Repository navigation
feat: keel assemble refuses a template with a kernel or bootloader - #89
Merged
Merged
Conversation
marcos-mendez
force-pushed
the
feat/container-template-guard
branch
from
October 8, 2026 07:15
4829043 to
1dd34b3
Compare
Decision 0052: the kernel, initrd, firmware, GRUB and installer move to a boot layer the ISO alone uses, so a container template never carries them. keel assemble now checks the assembled rootfs's dpkg database before it packs a template and refuses one that records any package only a machine boots with (keel.layers.container.MACHINE_ONLY, each pattern with its reason). A rootfs assembled without --template, which the ISO is made from, is not checked. The core 19.0-9 template had 28 of them, about 190 MB of its 904 MB.
marcos-mendez
force-pushed
the
feat/container-template-guard
branch
from
October 9, 2026 18:28
1dd34b3 to
4cb2952
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Decision 0052: a container template must never contain a kernel, an initrd, firmware, a bootloader or the installer. These now live in a boot layer of their own (Keel-Linux/common#47, Keel-Linux/buildtasks
bt-layer --boot).Change
keel.layers.container:MACHINE_ONLYis a list of fnmatch patterns, each with its reason.check(rootfs)readsvar/lib/dpkg/statusand refuses the rootfs (exitASSEMBLE_FAILED) if any matching package is recorded. A package that was removed but not purged also counts. A dpkg database that is missing or unreadable is refused too.keel assemble --templatecallscheckbefore packing, so neither the template nor its.sha512is written. A rootfs assembled without--template, which is what the ISO is made from, is not checked.tests/test_layers_container.py. The fixture is the package list of the published core 19.0-9 template: its 28 machine-only packages must match and the 18 close-named packages it keeps must not. Future kernel, UEFI and microcode names are covered too, as are dpkg states, a template that is refused and not written, and a rootfs-only assemble. The synthetic core layer now carries a dpkg status file. Coverage is 100 % forcontainer.pyandassemble.pyand 99 % in total.The 28 packages came to about 190 MB of core 19.0-9's 904 MB. Locally, with the same set purged, core's tar.zst went from 360.3 to 199.8 MB and web's from 383.1 to 224.0 MB.
Merge order
Merge this last: first Keel-Linux/common#47 and the buildtasks PR, then rebuild the layers with
keel-release --rebuild. The current layers still contain the kernel, so this version refuses them.Locally, the full suite had 21 failures outside the layer code, in mesh tests such as
tests/test_mesh_vipbridge.py. That file also fails on main in this environment. CI is the reference.