Skip to content

Add composefs backend #61

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alicefr merged 2 commits into from
Jun 11, 2026
Merged

Add composefs backend #61

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
944bfdf
Move CNI paths from /opt/cni to /var/lib/cni/bin
alicefr Jun 11, 2026
4e9c333
Add composefs backend disk image build support
alicefr Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/build-node-image.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,3 +97,27 @@ jobs:
podman push ${PUSH_DEST}:${TAG}-disk
podman tag ${DISK_SRC} ${PUSH_DEST}:latest-disk
podman push ${PUSH_DEST}:latest-disk

- name: Build composefs disk image
working-directory: node-images/fedora
run: |
BOOTC_DIGEST="${{ steps.push-bootc.outputs.digest }}"
PUSH_DEST="${{ steps.push-bootc.outputs.push_dest }}"
if [ -n "${BOOTC_DIGEST}" ] && [ -n "${PUSH_DEST}" ]; then
make build-disk-image-composefs BOOTC_IMAGE="${PUSH_DEST}" BOOTC_DIGEST="${BOOTC_DIGEST}"
else
make build-disk-image-composefs
fi

- name: Push composefs disk image
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && inputs.push)
working-directory: node-images/fedora
run: |
TAG=${{ steps.meta.outputs.tag }}
DISK_SRC=$(make -s print-node-image-composefs)
PUSH_DEST=${{ env.PUSH_REGISTRY }}/${{ env.PUSH_IMAGE }}

podman tag ${DISK_SRC} ${PUSH_DEST}:${TAG}-disk-composefs
podman push ${PUSH_DEST}:${TAG}-disk-composefs
podman tag ${DISK_SRC} ${PUSH_DEST}:latest-disk-composefs
podman push ${PUSH_DEST}:latest-disk-composefs
2 changes: 1 addition & 1 deletion internal/cluster/calico.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5026,7 +5026,7 @@ spec:
# Used to install CNI.
- name: cni-bin-dir
hostPath:
path: /opt/cni/bin
path: /var/lib/cni/bin
- name: cni-net-dir
hostPath:
path: /etc/cni/net.d
Comment on lines 5026 to 5032

@sourcery-ai sourcery-ai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security (CKV_K8S_16): Container should not be privileged

Privileged containers are containers that have all of the root capabilities of a host machine, allowing access to resources that are not accessible in ordinary containers.
Common uses of privileged containers include: running a Docker daemon inside a Docker container, running a container with direct hardware access, and automating CI/CD tasks in the open-source automation server Jenkins.
Running a container with a privileged flag allows users to have critical access to the host's resources.
If a privileged container is compromised, it does not necessarily entail remote code execution, but it implies that an attacker will be able to run full host root with all of the available capabilities, including CAP_SYS_ADMIN.

Fix

Kubernetes

  • Resource: Container
  • Arguments: privileged (Optional)

If true, processes in the privileged containers are essentially equivalent to root on the host.
Default to false.

apiVersion: v1
kind: Pod
metadata:
  name: <Pod name>
spec:
  containers:
  - name: <container name>
    image: <image>
    securityContext:
-      privileged: true

Source: checkov

Expand Down
2 changes: 1 addition & 1 deletion internal/cluster/init.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,7 @@ func (c *Cluster) Init(ctx context.Context, opts InitOptions) error {
return fmt.Errorf("failed to install Calico: %w", err)
}

c.logger.Info("CNI plugins will be installed to /opt/cni/bin (tmpfs overlay for bootc)")
c.logger.Info("CNI plugins will be installed to /var/lib/cni/bin")

// Wait for Calico to write its CNI config before installing CoreDNS
c.logger.Info("Waiting for Calico CNI configuration...")
Expand Down
4 changes: 2 additions & 2 deletions internal/node/templates/user-data.yaml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,6 @@ write_files:
content: |
[crio.network]
plugin_dirs = [
"/opt/cni/bin",
"/var/lib/cni/bin",
"/usr/libexec/cni",
]
Expand Down Expand Up @@ -75,11 +74,12 @@ runcmd:
- sysctl -w net.ipv4.ip_forward=1
- echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-kubernetes.conf
- mkdir -p /var/lib/kubelet/volumeplugins
- mkdir -p /var/lib/cni/bin
- mkdir -p /var/mnt/cluster_images
- mkdir -p /var/lib/containers/storage
- systemctl daemon-reload
- systemctl enable --now var-mnt-cluster_images.mount
- systemctl enable --now ostree-state-overlay@opt.service
- systemctl enable --now ostree-state-overlay@opt.service || true

@sourcery-ai sourcery-ai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Silencing systemctl failures may hide real issues; consider at least logging failures explicitly

Using || true here means any failure from systemctl enable --now ostree-state-overlay@opt.service (e.g., missing or misconfigured unit) will be silently ignored, making provisioning issues hard to detect. If this service is optional, guard the call with an explicit check (e.g., verifying the unit file exists or checking systemctl list-unit-files) and/or log a clear message when systemctl fails so it’s obvious when the overlay is not active.

- systemctl enable --now qemu-guest-agent
- nmcli connection modify "cloud-init enp2s0" ipv4.dns-search "~{{.ClusterDomain}} {{.ClusterDomain}}"
- nmcli connection up "cloud-init enp2s0"
Expand Down
3 changes: 2 additions & 1 deletion node-images/fedora/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,8 @@ FROM scratch AS root
COPY --from=builder /target-rootfs/ /

RUN passwd -d root
RUN sed -i 's|"/opt/cni/bin"|"/var/lib/cni/bin"|g' /etc/crio/crio.conf
RUN sed -i 's|"/opt/cni/bin"|"/var/lib/cni/bin"|g' /etc/crio/crio.conf && \
sed -i 's|"/opt/cni/net.d"|"/etc/cni/net.d"|g' /etc/crio/crio.conf
RUN bootc container lint

LABEL containers.bootc 1
Expand Down
2 changes: 2 additions & 0 deletions node-images/fedora/Containerfile.disk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ ARG STORAGE_PATH
ARG BOOTC_IMAGE
ARG DISK_SIZE=10G
ARG MEMORY=4G
ARG BCVK_EXTRA_ARGS=""
ENV CONTAINERS_STORAGE_CONF=/tmp/storage.conf
RUN mkdir -p /output && \
printf "[storage]\ndriver = \"overlay\"\ngraphroot = \"${STORAGE_PATH}\"\n" > $CONTAINERS_STORAGE_CONF && \
Expand All @@ -19,6 +20,7 @@ RUN mkdir -p /output && \
--format qcow2 \
--memory ${MEMORY} \
--disk-size ${DISK_SIZE} \
${BCVK_EXTRA_ARGS} \
${BOOTC_IMAGE} \
/output/disk.qcow2
RUN podman run --rm ${BOOTC_IMAGE} kubeadm config images list > /output/images.txt
Expand Down
19 changes: 15 additions & 4 deletions node-images/fedora/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,16 @@
.PHONY: build-bootc-image build-disk-image clean help
.PHONY: build-bootc-image build-disk-image build-disk-image-composefs clean help

KUBE_MINOR ?= 1.35
FEDORA_VERSION ?= 44
DISK_SIZE ?= 10G
BUILD_MEMORY ?= 4G
BCVK_EXTRA_ARGS ?=

IMAGE_TAG ?= v$(KUBE_MINOR)-fedora-$(FEDORA_VERSION)
REGISTRY ?= ghcr.io/alicefr/bink
BOOTC_IMAGE ?= $(REGISTRY)/node:$(IMAGE_TAG)
NODE_IMAGE ?= $(REGISTRY)/node:$(IMAGE_TAG)-disk
NODE_IMAGE_COMPOSEFS ?= $(REGISTRY)/node:$(IMAGE_TAG)-disk-composefs
BOOTC_DIGEST ?=

# Build the OCI bootc image (k8s + cri-o)
Expand Down Expand Up @@ -47,13 +49,17 @@ build-disk-image:
--build-arg MEMORY="$(BUILD_MEMORY)" \
--build-arg KUBE_MINOR="$(KUBE_MINOR)" \
--build-arg BOOTC_DIGEST="$$BOOTC_DIGEST" \
--build-arg BCVK_EXTRA_ARGS="$(BCVK_EXTRA_ARGS)" \
-t $(NODE_IMAGE) \
-f Containerfile.disk \
.
@echo "✅ Node image built: $(NODE_IMAGE)"
@echo ""
@echo "This image can be used with: bink cluster start --node-image $(NODE_IMAGE)"

build-disk-image-composefs:
$(MAKE) build-disk-image BCVK_EXTRA_ARGS="--composefs-backend" NODE_IMAGE="$(NODE_IMAGE_COMPOSEFS)"

print-image-tag:
@echo $(IMAGE_TAG)

Expand All @@ -63,6 +69,9 @@ print-bootc-image:
print-node-image:
@echo $(NODE_IMAGE)

print-node-image-composefs:
@echo $(NODE_IMAGE_COMPOSEFS)

clean:
@echo "=== Cleaning up ==="
podman rmi -f $(BOOTC_IMAGE) $(NODE_IMAGE) 2>/dev/null || true
Expand All @@ -72,9 +81,10 @@ help:
@echo "Makefile for building bink node images (Fedora)"
@echo ""
@echo "Targets:"
@echo " build-bootc-image - Build the OCI bootc image"
@echo " build-disk-image - Build the OCI disk image with qcow2 (default)"
@echo " clean - Remove built images"
@echo " build-bootc-image - Build the OCI bootc image"
@echo " build-disk-image - Build the OCI disk image with qcow2 (default, ostree backend)"
@echo " build-disk-image-composefs - Build the OCI disk image with composefs backend"
@echo " clean - Remove built images"
@echo ""
@echo "Variables:"
@echo " BOOTC_IMAGE - Bootc OCI image name (default: $(BOOTC_IMAGE))"
Expand All @@ -83,3 +93,4 @@ help:
@echo " FEDORA_VERSION - Fedora version (default: $(FEDORA_VERSION))"
@echo " DISK_SIZE - VM disk size (default: $(DISK_SIZE))"
@echo " BUILD_MEMORY - Memory for bcvk build (default: $(BUILD_MEMORY))"
@echo " BCVK_EXTRA_ARGS - Extra arguments passed to bcvk to-disk (default: none)"
Loading