base: move to Fedora 43, add initial-setup for first-boot accounts
The F42 base reached end of support (its last kernel is dated
2026-05-08), which surfaced as an end-of-support error on the installed
system. Bumps the base and dnf's releasever pin to 43.
Not 44: satty, swww, zellij, starship, bottom, swayosd, and
bibata-cursor-theme have no F44 builds yet. Terra and all three COPRs
enable fine on 44, they just have not rebuilt. Revisit when they do.
The full package set was verified to depsolve on 43 (422 packages, no
unmatched names).
The other half is the reason the FW12 install had no way in. The bootc
Anaconda flow presents no user-creation spoke, so an install completed
with root locked, greeter set to nologin, and no loginable account at
all. initial-setup fixes that: it prompts for account creation on first
boot and disables itself once setup succeeds. Ordering is free, since
greetd carries Alias=display-manager.service and initial-setup declares
Before=display-manager.service and Before=getty-pre.target.
initial-setup-gui is deliberately not installed. Without the GUI binary
run-initial-setup takes the TUI branch even though default.target is
graphical.target, which is what a TUI-first distro wants.
The tty1 drop-in is load-bearing, not cosmetic. Fedora's unit sets
TTYPath=/dev/tty7 and run-initial-setup contains no chvt, so the prompt
would render to a VT nobody is watching and the machine would look hung
on a blank screen.
build/alloy-0.0.yaml stays the fedora-42 anaconda set: bib ships no
fedora-43.yaml, and the 42 set depsolves clean on 43 (894 packages).
Recorded in its header so the next bump rechecks instead of assuming.
Not verified on hardware. The first-boot path in particular is reasoned
from the unit file and the launcher script, not observed.
- Co-Authored-By
- Claude Opus 4.8 (1M context) <noreply@anthropic.com>
4 files changed,
+48 insertions,
-7 deletions
| 15 |
15 |
|
# =====================================================================
|
| 16 |
16 |
|
# Runtime image — the bootable container itself.
|
| 17 |
17 |
|
# =====================================================================
|
| 18 |
|
- |
FROM quay.io/fedora/fedora-bootc:42
|
|
18 |
+ |
FROM quay.io/fedora/fedora-bootc:43
|
| 19 |
19 |
|
|
| 20 |
20 |
|
# =====================================================================
|
| 21 |
21 |
|
# Third-party repos
|
| 145 |
145 |
|
# Greeter
|
| 146 |
146 |
|
greetd \
|
| 147 |
147 |
|
tuigreet \
|
|
148 |
+ |
# First-boot account creation. The bootc Anaconda flow offers no
|
|
149 |
+ |
# user-creation spoke, so without this an install completes with
|
|
150 |
+ |
# root locked, greeter set to nologin, and no way to log in.
|
|
151 |
+ |
# Deliberately NOT initial-setup-gui: with no GUI binary present
|
|
152 |
+ |
# run-initial-setup takes the TUI branch, which is what Alloy
|
|
153 |
+ |
# wants regardless of default.target being graphical.target.
|
|
154 |
+ |
# Retired when the Alloy installer replaces Anaconda (GO task).
|
|
155 |
+ |
initial-setup \
|
| 148 |
156 |
|
# Cursor, GTK theme
|
| 149 |
157 |
|
bibata-cursor-theme \
|
| 150 |
158 |
|
adw-gtk3-theme \
|
| 159 |
167 |
|
# =====================================================================
|
| 160 |
168 |
|
# Package removals — stock desktop pieces Alloy replaces
|
| 161 |
169 |
|
# =====================================================================
|
| 162 |
|
- |
# fedora-bootc:42 is minimal and probably ships none of these, but keep
|
|
170 |
+ |
# fedora-bootc:43 is minimal and probably ships none of these, but keep
|
| 163 |
171 |
|
# the remove line for safety in case the base grows. || true swallows
|
| 164 |
172 |
|
# the "package not installed" error path.
|
| 165 |
173 |
|
RUN dnf remove -y \
|
| 230 |
238 |
|
# repos — rpm-ostree package layering on the installed system, and
|
| 231 |
239 |
|
# bootc-image-builder's installer depsolve — needs this pinned to the
|
| 232 |
240 |
|
# actual base version, independent of Alloy's product version.
|
| 233 |
|
- |
RUN echo 42 > /etc/dnf/vars/releasever
|
|
241 |
+ |
RUN echo 43 > /etc/dnf/vars/releasever
|
| 234 |
242 |
|
|
| 235 |
243 |
|
# =====================================================================
|
| 236 |
244 |
|
# bootc validation — fails the build if the image isn't a valid
|
| 2 |
2 |
|
#
|
| 3 |
3 |
|
# Alloy re-brands os-release (ID=alloy, VERSION_ID=0.0), so bootc-image-builder
|
| 4 |
4 |
|
# looks up a distro def named "alloy-0.0" and ships none. This file is bib's own
|
| 5 |
|
- |
# fedora-42.yaml anaconda-iso package set verbatim (Alloy is Fedora 42 underneath);
|
| 6 |
|
- |
# build/build-image.sh bind-mounts it into the builder's defs directory.
|
|
5 |
+ |
# fedora-42.yaml anaconda-iso package set verbatim; build/build-image.sh
|
|
6 |
+ |
# bind-mounts it into the builder's defs directory.
|
|
7 |
+ |
#
|
|
8 |
+ |
# NOTE (2026-07-19): the base moved to fedora-bootc:43 but this is still the
|
|
9 |
+ |
# fedora-42 set, because bib ships no fedora-43.yaml (it has only fedora-40 and
|
|
10 |
+ |
# fedora-42). The 42 set was verified to depsolve clean on F43: 894 packages, no
|
|
11 |
+ |
# unmatched names. Recheck on the next base bump rather than assuming.
|
| 7 |
12 |
|
#
|
| 8 |
13 |
|
# Regenerate from a newer bib with:
|
| 9 |
14 |
|
# podman run --rm --entrypoint sh <bib-image> -c \
|
| 10 |
|
- |
# 'cat /usr/share/bootc-image-builder/defs/fedora-42.yaml'
|
| 11 |
|
- |
# then re-add this header.
|
|
15 |
+ |
# 'ls /usr/share/bootc-image-builder/defs/'
|
|
16 |
+ |
# podman run --rm --entrypoint sh <bib-image> -c \
|
|
17 |
+ |
# 'cat /usr/share/bootc-image-builder/defs/fedora-<N>.yaml'
|
|
18 |
+ |
# then re-add this header. This file retires with Anaconda if the Alloy
|
|
19 |
+ |
# installer lands (GO task a1d037f8).
|
| 12 |
20 |
|
anaconda-iso:
|
| 13 |
21 |
|
packages:
|
| 14 |
22 |
|
- aajohan-comfortaa-fonts
|
| 4 |
4 |
|
# units are enabled or disabled by default. Rationale for each entry:
|
| 5 |
5 |
|
#
|
| 6 |
6 |
|
# - greetd: boot lands on the tuigreet TUI on VT1.
|
|
7 |
+ |
# - initial-setup: first-boot account creation. greetd carries
|
|
8 |
+ |
# Alias=display-manager.service and initial-setup
|
|
9 |
+ |
# declares Before=display-manager.service, so it runs
|
|
10 |
+ |
# to completion before tuigreet takes the VT. It
|
|
11 |
+ |
# disables itself once setup succeeds. Without it an
|
|
12 |
+ |
# install has no loginable account at all.
|
| 7 |
13 |
|
# - tailscaled: opt-in only. Enrollment happens via `alloy tail`
|
| 8 |
14 |
|
# (see docs/CONTINUITY.md — Alloy does not phone home
|
| 9 |
15 |
|
# before the user says yes).
|
| 16 |
22 |
|
# a match fall through to /usr/lib/systemd/system-preset/ defaults.
|
| 17 |
23 |
|
|
| 18 |
24 |
|
enable greetd.service
|
|
25 |
+ |
enable initial-setup.service
|
| 19 |
26 |
|
|
| 20 |
27 |
|
disable tailscaled.service
|
|
1 |
+ |
# Put first-boot account creation on the console the user is looking at.
|
|
2 |
+ |
#
|
|
3 |
+ |
# Fedora's initial-setup.service sets TTYPath=/dev/tty7, and
|
|
4 |
+ |
# run-initial-setup contains no chvt, so nothing switches the active VT
|
|
5 |
+ |
# to it. After plymouth quits the console sits on tty1, which means the
|
|
6 |
+ |
# account prompt renders to a VT nobody is watching and the machine
|
|
7 |
+ |
# looks hung on a blank screen.
|
|
8 |
+ |
#
|
|
9 |
+ |
# tty1 is free at this point: initial-setup declares Before=getty-pre.target
|
|
10 |
+ |
# so no getty has spawned, and greetd (Alias=display-manager.service,
|
|
11 |
+ |
# Conflicts=getty@tty1.service) is held by Before=display-manager.service
|
|
12 |
+ |
# until initial-setup exits.
|
|
13 |
+ |
#
|
|
14 |
+ |
# Revisit if initial-setup ever grows its own VT handling, and drop this
|
|
15 |
+ |
# entirely when the Alloy installer replaces Anaconda.
|
|
16 |
+ |
|
|
17 |
+ |
[Service]
|
|
18 |
+ |
TTYPath=/dev/tty1
|