Composefs changes #1915

Johan-Liebert1 · 2026-01-15T12:56:18Z

Most of this is in prep for #1913

Add option to reset soft reboot state
Don't soft-reboot automatically
Aligning with ostree API, now we only initiate soft-reboot if --apply
is passed to bootc update, bootc switch, else we only prepare the
soft reboot
Update image digest query format
After bootc/commit/49d753f996747a9b1f531abf35ba4e207cf4f020,
composefs-rs saves config in the format oci-config-sha256:.
Update to match the same
composefs/update: Handle --download-only flag
When --download-only is passed, only download the image into the
composefs repository but don't finalize it.
Conver the /run/composefs/staged-deployment to a JSON file and Add a
finalization_locked field depending upon which the finalize service will
either finalize the staged deployment or leave it as is for garbage
collection (even though GC is not fully implemented right now).
composefs/soft-reboot: Check for SELinux policy divergence
Until now while checking if a deployment is capable of being soft
rebooted, we were not taking into account any differences in SELinux
policies between the two deployments. This commit adds such a check
We only check for policy diff if SELinux is enabled

Some commits are split from #1913

gemini-code-assist

Code Review

This pull request introduces several enhancements to composefs functionality. It adds an option to reset the soft reboot state and modifies the soft reboot logic to align with the ostree API, where a soft reboot is only initiated if --apply is passed. Additionally, it updates the image digest query format to match recent changes in composefs-rs. The changes are well-structured and improve the consistency and usability of the soft reboot feature. My review includes a suggestion to refactor a part of the new reset_soft_reboot function to improve code clarity and maintainability.

crates/lib/src/bootc_composefs/soft_reboot.rs

Johan-Liebert1 · 2026-01-19T10:51:47Z

Setting up boot components seem to be failing in centos9, f42 with

Bootloader: grub
Installing bootloader via bootupd
error: boot data installation failed: installing component EFI: No such file or directory (os error 2)
error: Installing to disk: Installing bootloader: Failed to run command: Command {
    program: "bootupctl",
    args: [
        "bootupctl",
        "backend",
        "install",
        "--write-uuid",
        "--src-root",
        "/run/bootc/mounts/rootfs/ostree/deploy/default/deploy/3c393b017a7d9c64b3cab4c74372e0226024e26c15983479c3e70455ba0ac62a.0",
        "--device",
        "/dev/loop1",
        "/run/bootc/mounts/rootfs",
    ],
    create_pidfd: false,
}

Johan-Liebert1 · 2026-01-19T11:04:54Z

I guess #1926 is related

cgwalters · 2026-01-20T16:35:48Z

crates/lib/src/bootc_composefs/soft_reboot.rs

 const NEXTROOT: &str = "/run/nextroot";

+#[context("Resetting soft reboot state")]
+fn reset_soft_reboot() -> Result<()> {


I think functions like this should accept their global state, like Storage.

Feels a bit weird to have an argument when they don't use it. We could use run from the Storage, but we need to bind mount /run from host any to unmount nextroot, unless I'm missing something here

cgwalters · 2026-01-20T16:36:26Z

crates/lib/src/bootc_composefs/soft_reboot.rs

+
+    let Some(nextroot) = nextroot else {
+        tracing::debug!("Nextroot is not a directory");
+        println!("No deployment staged for soft rebooting");


Ideally we share these output messages between the two backends

That would be great, but afaik the implementation for soft reboot for ostree backend is in the ostree repo and not bootc. In the ostree path, we don't print anything if there is no deployment staged for soft rebooting. I have updated the final messages, i.e. soft reboot prep complete and soft reboot state reset messages, to match the ostree ones

cgwalters · 2026-01-20T16:37:39Z

crates/lib/src/bootc_composefs/update.rs


    if opts.soft_reboot.is_some() {
-        prepare_soft_reboot_composefs(storage, booted_cfs, &id.to_hex(), true).await?;
+        prepare_soft_reboot_composefs(storage, booted_cfs, Some(&id.to_hex()), true, false).await?;


Having more than one boolean value to functions I think leads to confusion as to what they mean. I think this can become an enum since they're mutually exclusive no?

I think this is from an older commit? I had changed this to an enum

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

Aligning with ostree API, now we only initiate soft-reboot if `--apply` is passed to `bootc update`, `bootc switch`, else we only prepare the soft reboot Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

After bootc/commit/49d753f996747a9b1f531abf35ba4e207cf4f020, composefs-rs saves config in the format `oci-config-sha256:`. Update to match the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

When `--download-only` is passed, only download the image into the composefs repository but don't finalize it. Conver the /run/composefs/staged-deployment to a JSON file and Add a finalization_locked field depending upon which the finalize service will either finalize the staged deployment or leave it as is for garbage collection (even though GC is not fully implemented right now). Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cgwalters · 2026-01-21T16:48:12Z

crates/lib/src/bootc_composefs/export.rs

+    // We want the digest in the form of "sha256:abc123"
+    let config_digest = format!("{}", imginfo.manifest.config().digest());


Hmm isn't this us losing type safety in that basically composefs-rs is using a different type alias for digests than exists in https://docs.rs/oci-spec/latest/oci_spec/image/struct.Digest.html ?

I think we could probably impl From<oci_spec::Digest> for composefs_rs::Sha256Digest or so?

Having to go through strings is definitely a big trap.

Hmm isn't this us losing type safety in that basically composefs-rs is using a different type alias for digests

I don't think that's the case, as composefs streams are now named as oci-layer-sha256:<digest>. The <digest> here is the same as the config digest. It's just that previously the streams were stored only as <digest> without the sha256: or any other prefix.

Maybe it'd be cleaner to export https://github.com/containers/composefs-rs/blob/6cbdb428b06d6121993c469337a57390c5895544/crates/composefs-oci/src/lib.rs#L31 from composefs-rs

cgwalters · 2026-01-21T16:49:06Z

crates/lib/src/bootc_composefs/soft_reboot.rs

+#[context("Resetting soft reboot state")]
+pub(crate) fn reset_soft_reboot() -> Result<()> {
+    let run = Utf8Path::new("/run");
+    bind_mount_from_pidns(PID1, &run, &run, true).context("Bind mounting /run")?;


I don't think this is necessary, we only need to do that when run under podman.

crates/lib/src/bootc_composefs/soft_reboot.rs

cgwalters · 2026-01-21T16:53:03Z

crates/lib/src/bootc_composefs/soft_reboot.rs

+        return Ok(());
+    }
+
+    unmount(NEXTROOT, UnmountFlags::DETACH).context("Unmounting nextroot")?;


Does this work though? We always enter a mount namespace, so this is where...ohhhh, I see that's why you did the bind mount of /run from the host mountns above.

And indeed I think we have similar code in ostree.

But...hmmm I think it'd be cleaner to avoid mutating global state this way - we could fork a child process that does the umount (look at similar code in bind_mount_from_pidns) or we could always pull in the real /run right after we do the re-exec to enter a new mountns.

we could always pull in the real /run right after we do the re-exec to enter a new mountns.

I think we do have an fd for /run in the pid/1 mount ns inside of global storage Struct, iirc. I might be imagining things though...

we could fork a child process that does the umount

wdyt about a function similar to bind_mount_from_pidns but it takes a lambda to run and only runs that instead of doing move_mount afterwards?

takes a lambda to run and only runs that

this would be in the forked child process

crates/lib/src/bootc_composefs/soft_reboot.rs

crates/lib/src/bootc_composefs/status.rs

crates/lib/src/bootc_composefs/update.rs

Until now while checking if a deployment is capable of being soft rebooted, we were not taking into account any differences in SELinux policies between the two deployments. This commit adds such a check We only check for policy diff if SELinux is enabled Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com> composefs: Refactor Add doc comments for StagedDeployment struct Use `serde_json::to_writer` to prevent intermediate string allocation Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cgwalters · 2026-01-22T19:19:42Z

crates/lib/src/bootc_composefs/status.rs

    return true;
 }

+const SELINUX_CONFIG_PATH: &str = "etc/selinux/config";


Let's split this out into a mod selinux. And while we're here...deduplicate with the similar code in composefs-rs

cgwalters · 2026-01-22T19:22:31Z

crates/lib/src/bootc_composefs/status.rs

+        let filename = entry.file_name();
+        let filename = filename
+            .to_str()
+            .ok_or_else(|| anyhow::anyhow!("Filename is not proper UTF-8"))?;


We can use Dir::entries_utf8 (probably have other places like this)

cgwalters · 2026-01-22T19:23:05Z

crates/lib/src/bootc_composefs/status.rs

+        if !filename.starts_with(POLICY_FILE_PREFIX) {
+            continue;
+        }
+
+        match filename.split_once(".") {


I think moving the . into the prefix then use filename.strip_prefix(POLICY_FILE_PREFIX) is more elegant

cgwalters · 2026-01-22T19:24:18Z

crates/lib/src/bootc_composefs/status.rs


-    return compare_cmdline_skip_cfs(depl_cmdline, booted_cmdline)
-        && compare_cmdline_skip_cfs(booted_cmdline, depl_cmdline);
+    return Ok(


Minor style personally I prefer

let r = <complex computation>; Ok(r)

in cases like this

cgwalters · 2026-01-22T19:26:06Z

crates/lib/src/bootc_composefs/status.rs

+        return Ok(None);
+    }
+
+    let selinux_config = deployment_root


Stuff below here is easily unit testable (again in the selinux mod) operating on a Dir without any booted bits etc

cgwalters · 2026-01-22T19:26:44Z

crates/lib/src/bootc_composefs/soft_reboot.rs

+#[context("Resetting soft reboot state")]
+pub(crate) fn reset_soft_reboot() -> Result<()> {
+    let run = Utf8Path::new("/run");
+    bind_mount_from_pidns(PID1, &run, &run, true).context("Bind mounting /run")?;


Can you add a comment like /// Note: By default bootc runs in an unshared mount namespace; this sets up our /runto actually be the same as the host/runso theumount below actually affects the host

Johan-Liebert1 requested a review from cgwalters January 15, 2026 12:56

gemini-code-assist bot reviewed Jan 15, 2026

View reviewed changes

crates/lib/src/bootc_composefs/soft_reboot.rs Show resolved Hide resolved

Johan-Liebert1 force-pushed the cfs-changes branch 2 times, most recently from 0193cf9 to 364e600 Compare January 19, 2026 09:25

cgwalters requested changes Jan 20, 2026

View reviewed changes

Johan-Liebert1 force-pushed the cfs-changes branch from 364e600 to ad5fa7f Compare January 21, 2026 05:14

Johan-Liebert1 added 4 commits January 21, 2026 08:04

composefs: Add option to reset soft reboot state

8c04825

Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

composefs: Don't soft-reboot automatically

cc61ac5

Aligning with ostree API, now we only initiate soft-reboot if `--apply` is passed to `bootc update`, `bootc switch`, else we only prepare the soft reboot Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

composefs/export: Update image digest query format

24c7c16

After bootc/commit/49d753f996747a9b1f531abf35ba4e207cf4f020, composefs-rs saves config in the format `oci-config-sha256:`. Update to match the same Signed-off-by: Pragyan Poudyal <pragyanpoudyal41999@gmail.com>

cgwalters force-pushed the cfs-changes branch from ad5fa7f to 3793354 Compare January 21, 2026 13:08

cgwalters self-assigned this Jan 21, 2026

jeckersb self-assigned this Jan 21, 2026

cgwalters reviewed Jan 21, 2026

View reviewed changes

Johan-Liebert1 force-pushed the cfs-changes branch from dcb44e8 to 709b25a Compare January 22, 2026 09:00

Johan-Liebert1 force-pushed the cfs-changes branch from 709b25a to bccc94c Compare January 22, 2026 10:36

Johan-Liebert1 requested a review from cgwalters January 22, 2026 10:37

cgwalters requested changes Jan 22, 2026

View reviewed changes

		// We want the digest in the form of "sha256:abc123"
		let config_digest = format!("{}", imginfo.manifest.config().digest());

Composefs changes #1915

Are you sure you want to change the base?

Composefs changes #1915

Uh oh!

Conversation

Johan-Liebert1 commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Johan-Liebert1 commented Jan 19, 2026

Uh oh!

Johan-Liebert1 commented Jan 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Johan-Liebert1 Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Johan-Liebert1 commented Jan 15, 2026 •

edited

Loading

Johan-Liebert1 Jan 21, 2026 •

edited

Loading