[Bug] Maybe official atomic-desktop-gnome-amd64.iso ships with broken bootc update policy

[diogopessoa]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When installing the official atomic-desktop-gnome-amd64.iso image, available in the AlmaLinux Atomic Desktop GitHub repository, it was not possible to update the system (bootc) because the container signature policy is defective.

The ISO installs AlmaLinux Atomic Desktop GNOME version:

10.1.20260321.1

After installation, running bootc update fails with:

error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage

Installation source

The system was installed from the official ISO:

atomic-desktop-gnome-amd64.iso

The ISO was downloaded from the AlmaLinux Atomic Desktop GitHub repository.

Steps to reproduce

1. Install AlmaLinux Atomic Desktop GNOME using the official:

   atomic-desktop-gnome-amd64.iso
   

2. Log in to the installed system.

3. Run:

   sudo bootc update

4. Observe:

   error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage
   

Original installed deployment

Booted image: quay.io/almalinuxorg/atomic-desktop-gnome:latest
Digest: sha256:22cbc7dbde1bada31729f1cde8359a519fece18f5184cb1419b08277d73ee671
Version: 10.1.20260321.1

Relevant policy

The installed /etc/containers/policy.json contained:

{
  "default": [
    {
      "type": "insecureAcceptAnything"
    }
  ],
  "transports": {
    "docker": {
      "quay.io/almalinuxorg/atomic-desktop-gnome": [
        {
          "type": "sigstoreSigned",
          "keyPaths": [
            "/etc/pki/containers/atomic-desktop-gnome.pub",
            "/etc/pki/containers/atomic-sig-backup.pub"
          ],
          "signedIdentity": {
            "type": "matchRepository"
          }
        }
      ]
    }
  }
}

Workaround

The issue was resolved by rebasing to a newer image:

sudo bootc switch quay.io/almalinuxorg/atomic-desktop-gnome

After the rebase, the system booted successfully and the newer deployment was:

Booted image: quay.io/almalinuxorg/atomic-desktop-gnome
Digest: sha256:fbb56140f5b2b95b3386d48164665922b7a2cf8569af7271b6362fd3ac39c38a
Version: 10.2.20260808.1

The resulting deployments were:

● ostree-unverified-registry:quay.io/almalinuxorg/atomic-desktop-gnome
  Version: 10.2.20260808.1

  ostree-image-signed:docker://quay.io/almalinuxorg/atomic-desktop-gnome:latest
  Version: 10.1.20260321.1

Expected behavior

A system installed from the official ISO should be able to update with:

sudo bootc update

without requiring a manual rebase.

Suggested resolution

Please consider:

1. Publishing a newer atomic-desktop-gnome-amd64.iso.

2. Updating the ISO to install the current image.

3. Correcting the default container policy in the ISO so that it does not use:

   "type": "insecureAcceptAnything"

Additional information

The current bootc status after the workaround was:

StateRoot: default
Deploy serial: 0
Staged: no
Commit: 80832a097ec22f02981406a1f39133a10e14085d24f4721c95f914a154f94e05
Soft-reboot: yes

Environment:

Distribution: AlmaLinux Atomic Desktop GNOME
Architecture: amd64
Initial image version: 10.1.20260321.1
Current image version: 10.2.20260808.1

Expected Behavior

No response

Steps To Reproduce

No response

Anything else?

No response

Search terms

bootc, bootc-update, atomic-desktop-gnome, containers-policy

[alexiri]

I've built a new ISO, can you give it a shot?

https://almalinux-atomic.s3-accelerate.dualstack.amazonaws.com/atomic-desktop/latest/atomic-desktop-gnome-amd64.iso

[diogopessoa]

I've built a new ISO, can you give it a shot?

https://almalinux-atomic.s3-accelerate.dualstack.amazonaws.com/atomic-desktop/latest/atomic-desktop-gnome-amd64.iso

I downloaded and installed the image above on the VM, but the same issue persists when trying to update the system:

❯ sudo bootc update      
error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage

other information:

 systemctl status bootc-fetch-apply-updates.timer --no-pager
bootc-fetch-apply-updates.timer - Apply bootc updates
     Loaded: loaded (/usr/lib/systemd/system/bootc-fetch-apply-updates.timer; disabled; preset: disabled)
     Active: active (waiting) since Sat 2026-08-15 16:32:13 -03; 3min 39s ago
 Invocation: 7ecf5d6a0c574abca75a936fc029fbbd
    Trigger: Sat 2026-08-15 18:15:56 -03; 1h 40min left
   Triggers: \u25cf bootc-fetch-apply-updates.service
       Docs: man:bootc(8)

Aug 15 16:32:13 localhost systemd[1]: Started bootc-fetch-apply-updates.timer - Apply bootc updates.

~ 

 sudo bootc status -v                                       
 Booted image: quay.io/almalinuxorg/atomic-desktop-gnome:latest
        Digest: sha256:fbb56140f5b2b95b3386d48164665922b7a2cf8569af7271b6362fd3ac39c38a (amd64)
       Version: 10.2.20260808.1 (2026-08-15T10:17:16Z)
     StateRoot: default
 Deploy serial: 0
        Staged: no
        Commit: 1361bdb72b6263046704bf45ca632c9f06484d16c544ce616d1f044572561871
     Signature: container-policy
   Soft-reboot: yes

Are you able to update without issues after installing from the ISO image?

[diogopessoa]

Is this bug report relevant?

• insecureAcceptAnything ublue-os/cosmic#14

This part caught my attention:
"we need to do is include the ublue key and policy.json in this image. This image is deriving right from Fedora so it doesn't have our key in it, so it's not going to rebase to a signed image. (...)"

[diogopessoa]

Just to emphasize, when I performed the rebase to the same AlmaLinux image, bootc update started working normally again:

sudo bootc switch quay.io/almalinuxorg/atomic-desktop-gnome:latest

Confirm switch to 'quay.io/almalinuxorg/atomic-desktop-gnome:latest'? (y/N): y
Fetched layers: 0 B in 0 seconds (0 B/s)                                                                                                                                   Deploying: done (13 seconds)                                                                                                                                           Pruned images: 1 (layers: 0, objsize: 0 bytes)
Queued for next boot: quay.io/almalinuxorg/atomic-desktop-gnome:latest
  Version: 10.2.20260808.1
  Digest: sha256:fbb56140f5b2b95b3386d48164665922b7a2cf8569af7271b6362fd3ac39c38a

Before rebase:

sudo bootc update
[sudo] password for user: 
error: Upgrading: Preparing import: Fetching manifest: containers-policy.json specifies a default of `insecureAcceptAnything`; refusing usage

After rebase:

sudo bootc update
[sudo] senha para diogo: 
No changes in quay.io/almalinuxorg/atomic-desktop-gnome => sha256:fbb56140f5b2b95b3386d48164665922b7a2cf8569af7271b6362fd3ac39c38a
No update available.

I think we need to check the containers-policy.json file to resolve this issue.