Skip to content

An experiment in building custom OSTree images based on Fedora Silverblue.

License

Notifications You must be signed in to change notification settings

ahgencer/ocitree

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

66 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Custom OSTree Images

Container Registry GitHub Stars Issues
Build Status License Community Built

ahgencer/ocitree provides customized container-native OSTree images based on Fedora Silverblue.

ahgencer/ocitree is an experiment in building custom distributions derived from Silverblue as simple Podman images. The images are automatically rebuilt nightly and pushed onto a container registry, which can then be used as an upstream remote for OSTree. It provides the regular Silverblue experience, plus:

  • Additional layered packages out-of-the-box.
  • Pre-enabled third-party repositories (such as from Copr or RPM Fusion).
  • The ability to run custom kernels, out-of-tree drivers, Ansible playbooks, etc.
  • Any other system modification you can imagine!

Interested? Here's how to get started.

FAQ

What are some possible security concerns with this project?

Currently, there are a few major security concerns surrounding this project:

  1. The images are not built on Fedora's trusted cloud infrastructure, rather using GitHub Actions. This puts the burden of trust on an opaque platform, as the owner of the infrastructure that builds the image ultimately decides what goes into it. We should always strive to promote more transparent software delivery strategies.

  2. The images are not signed in any way after they are built, meaning we have no way of protecting the image from being tampered with as it's being delivered to the end-user.

  3. The images are not built reproducibly. Currently, the Containerfile pulls in additional resources over the network, which are subject to link rot as well as to being quietly replaced with malicious versions (such as by a third-party attacker or a rogue developer).

Unfortunately, these concerns cannot be taken lightly; which is why the images built by the current pipeline should not be used on production systems (or even on systems that are networked with critical systems). Please be aware of the risks involved when testing out the images (especially ones that are not built by yourself, locally).

Getting started

Installation

Installation instructions, as well as instructions for building the images from source, can be found here.

What's inside the images?

Here's a list of everything you will find inside ahgencer/silverblue:

Component Source Description
Fedora Silverblue cgwalters/fedora-silverblue The base image. ahgencer/silverblue builds on the vanilla Silverblue experience.

Contributing

Found a bug or a missing feature? You can report it over at the issue tracker.

Creating your own fork of this repository is highly encouraged! Part of the reason this new container-based approach for creating OSTree images is so exciting is how easy it is. If you can think of anything you would have built or configured differently than ahgencer/ocitree, feel free to do it yourself!

That's also the rationale behind picking the Unlicense for this project. There are literally zero licensing conditions to use it. Go ahead and modify it to your heart's content!

License

This is free and unencumbered software released into the public domain.

Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.

You should have received a copy of the Unlicense along with this program. If not, please refer to https://unlicense.org.

About

An experiment in building custom OSTree images based on Fedora Silverblue.

Topics

Resources

License

Stars

Watchers

Forks

Packages