internal/exec/stages/files: add x-initrd.attach for LUKS on ostree

On ostree systems, soft-reboot fails with LUKS because systemd tears down
the crypto device during shutdown. Unlike traditional systems where the
kernel root mount prevents this, ostree's /sysroot is a regular mount.

Add x-initrd.attach to crypttab entries on ostree systems (detected via
/run/ostree-booted or OSTREE_BOOTED=1 env var). This tells systemd-
cryptsetup-generator to skip adding Conflicts=umount.target, preventing
device teardown.

Non-ostree systems are unchanged.

Fixes: #2216

Author: prestist

docs/release-notes.md

@@ -14,6 +14,8 @@ nav_order: 9
 
 ### Bug fixes
 
+- Add `x-initrd.attach` to crypttab entries on ostree systems to fix soft-reboot with LUKS ([#2219](https://github.com/coreos/ignition/pull/2219))
+
 
 ## Ignition 2.26.0 (2026-02-17)
 

internal/exec/stages/files/filesystemEntries.go

@@ -33,6 +33,37 @@ import (
 	"github.com/vincent-petithory/dataurl"
 )
 
+// isOstreeSystem checks if the system is running ostree by checking for
+// the presence of /run/ostree-booted. This marker file is created by
+// ostree during boot. Also supports OSTREE_BOOTED=1 environment variable
+// for testing.
+func isOstreeSystem(ostreeBootedPath string) bool {
+	if os.Getenv("OSTREE_BOOTED") == "1" {
+		return true
+	}
+	_, err := os.Stat(ostreeBootedPath)
+	return err == nil
+}
+
+// buildCrypttabOptions constructs the options suffix for a crypttab entry.
+// It adds _netdev if network is needed and x-initrd.attach on ostree systems.
+// The x-initrd.attach option prevents systemd-cryptsetup-generator from adding
+// Conflicts=umount.target, which is necessary for soft-reboot to work correctly
+// on ostree systems where /sysroot is not the kernel root mount.
+func buildCrypttabOptions(hasNetworkDev, isOstree bool) string {
+	var options []string
+	if hasNetworkDev {
+		options = append(options, "_netdev")
+	}
+	if isOstree {
+		options = append(options, "x-initrd.attach")
+	}
+	if len(options) == 0 {
+		return ""
+	}
+	return "," + strings.Join(options, ",")
+}
+
 // createCrypttabEntries creates entries inside of /etc/crypttab for LUKS volumes,
 // as well as copying keyfiles to the sysroot.
 func (s *stage) createCrypttabEntries(config types.Config) error {
@@ -55,17 +86,19 @@ func (s *stage) createCrypttabEntries(config types.Config) error {
 			Mode: cutil.IntToPtr(0600),
 		},
 	}
+
+	// Detect if we're on an ostree system
+	// Check the host's /run directory, not the target sysroot
+	isOstree := isOstreeSystem("/run/ostree-booted")
+
 	extrafiles := []filesystemEntry{}
 	for _, luks := range config.Storage.Luks {
 		out, err := exec.Command(distro.CryptsetupCmd(), "luksUUID", util.DeviceAlias(*luks.Device)).CombinedOutput()
 		if err != nil {
 			return fmt.Errorf("gathering luks uuid: %s: %v", out, err)
 		}
 		uuid := strings.TrimSpace(string(out))
-		netdev := ""
-		if len(luks.Clevis.Tang) > 0 || cutil.NotEmpty(luks.Clevis.Custom.Pin) && cutil.IsTrue(luks.Clevis.Custom.NeedsNetwork) {
-			netdev = ",_netdev"
-		}
+		hasNetworkDev := len(luks.Clevis.Tang) > 0 || cutil.NotEmpty(luks.Clevis.Custom.Pin) && cutil.IsTrue(luks.Clevis.Custom.NeedsNetwork)
 		keyfile := "none"
 		if !luks.Clevis.IsPresent() {
 			keyfile = filepath.Join(distro.LuksRealRootKeyFilePath(), luks.Name)
@@ -91,7 +124,8 @@ func (s *stage) createCrypttabEntries(config types.Config) error {
 				},
 			})
 		}
-		uri := dataurl.EncodeBytes([]byte(fmt.Sprintf("%s UUID=%s %s luks%s\n", luks.Name, uuid, keyfile, netdev)))
+		options := buildCrypttabOptions(hasNetworkDev, isOstree)
+		uri := dataurl.EncodeBytes([]byte(fmt.Sprintf("%s UUID=%s %s luks%s\n", luks.Name, uuid, keyfile, options)))
 		crypttab.Append = append(crypttab.Append, types.Resource{
 			Source: &uri,
 		})