ATAC-Helicopter · ATAC-Helicopter · Jul 29, 2026 · Jul 29, 2026
diff --git a/.github/workflows/build-container.yml b/.github/workflows/build-container.yml
@@ -66,22 +66,12 @@ jobs:
           context: prototype
           file: prototype/image/Containerfile
           platforms: linux/amd64
-          load: true
+          push: ${{ inputs.publish }}
           pull: true
           tags: ${{ env.IMAGE_REF }}
           cache-from: type=gha,scope=developer-os-amd64
           cache-to: type=gha,mode=max,scope=developer-os-amd64
 
-      - name: Verify the composed operating-system filesystem
-        env:
-          CONTAINER_RUNTIME: docker
-          IMAGE_PLATFORM: linux/amd64
-        run: prototype/scripts/verify-container.sh
-
-      - name: Publish the verified image
-        if: inputs.publish
-        run: docker push "${IMAGE_REF}"
-
       - name: Record the result
         env:
           PUBLISHED: ${{ inputs.publish }}
@@ -90,6 +80,6 @@ jobs:
             echo "## Developer OS container"
             echo
             echo "- Image: \`${IMAGE_REF}\`"
-            echo "- Verified: yes"
+            echo "- Filesystem verified during composition: yes"
             echo "- Published: ${PUBLISHED}"
           } >>"${GITHUB_STEP_SUMMARY}"
diff --git a/prototype/docs/CI.md b/prototype/docs/CI.md
@@ -24,8 +24,9 @@ the root for that reason.
 From the repository's **Actions** tab, choose **Build OS container**, select
 **Run workflow**, and normally leave **Publish** enabled.
 
-The job builds on an x86_64 GitHub-hosted runner, verifies the completed
-filesystem, then publishes it as:
+The job builds on an x86_64 GitHub-hosted runner and verifies the completed
+filesystem as part of the image composition. When **Publish** is enabled,
+BuildKit pushes the image directly as:
 
 ```text
 ghcr.io/OWNER/REPOSITORY:foundation
@@ -37,6 +38,11 @@ Actions artifact: a registry is designed for layered images and lets the disk
 job pull the result directly. No custom secret is required; the workflow uses
 the short-lived `GITHUB_TOKEN` with package permission.
 
+When **Publish** is disabled, the verified result remains only in BuildKit's
+reusable cache. Bootc images are deliberately not loaded into Docker's classic
+local image store because their deep layer history can exceed Docker's import
+limit.
+
 ### Build bootable disk
 
 Run `build-disk.yml` after the container workflow succeeds. It starts a

diff --git a/prototype/image/Containerfile b/prototype/image/Containerfile
@@ -22,6 +22,7 @@ COPY --from=session-builder /root/rpmbuild/RPMS/noarch/developer-os-session-*.no
 COPY desktop-profile/look-and-feel/ /usr/share/plasma/look-and-feel/org.developeros.desktop/
 COPY desktop-profile/kdeglobals /etc/xdg/kdeglobals
 COPY artwork/wallpaper.svg /usr/share/wallpapers/DeveloperOS/contents/images/3840x2160.svg
+COPY tests/verify-rootfs.sh /tmp/verify-rootfs.sh
 
 # Install product identity, preserve Xwayland, and remove every user-selectable
 # desktop session before adding back the one product Wayland session.
@@ -34,6 +35,8 @@ RUN rpm-ostree install /tmp/developer-os-session-*.noarch.rpm && \
     test -x /usr/bin/Xwayland && \
     test -x /usr/bin/startplasma-wayland && \
     grep -q 'LookAndFeelPackage=org.developeros.desktop' /etc/xdg/kdeglobals && \
+    /usr/bin/bash /tmp/verify-rootfs.sh && \
+    rm -f /tmp/verify-rootfs.sh && \
     ostree container commit
 
 LABEL org.opencontainers.image.title="Developer OS Foundation" \

diff --git a/prototype/scripts/verify-container.sh b/prototype/scripts/verify-container.sh
@@ -1,6 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+readonly repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 readonly image_ref="${IMAGE_REF:-localhost/developer-os:foundation}"
 readonly image_platform="${IMAGE_PLATFORM:-linux/amd64}"
 
@@ -17,23 +18,8 @@ fi
 
 "${runtime}" run \
   --rm \
+  --interactive \
   --platform "${image_platform}" \
   --entrypoint /usr/bin/bash \
   "${image_ref}" \
-  -euxo pipefail -c '
-  test -x /usr/bin/startplasma-wayland
-  test -x /usr/bin/Xwayland
-  test -x /usr/bin/podman
-  test -x /usr/bin/flatpak
-  test -x /usr/bin/toolbox
-  test -f /usr/share/wayland-sessions/developer-os.desktop
-  test "$(find /usr/share/wayland-sessions -maxdepth 1 -name "*.desktop" | wc -l)" -eq 1
-  test ! -d /usr/share/xsessions || ! find /usr/share/xsessions -name "*.desktop" -print -quit | grep -q .
-  test -f /usr/share/sddm/themes/breeze/theme.conf.user
-  grep -q "^DisplayServer=wayland$" /etc/sddm.conf.d/99-developer-os.conf
-  grep -q "^Current=breeze$" /etc/sddm.conf.d/99-developer-os.conf
-  ! grep -q "^export QT_QPA_PLATFORM=" /usr/libexec/developer-os-session
-  grep -q "^ID=developer-os$" /usr/lib/os-release
-  grep -q "SELINUX=enforcing" /etc/selinux/config
-  test -f /usr/share/plasma/look-and-feel/org.developeros.desktop/contents/layouts/org.kde.plasma.desktop-layout.js
-'
+  -s <"${repo_root}/tests/verify-rootfs.sh"
diff --git a/prototype/tests/verify-rootfs.sh b/prototype/tests/verify-rootfs.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+test -x /usr/bin/startplasma-wayland
+test -x /usr/bin/Xwayland
+test -x /usr/bin/podman
+test -x /usr/bin/flatpak
+test -x /usr/bin/toolbox
+test -f /usr/share/wayland-sessions/developer-os.desktop
+test "$(find /usr/share/wayland-sessions -maxdepth 1 -name "*.desktop" | wc -l)" -eq 1
+test ! -d /usr/share/xsessions ||
+  ! find /usr/share/xsessions -name "*.desktop" -print -quit | grep -q .
+test -f /usr/share/sddm/themes/breeze/theme.conf.user
+grep -q "^DisplayServer=wayland$" /etc/sddm.conf.d/99-developer-os.conf
+grep -q "^Current=breeze$" /etc/sddm.conf.d/99-developer-os.conf
+! grep -q "^export QT_QPA_PLATFORM=" /usr/libexec/developer-os-session
+grep -q "^ID=developer-os$" /usr/lib/os-release
+grep -q "SELINUX=enforcing" /etc/selinux/config
+test -f /usr/share/plasma/look-and-feel/org.developeros.desktop/contents/layouts/org.kde.plasma.desktop-layout.js