In https://bootc-dev.github.io/bootc/experimental-composefs.html#build-pattern-compute-digest-and-generate-uki-in-one-stage, we remove the kernel & initrd from the image after we've computed its composefs digest:
# Remove raw kernel/initramfs (now embedded in UKI)
RUN rm -f /usr/lib/modules/*/vmlinuz /usr/lib/modules/*/initramfs.img
This likely does not work. We should remove those files before we compute the composefs digest.
What we should be able to do instead is to move the kernel & initramfs out of the rootfs into a distinct directory before we compute the composefs hash and then use them in the UKI build step.