPERIMENTAL: false
136+
COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}

‎.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
cosign.key
2+
_build_*
3+
output
4+
_build-*/**

‎Containerfile‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
FROM docker.io/linuxmintd/mint22.1-amd64:latest
2+
3+
COPY files/37composefs/ /usr/lib/dracut/modules.d/37composefs/
4+
COPY files/ostree/prepare-root.conf /usr/lib/ostree/prepare-root.conf
5+
6+
ENV DEBIAN_FRONTEND=noninteractive
7+
8+
RUN apt update -y && \
9+
apt upgrade -y && \
10+
apt install -y libzstd-dev libssl-dev pkg-config curl git build-essential meson libfuse3-dev && \
11+
apt build-dep ostree -y
12+
13+
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
14+
15+
RUN --mount=type=tmpfs,dst=/tmp cd /tmp && \
16+
git clone https://github.com/ostreedev/ostree.git ostree && \
17+
cd ostree && \
18+
git submodule update --init --recursive && \
19+
env NOCONFIGURE=1 ./autogen.sh && \
20+
./configure \
21+
--prefix=/usr \
22+
--sysconfdir=/etc \
23+
--libdir=/usr/lib \
24+
--mandir=/usr/share/man \
25+
--infodir=/usr/share/info \
26+
--localstatedir=/var \
27+
--disable-silent-rules \
28+
--enable-gtk-doc \
29+
--with-curl \
30+
--with-openssl \
31+
--without-soup \
32+
--with-dracut=yesbutnoconf && \
33+
make && \
34+
make install && \
35+
cp -vf /usr/lib/libostree* /lib/$(arch)-linux-gnu
36+
37+
RUN --mount=type=tmpfs,dst=/tmp cd /tmp && \
38+
git clone https://github.com/bootc-dev/bootc.git bootc && \
39+
cd bootc && \
40+
git fetch --all && \
41+
git switch origin/composefs-backend -d && \
42+
/root/.cargo/bin/cargo build --release --bins && \
43+
install -Dpm0755 -t /usr/bin ./target/release/bootc && \
44+
install -Dpm0755 -t /usr/bin ./target/release/system-reinstall-bootc && \
45+
install -Dpm0755 -t /usr/bin ./target/release/bootc-initramfs-setup
46+
47+
RUN --mount=type=tmpfs,dst=/tmp cd /tmp && \
48+
git clone https://github.com/p5/coreos-bootupd.git bootupd && \
49+
cd bootupd && \
50+
git fetch --all && \
51+
git switch origin/sdboot-support -d && \
52+
/root/.cargo/bin/cargo build --release --bins --features systemd-boot && \
53+
install -Dpm0755 -t /usr/bin ./target/release/bootupd && \
54+
ln -s ./bootupd /usr/bin/bootupctl
55+
56+
RUN --mount=type=tmpfs,dst=/tmp cd /tmp && \
57+
git clone https://github.com/containers/composefs.git composefs && \
58+
cd composefs && \
59+
git fetch --all && \
60+
meson setup build --prefix=/usr --default-library=shared -Dfuse=enabled && \
61+
ninja -C build && \
62+
ninja -C build install
63+
64+
RUN apt install -y \
65+
dracut \
66+
podman \
67+
linux-image-generic \
68+
linux-firmware \
69+
systemd \
70+
btrfs-progs \
71+
e2fsprogs \
72+
xfsprogs \
73+
udev \
74+
cpio \
75+
zstd \
76+
binutils \
77+
dosfstools \
78+
conmon \
79+
crun \
80+
netavark \
81+
skopeo \
82+
dbus \
83+
fdisk \
84+
systemd-boot*
85+
86+
RUN cp /usr/bin/bootc-initramfs-setup /usr/lib/dracut/modules.d/37composefs
87+
88+
RUN echo "$(basename "$(find /usr/lib/modules -maxdepth 1 -type d | grep -v -E "*.img" | tail -n 1)")" > kernel_version.txt && \
89+
dracut --force --no-hostonly --reproducible --zstd --verbose --kver "$(cat kernel_version.txt)" "/usr/lib/modules/$(cat kernel_version.txt)/initramfs.img" && \
90+
cp /boot/vmlinuz-$(cat kernel_version.txt) "/usr/lib/modules/$(cat kernel_version.txt)/vmlinuz" && \
91+
rm kernel_version.txt
92+
93+
# If you want a desktop :)
94+
RUN apt install -y mint-meta-cinnamon
95+
96+
RUN cp -vf /usr/lib/libostree* /lib/$(arch)-linux-gnu
97+
98+
RUN tee /etc/containers/policy.json <<EOF
99+
{
100+
"default": [
101+
{
102+
"type": "insecureAcceptAnything"
103+
}
104+
]
105+
}
106+
EOF
107+
108+
RUN apt install -y xinit lightdm mate-terminal gnome-terminal flatpak vim mintsystem
109+
110+
# Alter root file structure a bit for ostree
111+
RUN mkdir -p /boot /sysroot /var/home && \
112+
rm -rf /var/log /home /root /usr/local /srv && \
113+
ln -s /var/home /home && \
114+
ln -s /var/roothome /root && \
115+
ln -s /var/usrlocal /usr/local && \
116+
ln -s /var/srv /srv
117+
118+
# Setup a temporary root passwd (changeme) for dev purposes
119+
# TODO: Replace this for a more robust option when in prod
120+
RUN usermod -p '$6$AJv9RHlhEXO6Gpul$5fvVTZXeM0vC03xckTIjY8rdCofnkKSzvF5vEzXDKAby5p3qaOGTHDypVVxKsCE3CbZz7C3NXnbpITrEUvN/Y/' root
121+
122+
# Necessary labels
123+
LABEL containers.bootc 1

‎Justfile‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
build-containerfile:
2+
sudo podman build \
3+
-t linuxmint-bootc:latest .
4+
5+
bootc *ARGS:
6+
sudo podman run \
7+
--rm --privileged --pid=host \
8+
-it \
9+
-e RUST_LOG=debug \
10+
-v /sys/fs/selinux:/sys/fs/selinux \
11+
-v /var/lib/containers:/var/lib/containers \
12+
-v /dev:/dev \
13+
-v /tmp:/data \
14+
--security-opt label=type:unconfined_t \
15+
linuxmint-bootc:latest bootc {{ARGS}}
16+
17+
generate-bootable-image:
18+
#!/usr/bin/env bash
19+
if [ ! -e /tmp/bootable.img ] ; then
20+
fallocate -l 20G /tmp/bootable.img
21+
fi
22+
just bootc install to-disk --composefs-native --via-loopback /data/bootable.img --filesystem ext4 --wipe
23+

‎LICENSE‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Copyright 2025 tulilirockz
2+
3+
Licensed under the Apache License, Version 2.0 (the "License");
4+
you may not use this file except in compliance with the License.
5+
You may obtain a copy of the License at
6+
7+
http://www.apache.org/licenses/LICENSE-2.0
8+
9+
Unless required by applicable law or agreed to in writing, software
10+
distributed under the License is distributed on an "AS IS" BASIS,
11+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
See the License for the specific language governing permissions and
13+
limitations under the License.

‎README.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Linux Mint Bootc
2+
3+
Experiment to see if Bootc could work on Linux Mint. It requires a lot of workarounds, though!
4+
5+
6+
## Building
7+
8+
In order to get a running ubuntu-bootc system you can run the following steps:
9+
```shell
10+
just build-containerfile # This will build the containerfile and all the dependencies you need
11+
just generate-bootable-image # Generates a bootable image for you using bootc!
12+
```
13+
14+
Then you can run the `bootable.img` as your boot disk in your preferred hypervisor.
15+
16+
# Fixes & Notes
17+
18+
A complete X11 session is a bit tricky to figure out, but if you want to get to the state the screenshot is in, follow these steps:
19+
20+
- `/tmp` is read only for some reason, do `mount -t tmpfs tmpfs /tmp` once your are on the image so that X11 can start up via the `.X11-UNIX` socket
21+
- Once you've created your user, with `useradd (name) && usermod -a -G sudo (name) && passwd (name)`, create your user's directories and add permissions to it (`chown (user):(user) /var/home/(user)`)
22+
- Start a TTY under that user, then write the following to `.xinitrc`: `dbus-run-session cinnamon-session`, running `startx` will work and you'll be dropped into a Cinnamon session like the desktop.
23+
- `mount /dev/vda2 /sysroot/boot` - You can mount the ESP under `/sysroot/boot` so that `bootc status` works.

‎cosign.pub‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEIaGOPFGPMwmfPHv7rPN6s6rcyFLx
3+
YaccPUbgEgOy4MD2d4y8LE2fFGOmu/UNdVRs62CacIlhOqRDS1bA142/Pw==
4+
-----END PUBLIC KEY-----

‎files/37composefs/bootc-initramfs-setup.service‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Copyright (C) 2013 Colin Walters <walters@verbum.org>
2+
#
3+
# This library is free software; you can redistribute it and/or
4+
# modify it under the terms of the GNU Lesser General Public
5+
# License as published by the Free Software Foundation; either
6+
# version 2 of the License, or (at your option) any later version.
7+
#
8+
# This library is distributed in the hope that it will be useful,
9+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
10+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
11+
# Lesser General Public License for more details.
12+
#
13+
# You should have received a copy of the GNU Lesser General Public
14+
# License along with this library. If not, see <https://www.gnu.org/licenses/>.
15+
16+
[Unit]
17+
DefaultDependencies=no
18+
ConditionKernelCommandLine=composefs
19+
ConditionPathExists=/etc/initrd-release
20+
After=sysroot.mount
21+
Requires=sysroot.mount
22+
Before=initrd-root-fs.target
23+
Before=initrd-switch-root.target
24+
25+
OnFailure=emergency.target
26+
OnFailureJobMode=isolate
27+
28+
[Service]
29+
Type=oneshot
30+
ExecStart=/usr/bin/bootc-initramfs-setup
31+
StandardInput=null
32+
StandardOutput=journal
33+
StandardError=journal+console
34+
RemainAfterExit=yes

0 commit comments

Comments
 (0)