From Fedora Project Wiki

Modernize boot.iso

Summary

We will switch over production of the boot.iso from using lorax to image-builder modernizing the build of the deliverable while keeping functional parity.

Owner


Current status

Detailed Description

Over the past few Fedora releases we have slowly been moving deliverable production over to new image build tooling. Package based live media has moved onto kiwi. ostree-, and bootc-based artifacts have moved onto image-builder though some deliverables remain to be migrated in this area.

One of the important artifacts in Fedora is the boot.iso. This is the network installer that is shipped as the "Everything" network installer, or the "Server" network installer for Fedora Server edition.

This artifact is used in pungi and processed further into the dvd.iso (by embedding a compose's repositories into the boot.iso) and the Fedora Atomic installers (by embedding a compose's ostree commit into the boot.iso).

We would like to start producing the boot.iso with modern image build tooling.

image-builder is currently deployed in Fedora's Koji build system and can produce both the Everything and Fedora Server Edition boot.iso's. Thus for this effort we would like to switch over the pungi configuration to start using image-builder for these deliverables.

While image-builder definitions currently provide a boot.iso that is at parity we would like to also use this switch to address several concerns with the boot.iso media while keeping functional parity. This includes (less|no) usage of Lorax in the build process which might necessitate changes to packages and/or configuration (mostly in Anaconda).

Since the boot.iso media is used in many workflows both internal to Fedora and by users we have explicitly targeted Fedora 45 to give us enough time to discover any dragons that might appear.

We plan to switch over as early as possible after rawhide becomes Fedora 45 to give users and ourselves the maximum amount of time to find any regressions and address them.

Separately, any work on the Pungi side of things and the investigative work that will go into this will benefit other image build tooling such as kiwi to also be able to produce these deliverables in the future as these parts are shared. Having redundancy in our tooling (both image-builder and kiwi being able to build the same artifacts) is a great thing to have as it allows us to switch over the build backend when one or the other is having issues and reduces the risk of any complications affecting all deliverables.

Feedback

Benefit to Fedora

Changing the production of the boot.iso over to image-builder brings infrastructural benefits. It also allows users to easily build (customized) boot.iso's locally that match official Fedora deliverables and provides an easier way to produce derivatives and Fedora remixes that want to create boot.iso media using image-builder or kiwi.

Aside from this the process on how these deliverables are produced becomes more linear and simpler to understand.

Scope

  • Proposal owners: implement definitions (image-builder) and descriptions (kiwi) to build modernized boot.iso media. Update pungi configuration to make use of this (might imply changes to pungi itself as well).
  • Other developers: None.
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with the Fedora Strategy:

Upgrade/compatibility impact

Early Testing (Optional)

Users can test the current state of these artifacts by installing image-builder and building the deliverables as they are now: 

$ sudo dnf install image-builder
$ sudo image-builder build everything-network-installer

Note that several changes need to land upstream and thus these installers do not properly reflect the state that we want in Fedora, yet.

How To Test

Once the pungi configuration for rawhide has been changed to produce these deliverables with image-builder OpenQA will start testing these automatically.

Users can also start testing after this point. The tests would involve the usual requirements and criteria for the boot.iso.

Once the new deliverables are testable an announcement will be made on the mailinglist and discussion forum to get as many eyes on this as possible.

User Experience

The user experience of using the boot.iso media should not change in any functional way.

Dependencies

There are no dependencies on other changes. The owners of this proposal will likely need to perform work in pungi, the pungi configuration, and perhaps Anaconda.

We have explicitly targeted Fedora 45 to give us enough time to make these changes as they might have long(er) timeframes to land in Fedora.

If any critical changes are not able to land before Fedora 45 we will have the option to either pave over them in image-builder (for example, if configuration files need to be moved around, or directories need to be removed) or to trigger the contigency and defer to Fedora 46.

Contingency Plan

  • Contingency mechanism: Revert pungi configuration changes
  • Contingency deadline: Beta Freeze
  • Blocks release: Yes

Documentation

We've researched the minimum amount of changes that needs to be made to a filesystem tree of installed packages to produce a working Anaconda environment. In a future proposal this might be shipped as an RPM. For now we've opted to not ship this as an RPM as we have no good mechanism to make sure it doesn't get installed onto a normal system (bricking it in the process, or at least doing things that are very unwanted).

This involves the following steps:

Ensure the correct modules are in initramfs

By placing a dracut dropin configuration of the following form before installing RPMs into a given root an initramfs with the required modules for Anaconda is generated (for example /etc/dracut.conf.d/00-anaconda.conf). Alternatively image build tooling can regenerate the initramfs with the equivalent options. 

# dracut dropin configuration file for Anaconda boot.iso-style    
# media    
    
# general settings    
compress="xz"    
mdadmconf="no"    
lvmconf="no"    
    
# necessary initramfs modules on top of dracut-config-generic    
add_dracutmodules+=" pollcdrom "    
add_dracutmodules+=" qemu "    
add_dracutmodules+=" qemu-net "    
add_dracutmodules+=" net-lib "    
add_dracutmodules+=" dbus-broker "    
add_dracutmodules+=" biosdevname "    
add_dracutmodules+=" anaconda "    
add_dracutmodules+=" prefixdevname-tools "    
    
# remove systemd-gpt-auto-generator as it interferes with things    
# when booting the ISO as a disk image under UEFI, also remove     
# lvm2-activation-generator    
remove_items+=" usr/lib/systemd/system-generators/lvm2-activation-generator "    
remove_items+=" usr/lib/systemd/system-generators/systemd-gpt-auto-generator "    
EOF

Necessary Users

After that a set of users needs to be created. As a systemd-sysusers dropin that looks like this but other means of creating these users can be used by image build tooling.

Note that the root user and install user must *not* have a password. 

u install 0:0 "Anaconda Installer" /root /usr/libexec/anaconda/run-anaconda

Default Target

After that set the default target for the tree to be anaconda.target:

systemctl set-default-target anaconda

You can then proceed with the 'normal' shenanigans to turn this tree into an ISO.

Set SELinux to permissive

echo "SELINUXTYPE=permissive" > /etc/selinux/config

Write Buildstamp

TBD

Release Notes

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/ModernizeBootISO&oldid=778742"