Red Hat build of MicroShift

Build the bootc image

Build your Red Hat Enterprise Linux (RHEL) that contains MicroShift as a bootable container image by using a Containerfile.

Prerequisites

A RHEL 9.6 host with an active Red Hat subscription for building MicroShift bootc images and running containers.
You logged into the RHEL 9.6 host by using the user credentials that have sudo permissions.
The rhocp and fast-datapath repositories are accessible in the host subscription. The repositories do not necessarily need to be enabled on the host.
You have a remote registry such as Red Hat Quay for storing and accessing bootc images.
You used the dnf install -y container-tools command to install the container-tools meta-package on the host. The meta-package contains all container tools, such as Podman, Buildah, and Skopeo for additional support and troubleshooting. These tools are required for obtaining assistance from Red Hat Support when you are building and installing the image.

Procedure

Create a Containerfile that includes the following instructions:

Example Containerfile for RHEL image mode

FROM registry.redhat.io/rhel9/rhel-bootc:9.6

ARG USHIFT_VER=4.20
RUN dnf config-manager \
        --set-enabled rhocp-${USHIFT_VER}-for-rhel-9-$(uname -m)-rpms \
        --set-enabled fast-datapath-for-rhel-9-$(uname -m)-rpms
RUN dnf install -y firewalld microshift && \
    systemctl enable microshift && \
    dnf clean all

# Create a default 'redhat' user with the specified password.
# Add it to the 'wheel' group to allow for running sudo commands.
ARG USER_PASSWD
RUN if [ -z "${USER_PASSWD}" ] ; then \
        echo USER_PASSWD is a mandatory build argument && exit 1 ; \
    fi
RUN useradd -m -d /var/home/redhat -G wheel redhat && \
    echo "redhat:${USER_PASSWD}" | chpasswd

# Mandatory firewall configuration
RUN firewall-offline-cmd --zone=public --add-port=22/tcp && \
    firewall-offline-cmd --zone=trusted --add-source=10.42.0.0/16 && \
    firewall-offline-cmd --zone=trusted --add-source=169.254.169.1

# Create a systemd unit to recursively make the root filesystem subtree
# shared as required by OVN images
RUN cat > /etc/systemd/system/microshift-make-rshared.service <<'EOF'
[Unit]
Description=Make root filesystem shared
Before=microshift.service
ConditionVirtualization=container
[Service]
Type=oneshot
ExecStart=/usr/bin/mount --make-rshared /
[Install]
WantedBy=multi-user.target
EOF
RUN systemctl enable microshift-make-rshared.service

Podman uses the host subscription information and repositories inside the container when building the container image. If the rhocp and fast-datapath repositories are not available on the host, the build fails.

Set the PULL_SECRET environment variable:
```
$ PULL_SECRET=~/.pull-secret.json
```
Configure the USER_PASSWD environment variable:
```
$ USER_PASSWD=<redhat_user_password>
```
Replace <redhat_user_password> with your password.
Configure the IMAGE_NAME environment variable:
```
$ IMAGE_NAME=microshift-4.20-bootc
```

Create a local bootc image by running the following image build command:

$ sudo podman build --authfile "${PULL_SECRET}" -t "${IMAGE_NAME}" \
    --build-arg USER_PASSWD="${USER_PASSWD}" \
    -f Containerfile

How secrets are used during the image build:

The podman --authfile argument is required to pull the base rhel-bootc:9.6 image from the registry.redhat.io registry.
The build USER_PASSWD argument is used to set a password for the redhat user.

Verification

Verify that the local MicroShift bootc image was created by running the following command:

$ sudo podman images "${IMAGE_NAME}"

Example output

REPOSITORY                       TAG         IMAGE ID      CREATED        SIZE
localhost/microshift-4.20-bootc  latest      193425283c00  2 minutes ago  2.31 GB