max / alloy

Hold alloy-nvidia to the gate the shipped image holds itself to The derived image ended on a bare `bootc container lint`, which reported three warnings that nothing read. That is the exact failure the shipped Containerfile records fixing on 2026-08-26, and it is worse here: astra installs and boots alloy-nvidia, not the Alloy underneath it, so a bar enforced on the base and not on the derivation is a bar that does not apply to the only machine that runs it. Measured on the first build that reached this step: /run/akmods and its lock, /run/dnf, akmods and dnf5 logs, the libdnf5 and akmods caches, and dnf's countme files. All payload on a machine that will never run akmods again -- the module is built at image time precisely because an installed bootc system cannot rebuild it. So the derivation gets the shipped image's sweep, plus the two akmods adds, and then the same --fatal-warnings --no-truncate gate. authselect is left alone because nothing here runs it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wvegQEzB5piwPowYQ3ZbV

Author: Max Johnson <me@maxj.phd> · 2026-09-04 21:23 UTC

Signed with PGP, not checked

Commit: 9f214549be00d8c82d6db060a4d8ada719d822bc

Parent: 218321a

1 file changed, +32 insertions, -1 deletion

M build/Containerfile.nvidia +32 -1

			@@ -98,4 +98,35 @@
98	98		RUN printf 'blacklist nouveau\noptions nouveau modeset=0\n' \
99	99		> /etc/modprobe.d/alloy-nvidia-blacklist.conf
100	100
101		-	RUN bootc container lint
	101	+	# The build host's leavings, on the same rule the shipped image applies to
	102	+	# itself. This step is why: the derived image builds a kernel module, which
	103	+	# means dnf, akmods and dracut all run here, and every one of them leaves
	104	+	# something behind.
	105	+	#
	106	+	# It matters more here than it looks. astra installs and boots THIS image, not
	107	+	# the Alloy underneath it, so a bar the shipped image enforces and this one does
	108	+	# not is a bar that does not apply to the only machine that runs it. Measured
	109	+	# 2026-09-04 on the first build that reached this far: /run/akmods, akmods and
	110	+	# dnf logs, the libdnf5 and akmods caches, and dnf's countme files, all of them
	111	+	# payload on a machine that will never run akmods again -- the module is built
	112	+	# here precisely because the installed system cannot rebuild it.
	113	+	#
	114	+	# Everything the shipped image sweeps, plus the two akmods adds. authselect is
	115	+	# not touched: this image runs no authselect, so its checksum is whatever the
	116	+	# base already validated.
	117	+	RUN set -eux; \
	118	+	find /run /tmp -mindepth 1 -maxdepth 1 -exec rm -rf {} + 2>/dev/null \|\| true; \
	119	+	rm -f /var/log/dnf5.log*; \
	120	+	rm -rf /var/lib/dnf /var/cache/libdnf5; \
	121	+	rm -rf /var/cache/akmods /var/log/akmods; \
	122	+	rm -f /var/cache/ldconfig/aux-cache; \
	123	+	echo "sweep: build-host caches, logs and /run content removed"
	124	+
	125	+	# The same gate the shipped image ends on, and for the same reason.
	126	+	#
	127	+	# `bootc container lint` alone stood here and reported three warnings that
	128	+	# nothing read, which is the exact failure the shipped Containerfile records
	129	+	# fixing on 2026-08-26: a detector whose output reaches no one is not a control.
	130	+	# A derived image is not a reason to keep a weaker gate -- it is the image that
	131	+	# boots.
	132	+	RUN bootc container lint --fatal-warnings --no-truncate