[4.0] Official Azure Linux 4.0 bootc base image (bootable container, atomic updates from an OCI registry)

[JayDoubleu]

Is your feature request related to a problem? Please describe.

Azure Linux 4.0 already packages bootc, ostree, rpm-ostree, bootupd and composefs, but there is no official bootable container image and no documented path to build one. Fedora publishes quay.io/fedora/fedora-bootc and CentOS quay.io/centos-bootc/centos-bootc; users derive their own images from those with a Containerfile, push them to any OCI registry, and machines update from the registry atomically with rollback. Azure Linux users cannot do that today without reverse-engineering the packaging gaps.

Describe the solution you'd like

An official Azure Linux 4.0 bootc base image on MCR, built and tested by the project, that follows the bootc image contract: kernel and initramfs under /usr/lib/modules/<kver>/, an empty /boot, the bootupd payload under /usr/lib/efi, the rpm database at /usr/share/rpm in rollback-journal mode, the composefs layout from bootc's reference files, and bootc container lint passing. With that image, a user builds a derived image with a Containerfile, installs it with bootc install to-disk, and updates it from a registry, the way Fedora CoreOS and Silverblue users do.

Describe alternatives you've considered

I built a working proof of concept on top of mcr.microsoft.com/azurelinux-beta/base/core:4.0 with the packages from the preview repo: https://github.com/JayDoubleu/azurelinux-bootc. It boots in QEMU on x86_64 and aarch64, updates and rolls back from a registry, verifies sigstore signatures with a policy in the image, splits the image into package-aligned layers with rpm-ostree compose build-chunked-oci so a version bump downloads about 1.5 MB, and runs the whole loop in GitHub Actions. The fixes it needed are the things an official image would settle once: move vmlinuz out of /boot, stage /boot/efi for bootupctl backend generate-update-metadata, add bubblewrap and grub2-pc-modules so bootc install works, move the rpm database to /usr/share/rpm and take it out of WAL mode so rpm -qa works on a read-only /usr, and the rpm-ostree upgrade bug in #18802. The decisions and measurements are in that repository's docs/.

Additional context

The same image model gives Azure Linux a simple story for VM images (bootc install to-disk, or bootc-image-builder for VHD), for people who host their own derived images on GitHub Container Registry and update fleets from them, and possibly for WSL2 distributions built from the same container image, though I have not tried that last one. The Containerfile and the test loop in the proof of concept are available for the project to reuse or adapt.

[eric-desrochers]

Thanks for the detailed proposal and proof of concept. This is a valuable feature request, and we’ll take it into consideration as we evaluate potential enhancements to the Azure Linux 4.0 experience.

At this point, we’re not making any commitment to implementing or supporting this capability, but the information you’ve provided will be helpful as part of our evaluation.