Skip to main content

max / alloy

Containerfile: fix releasever + disable third-party repos for image-builder Two fixes that unblock bootc-image-builder (ISO/disk generation) and also correct the installed system: - Pin dnf $releasever to 42. Alloy's os-release carries VERSION_ID=0.0, so $releasever expanded to "0.0" and every Fedora repo request became fedora-0.0 (404) — breaking both the installer depsolve and any rpm-ostree package layering on a running system. - Disable terra, the Rust-Wayland COPRs, and Tailscale after the build installs. They are build-time-only for a bootc image (updates arrive as whole-image pulls), and their file:// GPG keys / metalinks can't be resolved in image-builder's depsolve environment, which reads every enabled repo.
Co-Authored-By
Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-18 03:24 UTC
Signed with PGP, not checked
Commit: 1c753b0de80bbe732dec9fa8f95b1d4b8dbc635f
Parent: 8a86b10
2 files changed, +30 insertions, -0 deletions
M .gitignore +3
@@ -12,6 +12,9 @@
12 12 /dist/*.qcow2
13 13 /dist/*.tar.zst
14 14
15 + # bootc-image-builder output (ISO/raw/qcow2 + manifest)
16 + /output/
17 +
15 18 # Environment
16 19 .env
17 20 .env.*
M Containerfile +27
@@ -211,6 +211,33 @@
211 211 # os-release, plymouth splash, wallpapers ship via the config tree
212 212 # above. No additional layer needed here.
213 213
214 + # =====================================================================
215 + # Disable third-party repos post-install.
216 + # =====================================================================
217 + # terra, the Rust-Wayland COPRs, and Tailscale are needed only at
218 + # build time to layer packages Fedora doesn't carry. Left enabled they
219 + # earn nothing at runtime (a bootc image updates by whole-image pull,
220 + # not per-package dnf) and actively break bootc-image-builder: its
221 + # installer depsolve reads every enabled repo but runs in its own
222 + # environment, where these repos' file:// GPG keys and metalinks can't
223 + # be resolved. Disable them so only the Fedora repos remain live; the
224 + # already-installed packages are unaffected.
225 + RUN sed -i 's/^enabled=1/enabled=0/; s/^enabled_metadata=1/enabled_metadata=0/' \
226 + /etc/yum.repos.d/terra.repo \
227 + /etc/yum.repos.d/tailscale.repo \
228 + /etc/yum.repos.d/_copr:*.repo
229 +
230 + # =====================================================================
231 + # Pin dnf's $releasever to the Fedora base version.
232 + # =====================================================================
233 + # Alloy's os-release carries its own VERSION_ID (0.0), so dnf/librepo
234 + # would otherwise expand $releasever to "0.0" and request the
235 + # nonexistent fedora-0.0 repo (404). Every consumer of the Fedora
236 + # repos — rpm-ostree package layering on the installed system, and
237 + # bootc-image-builder's installer depsolve — needs this pinned to the
238 + # actual base version, independent of Alloy's product version.
239 + RUN echo 42 > /etc/dnf/vars/releasever
240 +
214 241 # =====================================================================
215 242 # bootc validation — fails the build if the image isn't a valid
216 243 # bootable container.