Support rootless bootc-image-builder by alexlarsson · Pull Request #445 · osbuild/image-builder-cli

alexlarsson · 2026-01-28T16:12:46Z

This MR + a bootc-image-builder with this change:

diff --git a/bib/cmd/bootc-image-builder/main.go b/bib/cmd/bootc-image-builder/main.go
index be4b064..c6c3503 100644
--- a/bib/cmd/bootc-image-builder/main.go
+++ b/bib/cmd/bootc-image-builder/main.go
@@ -268,7 +268,7 @@ func cmdBuild(cmd *cobra.Command, args []string) error {
        runInVM, _ := cmd.Flags().GetBool("in-vm")
 
        logrus.Debug("Validating environment")
-       if err := setup.Validate(targetArch); err != nil {
+       if err := setup.Validate(targetArch, runInVM); err != nil {
                return fmt.Errorf("cannot validate the setup: %w", err)
        }
        logrus.Debug("Ensuring environment setup")

And a localhost/bootc-image-builder container built with osbuild 171 allows us to run a rootless podman container with b-c-i-b:

$ touch /tmp/foo
$ podman run --rm --security-opt label=type:unconfined_t -ti --privileged --network=none -v $PWD/output:/output -v ~/.local/share/containers/storage:/var/lib/containers/storage -v /tmp/foo:/var/lib/containers/storage/db.sql localhost/bootc-image-builder --progress verbose --rootfs ext4 --in-vm --type raw quay.io/fedora/fedora-bootc:43

Its unfortunate that we have to mount over the db.sql, but if we don't, then we get this error:

2026/01/28 16:09:01 error: cannot build manifest: failed to inspect the image: exit status 125, stderr:
Error: database static dir "/home/alex/.local/share/containers/storage/libpod" does not match our static dir "/var/lib/containers/storage/libpod": database configuration mismatch

I don't know how to avoid this. I tried exposing the user container store using additional image stores, but I ran into tons of issues with bc-i-b and osbuild hardcoding /var/lib/containers/storage, which means the additional image store is ignored. Maybe we can fix those, or maybe we can change podman to avoid this error. Or maybe we can do the workaround in the bootc-i-b setup code.

alexlarsson · 2026-01-28T16:35:17Z

Hmm, seems the /dev/loop workaround didn't work that way. I'll try hanging it off in-vm instead.

maboras-rh · 2026-01-28T16:36:39Z

pkg/setup/setup.go

 // Validate checks that the environment is supported (e.g. caller set up the
 // container correctly)
-func Validate(targetArch string) error {
+func Validate(targetArch string, inVm bool) error {


I noticed a missing unit-test in setup_test.go. Since the Validate method declaration has changed. I think the tests should be updated to cover this change.

There is no current test for this, but I can look at adding one.

It may be a bit tricky though, as it relies on checking global properties of the current sandbox.

Clear, thanks for clarification.

I'm looking at this, and it doesn't really seem useful/possible to unit test this in a reasonable way. Some individual functions it uses are tested , like validateCanRunTargetArch is tested by TestValidateCanRunTargetArch*, but the remaining parts need to have a complete container image built to test.

If we're running in a virtual machine, there is no need to mount /dev in the container (it will be mounted in the vm). This is important because in a rootless container we're not allowed to mount devtmpfs.

If in vm, we don't need --privileged. Also, we can also support rootless containers.

supakeen

Thank you.

achilleas-k

neat!

This updates to the latest image-builder-cli, adding support for rootless container use (osbuild/image-builder-cli#445). It also updates the use of related APIs to pass runInVm options where needed. With this, I was able to run a rootless bc-i-b conversion. There is one problem, which is that if you mount ~/.local/share/containers/storage on the host to /var/lib/containers/storage in the contained, podman will complain with: Error: database static dir "~/.local/share/containers/storage/libpod" does not match our static dir "/var/lib/containers/storage/libpod": database configuration mismatch Additionally, if you pass the host "/var/lib/containers/storage" into the rootless container you will get read permission errors. There are two workarounds for this. Either you can use e.g. skopeo to copy the bootc container to a separate (non-root) container storage directory and mount that, or you can cover the "db.sql" file in the storage directory to make podman not print the error. Neither of these are super clean, and we should try to figure out a better solution, but for now I was at least able to run a complete image build using: ``` $ touch /tmp/foo $ podman run --rm --security-opt label=type:unconfined_t -ti --privileged \ --network=none -v $PWD/output:/output \ -v ~/.local/share/containers/storage:/var/lib/containers/storage \ -v /tmp/foo:/var/lib/containers/storage/db.sql \ localhost/bootc-image-builder --in-vm \ --rootfs ext4 --type raw \ quay.io/fedora/fedora-bootc:43 ```

This updates to the latest image-builder-cli, adding support for rootless container use (osbuild/image-builder-cli#445). It also updates the use of related APIs to pass runInVm options where needed. With this, I was able to run a rootless bc-i-b conversion. There is one problem, which is that if you mount `~/.local/share/containers/storage` on the host to `/var/lib/containers/storage` in the container, podman will complain with: ``` Error: database static dir "~/.local/share/containers/storage/libpod" does not match our static dir "/var/lib/containers/storage/libpod": database configuration mismatch ``` Additionally, if you pass the host `/var/lib/containers/storage` into the rootless container you will get read permission errors. There are two workarounds for this. Either you can use e.g. skopeo to copy the bootc container to a separate (non-root) container storage directory and mount that, or you can cover the `db.sql` file in the storage directory to make podman not print the error. Neither of these are super clean, and we should try to figure out a better solution, but for now I was at least able to run a complete image build using the "cover db" apprach like this: ``` $ touch /tmp/foo $ podman run --rm --security-opt label=type:unconfined_t -ti --privileged \ --network=none -v $PWD/output:/output \ -v ~/.local/share/containers/storage:/var/lib/containers/storage \ -v /tmp/foo:/var/lib/containers/storage/db.sql \ localhost/bootc-image-builder --in-vm \ --rootfs ext4 --type raw \ quay.io/fedora/fedora-bootc:43 ```

alexlarsson requested a review from a team as a code owner January 28, 2026 16:12

alexlarsson requested review from croissanne, supakeen and thozza and removed request for a team January 28, 2026 16:12

maboras-rh reviewed Jan 28, 2026

View reviewed changes

alexlarsson added 2 commits January 28, 2026 17:39

setup: Don't mount devtmpfs if not needed

3ed2d55

If we're running in a virtual machine, there is no need to mount /dev in the container (it will be mounted in the vm). This is important because in a rootless container we're not allowed to mount devtmpfs.

setup: Add InVm option to Validate()

0a15328

If in vm, we don't need --privileged. Also, we can also support rootless containers.

alexlarsson force-pushed the rootless branch from 4c68cd4 to 0a15328 Compare January 28, 2026 16:45

supakeen self-assigned this Jan 28, 2026

supakeen approved these changes Jan 28, 2026

View reviewed changes

supakeen requested a review from achilleas-k January 29, 2026 11:44

achilleas-k approved these changes Jan 29, 2026

View reviewed changes

achilleas-k added this pull request to the merge queue Jan 29, 2026

Merged via the queue into osbuild:main with commit 81814bf Jan 29, 2026
45 checks passed

alexlarsson mentioned this pull request Jan 29, 2026

Support root-less containers with --in-vm osbuild/bootc-image-builder#1189

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support rootless bootc-image-builder#445

Support rootless bootc-image-builder#445
achilleas-k merged 2 commits intoosbuild:mainfrom
alexlarsson:rootless

alexlarsson commented Jan 28, 2026

Uh oh!

alexlarsson commented Jan 28, 2026

Uh oh!

maboras-rh Jan 28, 2026

Uh oh!

alexlarsson Jan 28, 2026

Uh oh!

alexlarsson Jan 28, 2026

Uh oh!

maboras-rh Jan 28, 2026 •

edited

Loading

Uh oh!

alexlarsson Jan 29, 2026

Uh oh!

supakeen left a comment

Uh oh!

achilleas-k left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

alexlarsson commented Jan 28, 2026

Uh oh!

alexlarsson commented Jan 28, 2026

Uh oh!

maboras-rh Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

alexlarsson Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

alexlarsson Jan 28, 2026

Choose a reason for hiding this comment

Uh oh!

maboras-rh Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexlarsson Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

supakeen left a comment

Choose a reason for hiding this comment

Uh oh!

achilleas-k left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

maboras-rh Jan 28, 2026 •

edited

Loading