Bootable Containers? Why and how

Transcript

[music] >> Okay, so hi. Welcome to my presentation on bootable containers, the why and the how. So a bit about myself. I'm Roshan. I'm working at Red Hat on the Fedora CoreOS project and I use we use BootC extensively in our project. So I I mean, why not give a talk on this? So it's a CNCF sandbox project right now and yeah, let's see what what is BootC.

So as the name suggests, it's a bootable container. So for right now, when I say container, it's it means the Docker container or Podman container. Containers, they depict the people don't have the Linux kernel inside them. So what this while running containers, what happens is that we'll use the host host host operating systems Linux kernel and mount it there. But what what's happening with BootC containers is that it will contain a kernel and thereby since there's a kernel and there's a Linux file system inside the container, we could theoretically boot it.

So I guess you have a small idea on what how it works. So how it came out to be is that with this question. So what if you could use the same tooling that we use in the container space to create operating systems? So we could use this to create operating systems and we could host the operating systems on the container registries and we could also update the update the operating system using the container registries. And also this will give us some important features like atomicity where each update would be applied on its own without breaking system packages and this immutability.

So most of the things that are are read only which files, but you can write our our your personal data, configuration files, etc. And for the more tech savvy people, how it works is that on board the in the internal FS, there is some code which gets the container image and mounts it as the root and the kernel uses the pivot root stuff to get into it. So this is a rough diagram on how it works. So we have a container file and by container file I mean a Docker file and we call it container file and and what it does we could build a normal image using port man or Docker and then using that container image, the

special boot C container image, we could use image builder and create disk artifacts like ISO, QEMU, maybe cloud stuff and some other or we could do port man push or Docker push to push it to the container registry. So how it works is that you will get an ISO, live ISO to download which is generated by the same container image which is pushed into the container registry. So for for let's say example bare metal installation, you'll create an ISO using this image builder.

You will install it into your host operating system and for updates we'll use the same container registry that the container file is pushing pushing to. And this will work for local machines, virtual virtual machines, clouds and etc. So this is an example of a container file. You could say it's pretty much the same. The only only difference here is that we are deriving from a special base image which is a boot C image which has the kernel included by itself. So we don't have to do anything. And right now I'm installing Neo Vim and Firefox. And the last part is a linting operations.

We typically use it to catch errors errors and stuff like that. And you could for now now onwards I'll use Podman for building stuff. So, I just do Podman build. Normally give it a tag called Boot C example and that's it. We have the OS Boot C image ready. And this example show you how to create a QEMU artifact using image builder. So, using the same image container image we created earlier we could use this if you could look into it there's a CentOS Boot C Boot C image builder

image. We we are giving it argument of the container that we just created earlier. And then after a while maybe 15 20 minutes we'll get the QEMU outputted. And I'm using QEMU to run this. And there's it. There's a QEMU which we use we just installed Neovim and it's working as expected. So, after I quit out of Neovim when I do Boot C status you could see a booted image URL. So, I could see the registry that I have uploaded to. So, that's Arch Chandra Boot C example and

the digest that's that we are currently on. And now come how do we push updates to the thing? So, normally what we do is we will update the image that's in the that is in the container registry. It is the exact same process. We will right now let's this is just an example of how we upload to a container registry that is the same as everyone everywhere. And then about updating the container file. So, maybe I want to add Apache to the container. I'll just add Apache the httpd package and the system CTL enable httpd service that thing and after that I'll just create in I I I

built it once again. I will push it. And now when I boot into the machine, I could see when I do boot C status it's the same thing, but when I do boot C upgrade what it does is that it looks for the the image URL, I mean image tag and if there's a new update pushed with what will do it's pull the image and it will add it to add it I queue it for the next boot. So after you do a reboot it'll update the image would be updated. [clears throat] So after reboot this is this is what happened the you could see the sha sha version has been changed. Earlier it was to eight something

this now this. So these are the projects that are currently using boot C. So we got big players like Basite which is one of the more gaming focused distros that are currently available and then there's rail image mode and this of course the Fedora atomic family so that would include Fedora the gnome version the KDE version things like that and there's this upcoming thing called Armada OS that's mostly focused for gaming for pocket based devices so like the Rectroid Pocket Neo or something like that.

So we know how boot C works right now now let's go to a fun experiment. So I don't know if you guys know about this. So this used to be a meme back in the day it's called Hannah Montana Linux. So it's a fan fan fan distro made by someone and recently I came across a YouTube video where a guy just spotted all the stuff painstaking work to the KDE the newest KDE version. So this was this was like working on KDE 4.2 and this guy ported everything to the new version. So as a fun experiment let's try how we can build this using boot C.

So right now the project uses the Debian live build thing with the Calamaris installer and it uses the modern plasma and mostly it's just themes, custom icons, wallpapers and things like that. So it's easy and to understand how to do that. So this is how how we will do. We will get the Fedora Boot C image and inside the container file what we will do it we will copy the themes, the SDDM theme, the KDE theme, the custom icons, everything into the container file and then we'll just do port man build. And this is the only thing that we have to do. This is the container file for that.

This is some labels for so that people could understand what what it actually is. And this this actually shows that it's a bootable image. This containers dot boots equal to one. And this this install dot SH script and this configure dot SH script and here you could see this this special thing called root FS. So that is basically where all the icons things work. If I go back you could see I'm just copying this root FS to the root of the new container. So most of the [clears throat] themes are already in place. So if I go to user share KDE theme something like that there would be the theme that is supposed to be there.

So and in install dot SH it's just a list of things but we have to install. So it's the plasma the portal flat pack things like that. And mostly we do this so that we don't have to re while rebuilding we don't have to do anything re fetch and re download all the DNF files again. So and then there's the actual configure dot SH. It's very simple. You just copy the breeze theme.

You do HC OS release. You change it to Hannah Montana Linux enables network manager network manager SDDM Bluetooth things like that. And so set the default Plymouth theme to this thing. And then we profit. We got our custom boot image working as expected and yeah, there are some other cool features for this. So one one would be as I said atomic it's atomic so it's their transactional updates. So whenever we do an update we are essentially downloading a copy of an whole new file system. So it's very very easy to roll back and actually while booting it to it

you you could see in grub in which version you have to take. So this deployment number 0 1 2 3 4 and you could change how many deployments you have to do and this and the cool thing about this is that we could do something called boot C switch and what boot C switch is does is that you could change what the underlying image is. So for example there's something called Fedora atomic silver blue which is the gnome version for Fedora atomic. If you want to try out KD you could just change the URL to the KD one the Fedora atomic in keynote one and it will just work or if you want to change it to the one you could just switch it and it will work

and the there are some complicated stuff on how the configuration files are done. There's a three-way merge merge up between HC and stuff like that which is a bit complicated for this talk but rest assured your configs would be there. And these are some references is the YouTube video and also uploaded the [snorts and clears throat] the boot C version to my GitHub if you guys need to check out how it works and yeah any questions on this? No questions.

Okay uh