HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
bootc-dev
bootc
Rust2023–2026
bootc-dev / bootc

bootc

Boot and upgrade via container images

13Distinct people
15Mentions
0Explicit recommenders
2.4KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Boot and upgrade via container images

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 11:56:56 AM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year15 dated mentions

Observed mentions: 2023-03-23 23:40:10 UTC to 2026-03-03 06:22:49 UTC.

02468102023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments20232024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20242025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 10 mentions; 1 submissions, 9 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC110
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC1019
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC303

What Hacker News says

15 sources
With multi-stage Dockerfiles, you only copy the final, built application artifacts from the earlier stage(s). Then, building a package as one signed file to copy is justified and easier anyway. There's always: RUN dnf remove -y ansible && dnf clean all I thought there was a native way to build container images with ansible that don't have ansible installed in the image though? ansible/ansible-builder: https://github.com/ansible/ansible-builder "How to Use ansible-builder to Create Execution Environments" https://oneuptime.com/blog/post/2026-02-21-how-to-use-ansibl... : > The Build Process Explained: When you run ansible-builder build, it goes through these steps: > Reads your `execution-environment.yml` definition, Resolves collection dependencies (including transitive dependencies), Generates a `Containerfile` in a `context/` dir
Read the rest
ectory, Copies dependency files into the build context, Runs the container build using Podman or Docker How to Use Ansible to Build Podman Images > Building with Build Arguments, Multi-Stage Builds, Building with Buildah: https://oneuptime.com/#building-with-buildah : It's possible to build images using build a commands in an ansible playbook: buildah from buildah copy buildah run buildah config buildah commit . The CLI way to traverse an ansible playbook graph, for e.g. dagger: ansible-playbook --list-tags ansible-playbook --tags {tagname} But where can it parallelize? It probably shouldn't (?) parallelize because that wouldn't be a deterministic build; installing A then B is not the same as installing B then A. (Is not the same thing as installing A in one container image layer, B in another container image layer, and then trying to merge the package databases.) A given package B could conditionally install or configure according to whether or not A is already installed, and so for example package install tasks are not commutative. . Bootc (osbuild) builds VM and native machine images from Containerfiles: bootc-image-builder bootc upgrade /? bootc ansible [Debian] https://www.google.com/search?q=bootc+ansible https://www.google.com/search?q=bootc+ansible+debian "Demonstrate a debian or arch base image" bootc-dev/bootc#865 https://github.com/bootc-dev/bootc/issues/865 Is packer necessary with bootc? To require signatures for containers and also for native containers with bootc: cat /etc/containers/policy.json | grep sigstoreSigned podman image trust show --raw Here's this on ansible, dagger, bootc: "Public link: Dagger for Programmable CI/CD" https://gemini.google.com/share/3965633a3ff8
In BuildKit: Docker's Hidden Gem That Can Build Almost Anything
I absolutely love what the universalblue team has been doing. They are one of the few organizations that are truly dedicated to providing a first-class, enjoyable, batteries included linux experience on the desktop. I truly believe that updates are seamless not just because of all the buzzwords about the underlying technology but because its made for people who actually use the system daily. They gate the fedora kernel and track breaking changes so you don't get them, and generally care about the user experience. If you want sensible gnome defaults and extensions they are there (or there to be disabled at the click of a button). If you want remote desktop streaming (sunshine/moonlight) its there. On the flip side, their distribution model also means no more need to keep track of out of tree kernel modules on upgrades (zfs, nvidia, waydro
Read the rest
id even on Bazzite). Now onto the post specifically: LTS from a CentOS Stream base seems interesting. Fedora is nice, and the universalblue team tames it 99%, but its edge can be a bit too bleeding sometimes. My only reticence with CentOS Stream though is that it is veering dangerously close to Red Hat proper which I am unsure how to feel about. I am eagerly awaiting when non-rpms distros will be able to use the same underlying technology Bluefin uses, and see how the space evolves. A debian base especially seems interesting in theory. There has recently been some progress on that front: https://github.com/bootc-dev/bootc/issues/865 https://github.com/bootcrew/debian-bootc
In Bluefin LTS Is Released
secureblue creator here :) some corrections: > last I heard it wasn't out of Beta or whatever yet It is > But it uses containers rather than VMs It doesn't use plain containers for app isolation. We ship the OS itself as a bootable container (https://github.com/bootc-dev/bootc). That doesn't mean we use or recommend using containers for application isolation. Container support is actually disabled by default via our selinux policy restricting userns usage (this can be toggled though, of course). Containers on their own don't provide sandboxing. The syscall filtering for them is extremely weak. Flatpak (which sandboxes via bubblewrap: https://github.com/containers/bubblewrap) can be configured to be reasonably good, but we still encourage the use of VMs if needed. We provide one-click tooling for easily installing virt-manager (https://en.
Read the rest
wikipedia.org/wiki/Virt-manager) if desired. In short though, secureblue and Qubes aren't really analogous. We have different goals and target use cases. There is even an open issue on Qubes to add a template to use secureblue as a guest: https://github.com/QubesOS/qubes-issues/issues/9755
In Malicious versions of Nx and some supporting plugins were published
I don't know rust. I had assumed that all that was needed was to feed bootc-image-builder an image with files in the right places and it should work; if it needs to actually run native code (not just call a shell script or something) to integrate with the package manager, then it's over my head. And... also that seems like an overly-tightly-coupled design, IMHO. Hopefully https://github.com/coreos/bootupd/issues/468#issuecomment-15... (and similar) is the path forward. I guess I will see if I can get my head around https://github.com/frap129/arch-bootc and see if that works without any terrible hacks (like https://github.com/bootc-dev/bootc/issues/865#issuecomment-2... talking about hacking the code to replace rpm with pacman), and then assuming I don't loose steam I can write something on the relevant issue(s) outlining exactly what does
Read the rest
work and doesn't work how to reproduce it (because currently someone even trying to see what the current state of things looks like has to navigate through several layers of pages and can still walk away uncertain). My vague plan is [x] try building a qcow2 image from quay.io/centos-bootc/centos-bootc:stream9 [x] try building a lightly modified container image from centos stream and turn that into a qcow2 [ ] try building frap129's archlinux image [ ] write up minimal steps to reproduce frap129's archlinux image and boot it in qemu [ ] try building a debian image [ ] try building an alpine image [ ] try building a postmarketos image (my actual original goal) and either leave a trail of documentation of how to do things that do work, or else write up exactly what breaks.
In Learning about Bootc
Sorry mate, I didn't mean to say that you're not part of said community. I have seen that there are instructions here for arch: https://github.com/bootc-dev/bootc/issues/865#issuecomment-2... I do see that the poster mentions that "Of course all of this is mitigated by using Fedora's boot-related packages, but that certainly is only a workaround to get it running at all." If you're interested, I can talk to the bootc team to document what needs to be done and how it can be more clearly stated. Do you know rust enough to get involved if i can convince the group to get the party started ?
In Learning about Bootc
Am I not a member of the community? I am trying to build bootc images, but I can't work with nothing. Just now, I thought I'd go check and see if it'd improved, and guess what? It's actually worse than I remembered. There's a list of distros using it at https://github.com/bootc-dev/bootc/blob/main/ADOPTERS.md - but actually the non-Fedora distros they list are RHEL and HeliumOS, which is a CentOS Stream derivative. (There's a list of ostree users, but that's not the same and they even admit that this is more of a 'hey these use related tech and someday maybe they can use this'). So I went looking through docs, and found https://bootc-dev.github.io/bootc/installation.html which again says that this really only supports Fedora/CentOS/RHEL, but does link to the issue tracking work for others to use it. That's https://github.com/coreos/bootup
Read the rest
d/issues/468 , which is 2 years old and... basically is, again, a bunch of different folks saying they'd like to make it work on different distros and getting nowhere. There is one person who posted on https://github.com/bootc-dev/bootc/issues/865 and who claims to have converted an ostree Arch system to using bootc, but they didn't post steps to reproduce. Actually clicking around I eventually found their repo https://github.com/frap129/arch-bootc/tree/main which again doesn't say how to do it, but does appear to contain their code, so maybe I can reverse-engineer from there... Anyways. The community would very much like to step up, but we can only step up over so high of a learning curve, or possibly so high of a porting curve (a lot of comments indicate being tied to rpm integration).
In Learning about Bootc
I would suggest taking a look at bootc https://github.com/containers/bootc which enables you to use OCI / Docker containers as a transport and delivery system for OS updates. That makes available much of the tooling used to build and deliver container images for the purposes of delivering os updates. Such possibilities include the various registeries available for storing OS updates and branches. Tooling for security scanning, sbom generation, signing Docker or podman for building the image. It's important to note that the container image itself is not executed upon boot, but rather unpacked before hand.
In Yocto, RockPi and SBOMs: Building modern embedded Linux images
> they are significant because Nix can be used to create a fully featured OS instead of just a VM Look up Bootable Containers project by RedHat [0]. Fully featured OS built from a Containerfile, bootable on bare metal. I agree that Nix design is much better than Docker, and has a bunch of features that OCI ecosystem doesn't (e.g. remote builds[1], partial downloading of the build tree, non-linear build process[2], nix store import/export, overlays, I/O isolation, much better composability), but "creating OS instead of VM" [did you mean container?] is not one of them. [0] https://github.com/containers/bootc [1] You can use DOCKER_HOST, and I'm happy that this option is there, but Nix does it better. [2] Perhaps with BuildKit it's no longer true, I haven't checked what happens if you have multi-staged build with one stage depending on multi
Read the rest
ple previous ones (which are otherwise unconnected). I think Earthly can parallelize this scenario https://earthly.dev/
In Nix – Death by a Thousand Cuts
There’s a lot of comments in here about desktops, but IMO why even discuss Linux on the desktop… 99.9999% of Linux deployments are not Arch installs on old Thinkpads. Immutable distros *are* becoming a de-facto standard for server deployments, IoT devices, etc. They improve security, enable easy rollbacks, validation of a single non-moving target for systems/hardware developers… There’s also been a ton of very advanced development in the space. You can now take bootable containers and use them to reimage machines and perform upgrades. Extend your operating system using a Dockerfile as you would your app images: https://github.com/containers/bootc
In Are Immutable Linux Distros right for you?

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.