Skip to content

chore(ci): remove docker compatibility + use buildah for build - #2380

Merged
inffy merged 1 commit into
ublue-os:mainfrom
renner0e:rm-docker-ci
Jun 13, 2026
Merged

chore(ci): remove docker compatibility + use buildah for build#2380
inffy merged 1 commit into
ublue-os:mainfrom
renner0e:rm-docker-ci

Conversation

@renner0e

@renner0e renner0e commented Jun 13, 2026

Copy link
Copy Markdown
Member

We are not using docker in CI and I don't think it's worth the complexity to keep (rather poorly) supporting builds with docker. Bootc and Fedora only test/use the podman/buildah ecosystem so we should probably do the same.

Docker prefixes images with docker.io instead of localhost like podman does if you don't specific a tag prefix, so we can drop those prefixes everywhere.

I'm sure that some things are already broken to some degree with docker as I don't use it at all to test the various recipes.

I'm keeping the PODMAN variable to make it easy to at least replace the path of the podman binary, compiling podman from source, homebrew...

@codacy-production

codacy-production Bot commented Jun 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

@renner0e renner0e added the cherry-pick used to backport commits to the stable branch label Jun 13, 2026
@renner0e
renner0e marked this pull request as ready for review June 13, 2026 16:30
@renner0e
chore(ci): remove docker compatibility + use buildah for build
4bf9d78 
We are not using docker in CI and I don't think it's worth the
complexity to keep (rather poorly) supporting builds with docker. Bootc
and Fedora only test/use the podman/buildah ecosystem so we should
probably do the same.

Docker prefixes images with docker.io instead of localhost like podman
does if you don't specific a tag prefix, so we can drop those prefixes
everywhere.

I'm sure that some things are already broken to some degree with docker
as I don't use it at all to test the various recipes.

I'm keeping the PODMAN variable to make it easy to at least replace the
path of the podman binary, compiling podman from source, homebrew...
@inffy
inffy added this pull request to the merge queue Jun 13, 2026
Merged via the queue into ublue-os:main with commit d029a02 Jun 13, 2026
8 checks passed
@aurora-backport

aurora-backport Bot commented Jun 13, 2026

Copy link
Copy Markdown

Successfully created backport PR for stable-f44:

@aurora-backport aurora-backport Bot mentioned this pull request Jun 13, 2026
Closed
@renner0e
renner0e deleted the rm-docker-ci branch June 13, 2026 21:04
renner0e added a commit that referenced this pull request Jun 13, 2026
@renner0e
chore: backport 2380 and 2386 (#2387)
0c8c181 
* chore(ci): remove docker compatibility + use buildah for build (#2380)

We are not using docker in CI and I don't think it's worth the
complexity to keep (rather poorly) supporting builds with docker. Bootc
and Fedora only test/use the podman/buildah ecosystem so we should
probably do the same.

Docker prefixes images with docker.io instead of localhost like podman
does if you don't specific a tag prefix, so we can drop those prefixes
everywhere.

I'm sure that some things are already broken to some degree with docker
as I don't use it at all to test the various recipes.

I'm keeping the PODMAN variable to make it easy to at least replace the
path of the podman binary, compiling podman from source, homebrew...

(cherry picked from commit d029a02)

* fix: build-chunked-oci --from image name (#2386)

fixup of d029a02. rpm-ostree needs the full reference.

(cherry picked from commit 82105df)
renner0e added a commit that referenced this pull request Jun 30, 2026
@renner0e @ubot-7274
@inffy @ledif
chore: promote changes to stable (#2474)
d367af8 
* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 47fe6aa (#2355)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* feat(ci): use chunkah for rechunking (#2349)

Chunkah is actively maintained and the algorithm seems to be more stable
for the layer plan which results in smaller sizes for weekly updates
compared to rpm-ostree. Although it looks like daily updates are
slightly bigger for the time being.

In the future there may be a way to consume previous build manifests as
well to further shrink down image sizes.

I am not deleting the old build-chunked-oci code yet, to make this PR
easier to revert in case we have to.

Rpm-ostree is basically the only blocker for rootless CI, which is
generally what we should be doing, PolP and all that. Now we only need
root privileges for bootc install. Althought to keep this PR more simple
I will implement this later.

It seems like bootc install needs more space now, not sure exactly why
that happens but seems to be related due to pruned /sysroot.

xref #2324

Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>

* chore(ci): use ubuntu-slim for check jobs (#2358)

We are just running a couple lines of bash here.

See: #1728

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 3222e2b (#2359)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 61fcd0a (#2364)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* feat(ci): add retries for registry logins (#2369)

The retry function is lifted straight from our base images [1].

Shold make CI flakes a little less likely [2] as seen in [3].

[1]: https://forge.fedoraproject.org/atomic-desktops/config/src/commit/8301eaad962065b653df30cce9658021df1c24f2/justfile#L33-L53
[2]: #2337
[3]: https://github.com/ublue-os/aurora/actions/runs/27338439302/job/80768647685

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 4528632 (#2373)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* feat(just): add composefs-backend option to disk-image (#2370)

This recipe doesn't actually work yet without any changes to the image
because we don't add the bootc module to the initramfs and don't install
systemd-boot.

This makes it easier to test the composefs native backend.

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to e6540a6 (#2366)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* fix(release): tag selection in changelogs.py (#2363)

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 18e3fa7 (#2376)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to b4a1ff3 (#2378)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore: misc cleanup (#2382)

* chore: simplify container pinning for common brew

This is just less complex and fully uses image-versions.yml

* make akmods_flavor a separate recipe

Helps in further splitting up the big monolith that is the build recipe.

* set right just group

* set full name for alpine image

* chore(ci): remove docker compatibility + use buildah for build (#2380)

We are not using docker in CI and I don't think it's worth the
complexity to keep (rather poorly) supporting builds with docker. Bootc
and Fedora only test/use the podman/buildah ecosystem so we should
probably do the same.

Docker prefixes images with docker.io instead of localhost like podman
does if you don't specific a tag prefix, so we can drop those prefixes
everywhere.

I'm sure that some things are already broken to some degree with docker
as I don't use it at all to test the various recipes.

I'm keeping the PODMAN variable to make it easy to at least replace the
path of the podman binary, compiling podman from source, homebrew...

* fix: build-chunked-oci --from image name (#2386)

fixup of d029a02. rpm-ostree needs the full reference.

* feat(ci): print staging and production digest to summary (#2388)

May help us when spotting [1].

[1]: #2377

* chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 0b10032 (#2390)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ae0ee5d (#2391)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* feat(ci): add more aggressive retries for pulling (#2394)

This should minimize the network flakes we run into when we have to pull
images as part of the many `FROM`s, the default is 3 tries with 2s
delay, which is really low.

I'm not 100% sure it will help us, let's just try it!

See: #2337

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 6f208c9 (#2397)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(backport-action): make the action fail if there is an error (#2393)

* chore(backport-action): make the action fail if there is an error

* change pr title to adhere to semantic pr rules

* feat(ci): increase dnf timeout to combat network flakes (#2401)

The default is 30s, let's see if this is already enough. Most packages
should usually be cached, it's the retrieval of metadata that is often
the reason for the network related flakes.

xref: #2337

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9636b35 (#2403)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 86fe5f3 (#2405)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 02dba7f (#2407)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(ci): use container-storage-action again (#2408)

I did some light testing regarding the variation of allocated space on /
and /mnt if present the other day and sadly there is still a very low
single-digit chance where our image build is just gonna fail because we
got the worst possible disk configuration with 20GB free and no
(additional) space on /mnt. This would at least address the cases where
we do have /mnt.

This came up again because we are using chunkah now which produces an
image where none of the layers with the base image are shared.

xref: #2337

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to d4b28ac (#2410)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore: make rpm-ostree status mandatory in issue template (#2418)

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ad44bfe (#2420)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* fix(ci): properly retry registry logins (#2417)

This is the right way to do this, credentials would be missing if we do
run into the case where we have to retry the login.

xref: #2337

* chore(deps): update actions/checkout action to v7 (#2414)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 7d8d7dc (#2423)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update softprops/action-gh-release digest to 718ea10 (#2424)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore: Revert "chore: delete bootc install config (#2426)

* chore: Revert "chore: delete bootc install config (#1568)"

This is one of the things we need for bcvk to work with our images.

This reverts commit 5f76360.

* chore: drop filesystem option for bootc install

* chore(ci): set pull=newer for build command (#2427)

This is probably the way we should be doing it instead of having a
separate pull, also works for the other images, mainly useful for akmods
and kinoite as we do not pin those by a digest. Which we should be doing
at some point.

In the future we probably want to have some kind of mechanism that
ensures that we are only pulling the blessed verified image (configuring
the runner environment with a policy).

Currently we are verifying the tag and then pulling the image a short
while later. This is not very likely to happen but leaves a couple
seconds of room where an untrusted image could be published that we
did not verify the authenticity of.

This ties a little bit into [1].

[1]: #2381

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to f351cca (#2428)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to ca24863 (#2430)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to f229dc0 (#2432)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 2fb4115 (#2433)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to aea17b2 (#2434)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to a2f9ca4 (#2438)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 1ffdff1 (#2441)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update actions/cache action to v6 (#2445)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 1975db5 (#2447)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 8f5a379 (#2451)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update ghcr.io/get-aurora-dev/common:latest docker digest to 34ef110 (#2453)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 91ffbf1 (#2455)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update actions/attest action to v4.1.1 (#2457)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update actions/cache action to v6.1.0 (#2459)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to b0ff866 (#2461)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* refactor(ci): initial work for using flag/arg-based workflow (#2443)

* refactor(ci): initial work for using flag/arg-based workflow

The goal of this is to make the buildsystem function like any other CLI
program. The only recipes I haven't touched in this PR are the very
simple recipes like verify-container, retag-nvidia-ghcr and
login-registry. In the future I want to split up this Justfile in
multiple smaller ones where it feels right to do that.

resolves: #2436

* document minimum just version

* build recipe

* feat: redo the way we do kernel pins

This allows an independent pinning of kernels for future ARM builds
regardless of x86. Probably the way we should have done it from the
beginning.

* get rid of build-ghcr and build-pipeline related things

We are not using the build-pipeline recipe anywhere right now. I think a
build-rechunk recipe is good enough for now.

I think build-ghcr doesn't make any sense anymore as it's now just a
single additional flag. The rechunk recipe with chunkah currently
doesn't alter any behavior when run in ghcr so we can delete this. But
this will likely change when chunkah implements some form of passing a
previous manifest.

I want to do a recipe at some point which replaces the general idea of
the pipeline recipe and is as close to github as possible. Build ->
Rechunk -> Secureboot-> tag + push an image to a local registry bootc
install.

* do deprecated build-chunked-oci recipe

* remove build-pipeline parts of ostree-rechunk

* export oci

* load rootful recipe

currently not used in CI as we are running everything as root.

* secureboot

* generate-point

* gen-sbom

* package cache

* bootc install

* some remaining shebangs

best practice to use env bash here instead

* push recipe

* redo generate-build-tags and tag-images

I removed the version input here. This has been broken for probably a
very long time, this didn't do anything for months at least, oldest log
I could find here:

```
Error: no such object: "aurora:latest"
Tags for this Action...
latest latest-43.20260424 latest-20260424 43 43-43.20260424 43-20260424
```

Kernel input is now done through just, so no reason to pass that, no
idea why we had that here in the first place.

* fix kernel pin for build-rechunk

This convenience recipe needs to take all the options from the build one

* chore(deps): update ghcr.io/ublue-os/brew:latest docker digest to 2b3b1e9 (#2463)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9abf432 (#2464)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to 9f2854d (#2467)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* fix(ci): add space in disk-image (#2469)

oopsie made in: cfd014f

* chore(deps): update korthout/backport-action action to v4.6.0 (#2470)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

* chore(deps): update quay.io/fedora-ostree-desktops/kinoite:44 docker digest to ce90f03 (#2472)

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>

---------

Co-authored-by: ubot-7274[bot] <217212047+ubot-7274[bot]@users.noreply.github.com>
Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>
Co-authored-by: Adam Fidel <ledif@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@inffy inffy inffy approved these changes
@NiHaiden NiHaiden Awaiting requested review from NiHaiden NiHaiden is a code owner
@ledif ledif Awaiting requested review from ledif ledif is a code owner

Assignees

No one assigned

Labels

cherry-pick used to backport commits to the stable branch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@renner0e @inffy