Making changes to bootc systems

We’ve created our first system but there are a few things that might be missing we typically do to our systems. Not requiring a password every time we use sudo might be something we allow admins to do. We may also need to put notices on logins or present info in the MOTD. Let’s make some changes to how the system behaves. While we’re at it, lets update the index page too.

First, let’s set up a directory structure that mimics /etc and create the files we need inside it. This allows us to add all the configs at once with a single command and in a single layer of the image.

Since the motd file lives in the top level of /etc, that one command creates all the paths we need for this exercise. RHEL supports drop-in directories for several services and applications, including sudo privileges.

Drop-in support lets us add a file to a <servicename>.d directory rather than editing the main configuration file. You might already be familiar with drop-in config files from working with Apache and it’s /etc/httpd/conf.d/ directory. Using drop-in files lets us affect the configuration of a system, without needing to edit a file in place, or carry a full configuration file in the image.

Let’s address the sudoers password first, by allowing users in the wheel group to not need to enter their password.

Add the following and save the file

And let’s provide a message of the day!

Add the following and save the file

Now that we have our new configs, we can add them to the Containerfile and rebuild the image.

If you aren’t familiar, the ADD directive has some extra capabilities over the COPY command. Where COPY only works on a single file, ADD can work on complete directories or even unpack tar files. This can be very useful when dealing with multiple files and directories that all start from the same place, but could make the Containerfile a little opaque if folks are unfamiliar with the syntax and the results.

We rebuild the image with our updates the same way we originally built it.

And make sure to push it to the registry:

We now have replaced the original image in the registry we used to create the virtual machine with a new image. This is the standard workflow for making changes to an image mode host. All of our updates, additions, or changes are done via the build systems we use, and are then published to be used by the hosts. We’ll talk more about updates and how to differentiate them in a later exercise.

The virtual machine you have created in the previous exercise should still be running. You can check this with:

And the output should list the virtual machine called qcow-vm as running.

Now you can ssh into the virtual machine:

The bootc update command will download and prepare a detected update for use at the next boot. This means updates are offline, and can be applied at any time. Changes will only take effect when the system reboots.

(Reminder, the password for sudo is LB1054!)

Notice that bootc update provides information about the layers that have been modified and a progress indicator. The update mechanism also uses container tools to pull the image from the registry to the host for preparation. This means we only pull down the layers that were changed, not the full image if not needed. Later versions of bootc will expand this idea of delta updated to further reduce the time and bandwidth used for updates.

The final output should look something like this:

Let’s check the current status of the host.

Updates to bootc hosts are offline in nature, meaning the new image has been readied for deployment, but no other changes have been made to the running system.

The last step for the change to take is to reboot the virtual machine. Before doing so, please make sure you are logged in to the virtual machine and not the hypervisor, the prompt should look like [core@localhost ~]$.

After a short wait, log back into the system and and you should see the message of the day after logging in successfully.

We can check on our sudoers policy change as well. You shouldn’t be prompted for a password for any sudo commands since the user is in the wheel group.

What about the change to the index page?

The new text doesn’t appear, and it’s also not in the file on disk. This is expected based on how bootc handles directories and image contents during changes.

Stay logged into the VM to explore how bootc manages file updates in the next module.