Presenters

Source

🚀 Fedora’s Bold Move: Bootable Containers for a Faster, More Reliable Future 🌐

Fedora is embarking on a fascinating and ambitious journey: transitioning to a system based on bootable containers. This isn’t your typical containerization – we’re not talking about running full operating systems inside containers. Instead, Fedora is reimagining how the entire root filesystem is managed and updated, and the implications are huge! Let’s dive into what this means and why it’s a game-changer.

🤔 What Are Bootable Containers in Fedora’s World?

Forget everything you think you know about containers. In this context, a “bootable container” refers to packaging the entire root filesystem of Fedora as a container image. Think of it as a pre-built, self-contained snapshot of the operating system.

Here’s the breakdown:

  • It’s the Root Filesystem: The core of the OS – all the packages, configuration files, and essential components – are bundled together.
  • Flexibility in Installation: Tools like “booty” handle the specifics of installing this container image onto the target system, including disk partitioning and bootloader configuration.
  • Kernel Remains Separate: Crucially, the Linux kernel itself isn’t included in the container image. This keeps things modular and allows for kernel updates to be handled separately. 💾

✨ The Benefits: Why is Fedora Doing This?

This shift isn’t just for the sake of change; it brings a host of compelling advantages:

  • 🚀 Improved Update Efficiency (Delta Updates): This is the big one. Instead of downloading entire updates, only the changed files are downloaded. This drastically reduces update sizes and speeds up the process. Imagine the impact on bandwidth and update times!
  • 🎯 Increased Reproducibility: The build process is becoming more deterministic and controlled, meaning updates are more predictable and reliable.
  • 🦾 Greater Flexibility: Developers and users gain more freedom to experiment with and customize the base operating system.

👨‍💻 Under the Hood: The Build Process Explained

So, how does Fedora actually create these bootable containers? Let’s break down the process:

  1. Conflux: The Build System: Fedora leverages Conflux, a powerful build system based on Tekton pipelines and running within Kubernetes. This ensures a controlled and reproducible build environment.
  2. Declarative YAML Configuration: YAML files define the packages included in the root filesystem. This promotes reproducibility and minimizes hidden dependencies.
  3. Intelligent Layering: The root filesystem is split into a significant number of layers (currently around 50-100). This is key to achieving those delta updates, but it introduces a tradeoff: more layers mean smaller downloads, but also more parallel downloads during the update process.
  4. The Steps:
    • Starts with a base Fedora image.
    • Copies Fedora source files and configuration.
    • Integrates RPM packages based on the YAML configuration.
    • Rebuilds the root filesystem.
    • Splits the root filesystem into those intelligent layers.
    • Creates the final OCI (Open Container Initiative) image.
    • Applies final tweaks and configurations.
  5. “Booty” for Installation: This tool handles the installation of the container image onto the target system.

🚧 Current Status and Challenges – The Road Ahead

While incredibly promising, this transition is a work in progress. Fedora faces some challenges:

  • Reproducibility Gaps: Certain areas still lack full reproducibility due to dependencies on OS3 and “the street.”
  • Network Dependency: The build process currently relies on network access, although offline builds are a priority.
  • “U J Drift”: Addressing issues related to user/group ID drift is ongoing.
  • Signing Evolution: Fedora is moving away from traditional GPG signing towards Cosign for enhanced security.
  • Performance Considerations: Balancing the benefits of smaller downloads with the overhead of parallel downloads due to the large number of layers remains a key consideration.

❓ Addressing Your Questions

During the presentation, some excellent questions were raised. Here’s a quick recap of the answers:

  • How Isolated are the Builds? Increasingly isolated, with a strong focus on creating fully offline builds.
  • Reproducibility: A top priority, although gaps remain.
  • Layer Count: Currently around 50-100, with potential for increase.

Fedora’s move to bootable containers is a bold and exciting step towards a more efficient, reliable, and flexible operating system. It’s a fascinating example of how containerization can be applied beyond traditional application deployment, fundamentally changing the way we manage and update our operating systems. Keep an eye on this space – it’s going to be a thrilling journey! 🌐

Appendix