Skip to content

feat(ci): rootless CI #2496

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
inffy merged 2 commits into from
Jul 4, 2026
Merged

feat(ci): rootless CI #2496

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14a9541
feat(ci): rootless CI
renner0e Jul 3, 2026
15af900
chore: unset target-dir for container-storage-action
renner0e Jul 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 10 additions & 11 deletions .github/workflows/reusable-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,6 @@ jobs:
uses: ublue-os/container-storage-action@25e05be4948f77746938687877829d15c5038036
continue-on-error: true
with:
target-dir: /var/lib/containers
mount-opts: compress-force=zstd:2
loopback-free: '1'

Expand Down Expand Up @@ -157,7 +156,7 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
sudo -E $(command -v just) \
$(command -v just) \
repo_organization="${{ github.repository_owner }}" \
build \
--image "${MATRIX_BASE_NAME}" \
Expand All @@ -170,7 +169,7 @@ jobs:
shell: bash
id: cache-perms
run: |
sudo chmod 777 --recursive /var/tmp/buildah-cache-0
chmod 777 --recursive /var/tmp/buildah-cache-${UID}

- name: Write new DNF package cache
if: steps.setup-cache.outputs.allow_cache_write == 'true'
Expand All @@ -188,7 +187,7 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
sudo -E $(command -v just) rechunk \
$(command -v just) rechunk \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
Expand All @@ -207,7 +206,7 @@ jobs:
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
SYFT_CMD: ${{ steps.setup-syft.outputs.cmd }}
run: |
sudo -E $(command -v just) gen-sbom \
$(command -v just) gen-sbom \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}" \
Expand All @@ -221,7 +220,7 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
sudo -E $(command -v just) secureboot \
$(command -v just) secureboot \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
Expand All @@ -234,7 +233,7 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
sudo -E $(command -v just) export-oci \
$(command -v just) export-oci \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}"
Expand All @@ -260,7 +259,7 @@ jobs:
MATRIX_STREAM_NAME: ${{ matrix.stream_name }}
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
sudo -E $(command -v just) disk-image \
$(command -v just) disk-image \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}" \
Expand Down Expand Up @@ -309,7 +308,7 @@ jobs:
ALIAS_TAGS: ${{ steps.generate-tags.outputs.alias_tags }}
run: |
set -eoux pipefail
sudo -E $(command -v just) tag-images \
$(command -v just) tag-images \
--image "${IMAGE_NAME}" \
--default-tag "${MATRIX_STREAM_NAME}" \
--tags "${ALIAS_TAGS}"
Expand Down Expand Up @@ -346,7 +345,7 @@ jobs:
run: |
set -euox pipefail

sudo -E $(command -v just) push-image \
$(command -v just) push-image \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}" \
Expand Down Expand Up @@ -386,7 +385,7 @@ jobs:
run: |
set -euox pipefail

sudo -E $(command -v just) push-image \
$(command -v just) push-image \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \
--flavor "${MATRIX_IMAGE_FLAVOR}" \
Expand Down
2 changes: 2 additions & 0 deletions Justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -840,6 +840,8 @@ disk-image $image="aurora" $tag="latest" $flavor="main" ghcr="false" $backend="o
BOOTC_INSTALL_ARGS+=("--bootloader systemd" "--composefs-backend")
fi

{{ just }} load-rootful --image "${image}" --tag "${tag}" --flavor "${flavor}"

{{ just }} bootc "${image}" "${tag}" "${flavor}" install to-disk "${BOOTC_INSTALL_ARGS[@]}"

# FIXME: Please consider using podman push in the future for signing as well instead of temporary tag + cosign
Expand Down
Loading