Don't use sudo podman aka rootless builds by FrostyX · Pull Request #46 · fedora-copr/copr-image-builder

FrostyX · 2026-06-30T14:09:15Z

There is an experimental support for rootless builds
https://osbuild.org/docs/bootc/#rootless

        || exit 1
 else
-    sudo podman pull $IMAGE || exit 1
+    podman pull $IMAGE || exit 1


gemini-code-assist

Code Review

This pull request removes sudo from several podman commands to run them in rootless mode, adds the --in-vm flag to the podman run command, and removes the image digest pin from the base image in the Containerfile. The feedback highlights critical issues introduced by running rootless: the hardcoded volume mount for container storage will fail because rootless storage resides in the user's home directory, and the --cap-add LINUX_IMMUTABLE flag may not function correctly without root privileges. Additionally, it is recommended to restore the image digest pin to ensure build reproducibility and security.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

gemini-code-assist · 2026-06-30T14:10:35Z

 if [ "$BUILD_BOOTC" == true ]; then
    mkdir -p output
-    sudo podman run \
+    podman run \


When running podman in rootless mode (by removing sudo), the container storage is typically located in the user's home directory (e.g., ~/.local/share/containers/storage) rather than the global /var/lib/containers/storage.

Because line 41 hardcodes the volume mount -v /var/lib/containers/storage:/var/lib/containers/storage, the rootless podman run command will fail to find the locally built/pulled $IMAGE or fail due to permission issues on /var/lib/containers/storage.

To support both rootful and rootless builds dynamically, you can query the active storage path using podman info and mount that directory instead:

storage_dir=$(podman info --format '{{ .Store.GraphRoot }}') podman run \ ... -v "$storage_dir":/var/lib/containers/storage \ ...

gemini-code-assist · 2026-06-30T14:10:35Z

 # This Containerfile is based on an ansible playbook for provisioning Copr builders
 # https://pagure.io/fedora-infra/ansible/blob/main/f/roles/copr/backend/files/provision/provision_builder_tasks.yml
-FROM quay.io/fedora/fedora-bootc:44@sha256:db4ce967bfd6fd136ce78d898a45fcb6af9e6d00a44cf316037cbb7176b6a9d5
+FROM quay.io/fedora/fedora-bootc:44


Removing the image digest (@sha256:...) reduces build reproducibility and security, as the base image tag quay.io/fedora/fedora-bootc:44 can be updated or overwritten in the registry. It is recommended to keep the base image pinned to a specific digest to ensure consistent and predictable builds.

FROM quay.io/fedora/fedora-bootc:44@sha256:db4ce967bfd6fd136ce78d898a45fcb6af9e6d00a44cf316037cbb7176b6a9d5

gemini-code-assist · 2026-06-30T14:10:35Z

    # The LINUX_IMMUTABLE is needed for doing chattr when building the image.
    # We use it for Internal Copr builders
-    sudo podman build \
+    podman build \


In rootless mode, --cap-add LINUX_IMMUTABLE may not grant the actual capability to set or modify immutable file attributes (such as chattr +i) because the rootless user lacks these privileges on the host. If the build process relies on this capability (as indicated by the comment on line 19), the build might fail or behave unexpectedly when run without sudo.

There is an experimental support for rootless builds https://osbuild.org/docs/bootc/#rootless

FrostyX · 2026-06-30T14:29:23Z

The feature is experimental and the build currently fails with

[\] Disk image building step
[3 / 5] Pipeline build [--------------------------------------------------------------------------------------------------------------------------->__________________________________________________________________________________] 60.00%
[3 / 3] Stage org.osbuild.selinux [------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------->] 100.00%
Message: Finished pipeline build
2026/06/30 14:13:58 error: cannot run osbuild: error running osbuild: exit status 1
BuildLog:
starting -
Starting pipeline source org.osbuild.containers-storage
Finished module source org.osbuild.containers-storage
Finished pipeline org.osbuild.containers-storage
Starting pipeline build
Starting module org.osbuild.container-deploy
4956900e09eb0af4e89bcfbda45cbeed79ed2ac370896a6476166b410a91a6cf
umount: /run/osbuild/containers/storage/overlay: not mounted.
WARNING: umount of overlay dir failed with an error: CompletedProcess(args=['umount', '-f', '--lazy', '/run/osbuild/containers/storage/overlay'], returncode=32)
Finished module org.osbuild.container-deploy
Starting module org.osbuild.selinux
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
setfiles: /run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin:  Regex version mismatch, expected: 10.46 2025-08-27 actual: 10.47 2025-10-21
setfiles: Could not set context for /run/osbuild/tree/usr/bin/pesto:  Invalid argument
Traceback (most recent call last):
File "/run/osbuild/bin/org.osbuild.selinux", line 45, in <module>
    r = main(osbuild.api.arguments())
  File "/run/osbuild/bin/org.osbuild.selinux", line 26, in main
    selinux.setfiles(file_contexts, os.path.normpath(root), target, exclude_paths=exclude_paths)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/run/osbuild/lib/osbuild/util/selinux.py", line 55, in setfiles
    subprocess.run(["setfiles", "-F",
    ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^
                    "-r", root,
                    ^^^^^^^^^^^
    ...<2 lines>...
                    f"{root}{path}"],
                    ^^^^^^^^^^^^^^^^^
                   check=True)
                   ^^^^^^^^^^^
File "/usr/lib64/python3.13/subprocess.py", line 577, in run
    raise CalledProcessError(retcode, process.args,
                             output=stdout, stderr=stderr)
subprocess.CalledProcessError: Command '['setfiles', '-F', '-r', '/run/osbuild/tree', '-e', '/run/osbuild/tree/sysroot', '/run/osbuild/tree/etc/selinux/targeted/contexts/files/file_contexts', '/run/osbuild/tree/']' returned non-zero exit status 255.
Finished module org.osbuild.selinux
Finished pipeline build
manifest - failed
Output:
Failed

Upstream issue reported here: osbuild/image-builder#2425

FrostyX · 2026-06-30T16:06:44Z

@joelcapitao is currently building VM images in Konflux, so we definitely want to re-use as much of their work as possible. I am copy-pasting the full quote here because I only half-understand what they are doing:

indeed, we already hit this issue and reported to konflux-ci/support#21 for the Fedora Konflux cluster. Currently, we are pointing Konflux to our own VM instead of using the one from the Multi platform controller (MPC) backend of Konflux c.f https://github.com/joelcapitao/bib-fcos-experimentation/blob/ae66a59e3ef2f519af024ac1af149080adbb38d7/.tekton/tasks/image-builder.yaml#L475

github-advanced-security AI found potential problems Jun 30, 2026

View reviewed changes

Comment thread copr-build-image-bootc.sh

|| exit 1

else

sudo podman pull $IMAGE || exit 1

podman pull $IMAGE || exit 1

gemini-code-assist Bot reviewed Jun 30, 2026

View reviewed changes

FrostyX added 2 commits June 30, 2026 16:26

Don't use sudo podman aka rootless builds

824f515

There is an experimental support for rootless builds https://osbuild.org/docs/bootc/#rootless

Drop hash for easier development

be31b09

FrostyX force-pushed the rootless branch from c9459b1 to be31b09 Compare June 30, 2026 14:28

FrostyX changed the title ~~Support rootless builds~~ Don't use sudo podman aka rootless builds Jun 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Don't use sudo podman aka rootless builds#46

Don't use sudo podman aka rootless builds#46
FrostyX wants to merge 2 commits into
fedora-copr:mainfrom
FrostyX:rootless

FrostyX commented Jun 30, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Uh oh!

FrostyX commented Jun 30, 2026 •

edited

Loading

Uh oh!

FrostyX commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

FrostyX commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Jun 30, 2026

Choose a reason for hiding this comment

Uh oh!

FrostyX commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FrostyX commented Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

FrostyX commented Jun 30, 2026 •

edited

Loading

FrostyX commented Jun 30, 2026 •

edited

Loading