#immutable
4 entries
writing · September 2026
The Key in the Wrong Keyring
We wanted to sign everything for cairn in CI, including a key for kernel modules, and reached into shim's part of the boot chain without asking first.
writing · March 2026
Building Bootc Images from Scratch
The upstream Fedora bootc images ship 523 packages. We built one with 255 from scratch using dnf --installroot and a Containerfile. No rpm-ostree, no treefile, no inheritance.
writing · March 2026
Kernel Modules as Multi-Stage Container Builds
A pattern for building ZFS and NVIDIA kernel modules in multi-stage container builds for bootc immutable images. No DKMS, no gcc, no kernel-devel in your production OS.
projects · November 2025
Immutable
FROM-scratch Fedora bootc images with source-built, MOK-signed ZFS and NVIDIA kernel modules. A homelab on an earned, verifiable supply chain.