Dockerfile.cfsuki

# Override via --build-arg=base=<image> to use a different base
ARG base=localhost/bootc
FROM $base AS base

FROM base as kernel
RUN <<EORUN
set -xeuo pipefail
. /usr/lib/os-release
case $ID in
  centos|rhel)
    dnf config-manager --set-enabled crb
    # Enable EPEL for sbsigntools
    dnf -y install epel-release
    ;;
esac
dnf -y install systemd-ukify sbsigntools
EORUN
# Must be passed
ARG COMPOSEFS_FSVERITY
RUN --network=none \
    --mount=type=secret,id=secureboot_key \
    --mount=type=secret,id=secureboot_cert \
    --mount=type=bind,from=base,target=/target \
     <<EOF
    set -xeuo pipefail

    # Should be generated externally
    test -n "${COMPOSEFS_FSVERITY}"

    cmdline="composefs=${COMPOSEFS_FSVERITY} console=ttyS0,115200n8 console=hvc0 enforcing=0 rw"

    # Use sbsign to re-sign the entire UKI with our key
    kver=$(cd /target/usr/lib/modules && echo *)
    ukify build \
        --linux "/target/usr/lib/modules/$kver/vmlinuz" \
        --initrd "/target/usr/lib/modules/$kver/initramfs.img" \
        --uname="${kver}" \
        --cmdline "${cmdline}" \
        --os-release "@/target/usr/lib/os-release" \
        --signtool sbsign \
        --secureboot-private-key "/run/secrets/secureboot_key" \
        --secureboot-certificate "/run/secrets/secureboot_cert" \
        --measure \
        --json pretty \
        --output "/boot/$kver.efi"
EOF

FROM base as final
RUN --network=none --mount=type=bind,from=kernel,target=/run/kernel <<EOF
set -xeuo pipefail
kver=$(cd /usr/lib/modules && echo *)
mkdir -p /boot/EFI/Linux
# We put the UKI in /boot for now due to composefs verity not being the
# same due to mtime of /usr/lib/modules being changed
target=/boot/EFI/Linux/$kver.efi
cp /run/kernel/boot/$kver.efi $target
# And remove the defaults
rm -v /usr/lib/modules/${kver}/{vmlinuz,initramfs.img}
# Symlink into the /usr/lib/modules location
ln -sr $target /usr/lib/modules/${kver}/$(basename $kver.efi)
bootc container lint --fatal-warnings
EOF

FROM base as final-final
COPY --from=final /boot /boot
# Override the default
LABEL containers.bootc=sealed