Some packages expose end-user configuration options but generate additional files from those options at runtime. Two well-known examples are crypto-policies (generates backend config files like the OpenSSL configuration) and ca-certificates (generates the consolidated CA trust store). Under bootc upgrades, this pattern breaks.
On bootc systems in persistent mode, /etc is handled with OSTree-style three-way merge semantics across upgrades:
There are a few use cases for having a strict subset of a Git commit's tree that is bound to a parent.
For example, Rust crates often exclude extraneous files not needed to build
the project via e.g. Cargo.toml's exclude and include verbs; but git
is not aware of these. Ensuring that the published source code corresponds
Generated-by: https://github.com/cgwalters/cgwalters#llms
Fedora's Konflux instance needs to integrate with forge.fedoraproject.org (Forgejo). GitHub solves this with GitHub Apps: a single global identity that
(AI: Significant AI usage went into generating and writing this)
In long agentic sessions, tool outputs (build logs, file reads, search results) accumulate in the context window. Most content is consumed once — the agent reads it, acts on it, and never references it again (for example, a successful build may output a lot of text when the agent only needs to know "the build worked"). But it stays in context, consuming tokens on every subsequent LLM call and pushing the session toward compaction or context overflow.
Various agent frameworks like pi and goose impose hard output caps on their built-in tools (e.g. 50KB / 2000 lines for shell/bash), but that's not consistent across all tools. MCP servers may have their own limits, or may not.
(This document has heavy AI generation, but is a result of a fair bit of interactive design/research work with cgwalters, plus of course big tip to paude and other projects which already blazed this trail around network proxying)
OpenShell's current inner sandboxing — Landlock, seccomp, network namespaces, iptables, and TOFU binary verification, all running inside the sandbox container — is simultaneously too much and too little.
This document is fully generated by Opus 4.6 with OpenCode.
A new-user comparison of getting a "hello world" Apache httpd system running in QEMU using bootc and Kairos, written March 2026.
Kairos v4.0.1 / Hadron v0.0.4; bootc from current main branch.
Debugging Github Actions can be painful. First of all, I think a good practice is to avoid having substantial amounts of code in the action itself. Repositories under the bootc-dev organization lean into using Justfile as an entrypoint, and most GHA flows invoke just <task> which means it's also easier to reproduce locally.
But still though, some things (especially nontrivial workflows that e.g. lean into using artifacts across jobs) are nontrivial to test locally.
So here's the trick: instead of continually force pushing to a PR (and spamming everyone with notifications about pushes there) what I do instead is force push to the main branch of my fork of the repository - then monitor action runs from there.
Assisted-by: OpenCode (Opus 4.5)
OCI container layer tars may or may not include a root directory entry (./ or /). This is a known specification gap in the OCI image-spec. When root entries exist, container runtimes ignore them - both Podman and Docker explicitly skip root directory entries during extraction. The mode difference (0555 vs 0755) comes from hardcoded defaults used when creating the extraction directory before extraction begins:
| Runtime | Root Mode | Root Mtime | Honors Tar Root Entry? |
|---|
Status: Draft Proposal Version: 0.3.0 Last Updated: 2025-11-14
This extension enables registries to serve uncompressed blob representations while maintaining cryptographic integrity verification. It defines a two-phase client-server negotiation mechanism using HTTP headers to signal capability and intent.