From 25814de40ff264b78a7f23bb601bbcf0374fa5d1 Mon Sep 17 00:00:00 2001
From: nikodunk <n.dunkel@gmail.com>
Date: Tue, 21 Jul 2026 11:04:19 -0700
Subject: [PATCH 1/2] bootc builder

---
 Containerfile                            |  38 +++++++
 build.sh                                 | 125 ++++++++++++-----------
 etc/terraform-daily-9.0-azure-amd64.conf |   7 ++
 etc/terraform-daily-9.0-azure-arm64.conf |   7 ++
 4 files changed, 116 insertions(+), 61 deletions(-)
 create mode 100644 Containerfile

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 000000000..f3d92f3f0
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,38 @@
+FROM ghcr.io/jmarrero/ubuntu-bootc:latest
+
+ARG CHANNEL=daily
+ARG BASECODENAME=resolute
+ARG VERSION=9.0
+ARG CODENAME=tanit
+ARG NAME="elementary OS"
+ARG ARCH=amd64
+
+LABEL org.opencontainers.image.title="${NAME}" \
+      org.opencontainers.image.version="${VERSION}" \
+      org.opencontainers.image.description="elementary OS bootc image" \
+      org.opencontainers.image.base.name="ghcr.io/jmarrero/ubuntu-bootc:latest" \
+      os.channel="${CHANNEL}" \
+      os.codename="${CODENAME}"
+
+COPY etc/config/archives/elementary.key /etc/apt/trusted.gpg.d/elementary.gpg
+COPY etc/config/archives/patches.key /etc/apt/trusted.gpg.d/patches.gpg
+COPY etc/config/archives/patches.pref /etc/apt/preferences.d/os-patches.pref
+
+RUN echo "Types: deb" > /etc/apt/sources.list.d/elementary.sources \
+    && echo "URIs: https://ppa.launchpadcontent.net/elementary-os/${CHANNEL}/ubuntu" >> /etc/apt/sources.list.d/elementary.sources \
+    && echo "Suites: ${BASECODENAME}" >> /etc/apt/sources.list.d/elementary.sources \
+    && echo "Components: main" >> /etc/apt/sources.list.d/elementary.sources \
+    && echo "Signed-By: /etc/apt/trusted.gpg.d/elementary.gpg" >> /etc/apt/sources.list.d/elementary.sources \
+    && echo "Types: deb" > /etc/apt/sources.list.d/os-patches.sources \
+    && echo "URIs: https://ppa.launchpadcontent.net/elementary-os/os-patches/ubuntu" >> /etc/apt/sources.list.d/os-patches.sources \
+    && echo "Suites: ${BASECODENAME}" >> /etc/apt/sources.list.d/os-patches.sources \
+    && echo "Components: main" >> /etc/apt/sources.list.d/os-patches.sources \
+    && echo "Signed-By: /etc/apt/trusted.gpg.d/patches.gpg" >> /etc/apt/sources.list.d/os-patches.sources
+
+RUN apt-get update \
+    && apt-get install -y elementary-desktop elementary-minimal elementary-standard \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /usr/lib/systemd/system/apparmor.service.d \
+    && printf '[Unit]\nConditionPathExists=\n' > /usr/lib/systemd/system/apparmor.service.d/99_enable_in_live_mode.conf
diff --git a/build.sh b/build.sh
index 71596c5bd..a4b78ebe0 100755
--- a/build.sh
+++ b/build.sh
@@ -18,78 +18,81 @@ BASE_DIR="$PWD"
 source "$BASE_DIR"/"$CONFIG_FILE"
 
 echo -e "
-#----------------------#
-# INSTALL DEPENDENCIES #
-#----------------------#
-"
 
-apt-get update
-apt-get install -y live-build patch gnupg2 binutils zstd
 
-# The Debian repositories don't seem to have the `ubuntu-keyring` or `ubuntu-archive-keyring` packages
-# anymore, so we add the archive keys manually. This may need to be updated if Ubuntu changes their signing keys
-# To get the current key ID, find `ubuntu-keyring-xxxx-archive.gpg` in /etc/apt/trusted.gpg.d on a running
-# system and run `gpg --keyring /etc/apt/trusted.gpg.d/ubuntu-keyring-xxxx-archive.gpg --list-public-keys `
-gpg --homedir /tmp --no-default-keyring --keyring /etc/apt/trusted.gpg --recv-keys --keyserver keyserver.ubuntu.com F6ECB3762474EDA9D21B7022871920D1991BC93C
+#--------------------------------#
+# BUILD & LINT CONTAINER IMAGE    #
+#--------------------------------#
+"
 
-# TODO: Remove this once debootstrap can natively build resolute images:
-ln -sfn /usr/share/debootstrap/scripts/gutsy /usr/share/debootstrap/scripts/resolute
+YYYYMMDD="$(date +%Y%m%d)"
+IMAGE_TAG="elementaryos-$VERSION-$CHANNEL-$ARCH.$YYYYMMDD$OUTPUT_SUFFIX"
+OUTPUT_DIR="$BASE_DIR/builds/$ARCH"
+mkdir -p "$OUTPUT_DIR"
 
-build () {
-  BUILD_ARCH="$1"
+podman build \
+  --build-arg CHANNEL="$CHANNEL" \
+  --build-arg BASECODENAME="$BASECODENAME" \
+  --build-arg VERSION="$VERSION" \
+  --build-arg CODENAME="$CODENAME" \
+  --build-arg NAME="$NAME" \
+  --build-arg ARCH="$ARCH" \
+  -t "$IMAGE_TAG" \
+  -f Containerfile \
+  "$BASE_DIR"
 
-  mkdir -p "$BASE_DIR/tmp/$BUILD_ARCH"
-  cd "$BASE_DIR/tmp/$BUILD_ARCH" || exit
+bootc container lint "$IMAGE_TAG"
 
-  # remove old configs and copy over new
-  rm -rf config auto
-  cp -r "$BASE_DIR"/etc/* .
-  # Make sure conffile specified as arg has correct name
-  cp -f "$BASE_DIR"/"$CONFIG_FILE" terraform.conf
+if [ -n "$REGISTRY" ] && [ -n "$IMAGE_NAME" ]; then
+  REMOTE_TAG="${VERSION}-${CHANNEL}-${ARCH}.${YYYYMMDD}${OUTPUT_SUFFIX}"
+  REMOTE_IMAGE="${REGISTRY}/${IMAGE_NAME}:${REMOTE_TAG}"
 
   echo -e "
-#------------------#
-# LIVE-BUILD CLEAN #
-#------------------#
+#--------------------------------------------------------#
+# PUSH TO REGISTRY SO EXISTING INSTALLS CAN BOOTC UPDATE #
+#--------------------------------------------------------#
 "
-  lb clean
 
-  echo -e "
-#-------------------#
-# LIVE-BUILD CONFIG #
-#-------------------#
-"
-  lb config
+  podman tag "$IMAGE_TAG" "$REMOTE_IMAGE"
+  podman push "$REMOTE_IMAGE"
 
-  echo -e "
-#------------------#
-# LIVE-BUILD BUILD #
-#------------------#
-"
-  lb build
+  if [ "$CHANNEL" = "stable" ]; then
+    LATEST_IMAGE="${REGISTRY}/${IMAGE_NAME}:latest"
+    podman tag "$IMAGE_TAG" "$LATEST_IMAGE"
+    podman push "$LATEST_IMAGE"
+  fi
 
-  echo -e "
-#---------------------------#
-# MOVE OUTPUT TO BUILDS DIR #
-#---------------------------#
+  echo "Pushed: $REMOTE_IMAGE"
+fi
+
+echo -e "
+#---------------------------------------------#
+# GENERATE ISO FROM IMAGE FOR NEW INSTALLS    #
+#---------------------------------------------#
 "
 
-  YYYYMMDD="$(date +%Y%m%d)"
-  OUTPUT_DIR="$BASE_DIR/builds/$BUILD_ARCH"
-  mkdir -p "$OUTPUT_DIR"
-  FNAME="elementaryos-$VERSION-$CHANNEL-$BUILD_ARCH.$YYYYMMDD$OUTPUT_SUFFIX"
-  mv "$BASE_DIR/tmp/$BUILD_ARCH/live-image-$BUILD_ARCH.hybrid.iso" "$OUTPUT_DIR/${FNAME}.iso"
-
-  # cd into output to so {FNAME}.sha256.txt only
-  # includes the filename and not the path to
-  # our file.
-  cd $OUTPUT_DIR
-  md5sum "${FNAME}.iso" | tee "${FNAME}.md5.txt"
-  sha256sum "${FNAME}.iso" | tee "${FNAME}.sha256.txt"
-  cd $BASE_DIR
-}
-
-# remove old builds before creating new ones
-rm -rf "$BASE_DIR"/builds
-
-build "$ARCH"
+if [ "$BUILD_ISO" = "true" ]; then
+  podman run --rm --privileged \
+    -v /var/lib/containers/storage:/var/lib/containers/storage \
+    -v "$OUTPUT_DIR:/output" \
+    ghcr.io/osbuild/image-builder-cli:latest \
+    --type "bootc-generic-iso" \
+    "$IMAGE_TAG"
+
+  ISO_FILE=$(find "$OUTPUT_DIR" -maxdepth 1 -name "*.iso" -type f | head -1)
+  if [ -n "$ISO_FILE" ]; then
+    FNAME="elementaryos-$VERSION-$CHANNEL-$ARCH.$YYYYMMDD$OUTPUT_SUFFIX"
+    mv "$ISO_FILE" "$OUTPUT_DIR/${FNAME}.iso"
+    cd "$OUTPUT_DIR"
+    md5sum "${FNAME}.iso" | tee "${FNAME}.md5.txt"
+    sha256sum "${FNAME}.iso" | tee "${FNAME}.sha256.txt"
+    cd "$BASE_DIR"
+  fi
+fi
+
+echo -e "
+#------------------------#
+# IMAGE BUILT SUCCESSFULLY
+#------------------------#
+"
+echo "Image: $IMAGE_TAG"
diff --git a/etc/terraform-daily-9.0-azure-amd64.conf b/etc/terraform-daily-9.0-azure-amd64.conf
index 79fd43a87..15c5157b6 100644
--- a/etc/terraform-daily-9.0-azure-amd64.conf
+++ b/etc/terraform-daily-9.0-azure-amd64.conf
@@ -28,3 +28,10 @@ HWE_X11="no"
 
 # suffix for generated .iso files
 OUTPUT_SUFFIX=""
+
+# generate installer ISO from bootc image via bootc-image-builder
+BUILD_ISO="true"
+
+# container registry and image name (for bootc image push)
+REGISTRY="ghcr.io"
+IMAGE_NAME="elementary/os"
diff --git a/etc/terraform-daily-9.0-azure-arm64.conf b/etc/terraform-daily-9.0-azure-arm64.conf
index 22396c465..f1d1e81ed 100644
--- a/etc/terraform-daily-9.0-azure-arm64.conf
+++ b/etc/terraform-daily-9.0-azure-arm64.conf
@@ -28,3 +28,10 @@ HWE_X11="no"
 
 # suffix for generated .iso files
 OUTPUT_SUFFIX=""
+
+# generate installer ISO from bootc image via bootc-image-builder
+BUILD_ISO="true"
+
+# container registry and image name (for bootc image push)
+REGISTRY="ghcr.io"
+IMAGE_NAME="elementary/os"

From 31127cc8f6eef8451f2d3236dd34b07f073ae800 Mon Sep 17 00:00:00 2001
From: nikodunk <n.dunkel@gmail.com>
Date: Tue, 21 Jul 2026 11:20:18 -0700
Subject: [PATCH 2/2] move linting to containerfile where it belongs

---
 Containerfile | 2 ++
 build.sh      | 4 +---
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Containerfile b/Containerfile
index f3d92f3f0..7f888c7d5 100644
--- a/Containerfile
+++ b/Containerfile
@@ -36,3 +36,5 @@ RUN apt-get update \
 
 RUN mkdir -p /usr/lib/systemd/system/apparmor.service.d \
     && printf '[Unit]\nConditionPathExists=\n' > /usr/lib/systemd/system/apparmor.service.d/99_enable_in_live_mode.conf
+
+RUN bootc container lint
diff --git a/build.sh b/build.sh
index a4b78ebe0..9dcf3c27e 100755
--- a/build.sh
+++ b/build.sh
@@ -21,7 +21,7 @@ echo -e "
 
 
 #--------------------------------#
-# BUILD & LINT CONTAINER IMAGE    #
+# BUILD CONTAINER IMAGE    #
 #--------------------------------#
 "
 
@@ -41,8 +41,6 @@ podman build \
   -f Containerfile \
   "$BASE_DIR"
 
-bootc container lint "$IMAGE_TAG"
-
 if [ -n "$REGISTRY" ] && [ -n "$IMAGE_NAME" ]; then
   REMOTE_TAG="${VERSION}-${CHANNEL}-${ARCH}.${YYYYMMDD}${OUTPUT_SUFFIX}"
   REMOTE_IMAGE="${REGISTRY}/${IMAGE_NAME}:${REMOTE_TAG}"