ahgencer/ocitree provides customized container-native OSTree images based on Fedora Silverblue.
ahgencer/ocitree is an experiment in building custom distributions derived from Silverblue as simple Podman images. The images are automatically rebuilt nightly and pushed onto a container registry, which can then be used as an upstream remote for OSTree. It provides the regular Silverblue experience, plus:
- Additional layered packages out-of-the-box.
- Pre-enabled third-party repositories (such as from Copr or RPM Fusion).
- The ability to run custom kernels, out-of-tree drivers, Ansible playbooks, etc.
- Any other system modification you can imagine!
Interested? Here's how to get started.
Currently, there are a few major security concerns surrounding this project:
-
The images are not built on Fedora's trusted cloud infrastructure, rather using GitHub Actions. This puts the burden of trust on an opaque platform, as the owner of the infrastructure that builds the image ultimately decides what goes into it. We should always strive to promote more transparent software delivery strategies.
-
The images are not signed in any way after they are built, meaning we have no way of protecting the image from being tampered with as it's being delivered to the end-user.
-
The images are not built reproducibly. Currently, the Containerfile pulls in additional resources over the network, which are subject to link rot as well as to being quietly replaced with malicious versions (such as by a third-party attacker or a rogue developer).
Unfortunately, these concerns cannot be taken lightly; which is why the images built by the current pipeline should not be used on production systems (or even on systems that are networked with critical systems). Please be aware of the risks involved when testing out the images (especially ones that are not built by yourself, locally).
Installation instructions, as well as instructions for building the images from source, can be found here.
Here's a list of everything you will find inside ahgencer/silverblue:
| Component | Source | Description |
|---|---|---|
| Fedora Silverblue | cgwalters/fedora-silverblue | The base image. ahgencer/silverblue builds on the vanilla Silverblue experience. |
Found a bug or a missing feature? You can report it over at the issue tracker.
Creating your own fork of this repository is highly encouraged! Part of the reason this new container-based approach for creating OSTree images is so exciting is how easy it is. If you can think of anything you would have built or configured differently than ahgencer/ocitree, feel free to do it yourself!
That's also the rationale behind picking the Unlicense for this project. There are literally zero licensing conditions to use it. Go ahead and modify it to your heart's content!
This is free and unencumbered software released into the public domain.
Anyone is free to copy, modify, publish, use, compile, sell, or distribute this software, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.
You should have received a copy of the Unlicense along with this program. If not, please refer to https://unlicense.org.