#bootc
6 entries
writing · September 2026
The Key in the Wrong Keyring
We wanted to sign everything for cairn in CI, including a key for kernel modules, and reached into shim's part of the boot chain without asking first.
projects · July 2026
Cairn
A sealed bootc estate: db-signed UKI boot under keys from an offline ceremony, composefs-pinned root, TPM2 unlock bound to a signed PCR11 policy. Images promote only after booting for real in CI.
writing · March 2026
Building Bootc Images from Scratch
The upstream Fedora bootc images ship 523 packages. We built one with 255 from scratch using dnf --installroot and a Containerfile. No rpm-ostree, no treefile, no inheritance.
writing · March 2026
Kernel Modules as Multi-Stage Container Builds
A pattern for building ZFS and NVIDIA kernel modules in multi-stage container builds for bootc immutable images. No DKMS, no gcc, no kernel-devel in your production OS.
writing · March 2026
On Building a Complicated Foot Gun
Deploying a home server with immutable infrastructure tooling: what the pipeline tested, what it didn't, and what broke anyway.
projects · November 2025
Immutable
FROM-scratch Fedora bootc images with source-built, MOK-signed ZFS and NVIDIA kernel modules. A homelab on an earned, verifiable supply chain.