UKIs and composefs support for Bootable Containers
summary
Using fs-verity plus a UKI hash, the UKI effectively signs and verifies every byte of a read‑only root tree via a Merkle hash chain; composefs separates file content from metadata so a single repository deduplicates files and hosts many OS images without reserving fixed image space (no dm‑verity images). The demo builds an OCI image from a Containerfile, computes the composefs hash, embeds a signed UKI (kept out of the image hash by excluding /boot), pushes to a registry and deploys with bootc — end‑to‑end boot with secure boot works, integration still lands from feature branches.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:07What is composefs
- 4:39EROFS role in composefs
- 6:05OverlayFS features
- 7:55composefs repositories
- 12:56Trusted boot chain with UKIs
- 15:27Bootable containers benefits
- 17:59Integrating composefs
- 21:39Building UKI image
- 23:05Installing bootable container
- 24:55Verifying secure boot
- 26:46composefs root filesystem
- 28:15Future plans
- 30:24Q&A
related talks
35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefs
43mTowards Secure Unified Kernel Images for Generic Linux Distributions and Every...
42mSecuring Filesystem Images for Unprivileged Containers
01h 05mImmutable and Stateless Systems with systemd
25mIntroduction to Bootable Containers
32mUniK: Unikernel Backend to Cloud Foundry
23mCreate your own custom Fedora IoT images
39mFlattened Image Trees: A Powerful Kernel uImage Format