What’s new in image mode for RHEL in 9.5?

Image mode for Red Hat Enterprise Linux (RHEL) makes the operating system as simple to build, deploy, and manage as a containerized application. It has been an exciting time to see so many customers and users in the community engaged and focused on driving more of their infrastructures with container workflows. The opportunity to grow the value proposition of containers beyond applications is certainly resonating. If you are new to this concept and wondering where this might be useful please take a look at some of the use cases. Let’s dive into the release!

TL;DR for RHEL 9.5

There is a lot to explore in 9.5! First, image mode remains in technology preview. Bootc’s API and interfaces are now considered stable, promising a smooth upgrade experience moving forward. The command-line interface (CLI) has a better human-readable output and we’re introducing the ability to bind containerized applications to the host operating system through bootc’s new logically bound images. Bootc also introduces a new interface for configuring kernel arguments. Next, bootc-image-builder gains the ability to create production-ready images in more formats. Specifically, 9.5 adds Azure and Google Cloud Platform (GCP) image types, more control and customization of filesystem layouts, and the ability to embed customized kickstart configs into offline bare metal installer ISOs. 

rhel-bootc

Image mode for RHEL is delivered as a container image called rhel-bootc. 9.5 brings rhel-bootc to more architectures, specifically aarch64 and s390x — ppc64le will be coming soon. Each release includes a software bill of materials, or SBOM, to make introspection of the image easy to integrate with a number of security tools. On the management side, Red Hat Lightspeed (formerly Red Hat Insights) offers a powerful suite of tools that provide visibility and control of image mode (immutable) systems side by side with package mode (traditional, mutable RHEL) systems. Users are encouraged to include our example here into their Containerfiles to register systems with Red Hat Lightspeed.

Bootc v1.x

The core technology that enables image mode is called bootc (boot container) and it remains in a technology preview in 9.5 with the goal of being fully supported in 9.6. Despite being in a preview state, the project has reached a major milestone and the CLI and internal APIs of bootc are mature enough to be declared stable. This is important for integration work and also allows existing installs to upgrade to future, supported releases. Bootc also introduces a feature called "logically bound images" which was introduced with Red Hat Enterprise Linux AI. We now have an update mechanism for containers that need to be versioned with the operating system (OS). This solves a historically difficult challenge for containers that have deep OS-level dependencies and need to move in lock-step with the OS. To learn more please take a look at Chris Kyrouac’s deep dive. 

Security first

RHEL has a history that is deeply rooted in security. Many of our users are required to abide by the Federal Information Processing Systems (FIPS) standards to ensure only approved cryptographic algorithms are used. In order to make sure a RHEL host is operating in FIPS mode, a boot option has to be added to the kernel command line. Since we are working with container images and build tools with image mode, it begs the question: "How does one configure things like kernel arguments in a container image?" Great question! With 9.5, bootc gains a new facility to set and update kernel arguments. We’ll explore this using FIPS mode as an example.

Kernel arguments can easily be configured via TOML config files under /usr/lib/bootc/kargs.d/. To set fips=1 as a kernel argument, create a file called 01-fips.toml that includes the content: kargs = [“fips=1”] 

Once that is in place here are the relevant parts of an example Containerfile to build it this into your image:

FROM registry.redhat.io/rhel9/rhel-bootc:9.5
COPY 01-fips.toml /usr/lib/bootc/kargs.d/
RUN update-crypto-policies --no-reload --set FIPS

This facility can be used to set any kernel argument and it makes it easy to manage one of the more opaque parts of the OS and easily adapt this over time via future images. If you are using the RHEL installer called Anaconda to deploy a bootc image, make sure to also use the bootloader kickstart argument as these kargs are not yet supported by Anaconda. We are working to change this in future releases. This FIPS example comes from our example repository on GitLab. We recommend checking this out for more tips and tricks on building container images. 

More platforms and image customization

One of the first things to understand with image mode is how the container image is deployed on the first boot. Essentially, these are regular container images but to boot them there is a "deployment" phase via bootc install to-filesystem where the container is setup to a filesystem, the bootloader is installed, and etc. Anaconda includes this logic and is the perfect tool for bare metal, but for virtual machines (VMs) and cloud images, we included a version of image builder that makes this process simple. With 9.5 we add the image types vhd and gce for Azure & GCP respectively. We also have much more control of the final images, and specifically the filesystem layout. See below:

[[customizations.filesystem]]
mountpoint = "/"
minsize = "10 GiB"
[[customizations.filesystem]]
mountpoint = "/var/data"
minsize = "20 GiB"

For users who prefer the flexibility of LVM can also define an advanced layout. Here’s a more advanced example that will set:

[[customizations.disk.partitions]]
type = "lvm"
name = "second-one"
minsize = "50 GiB"
[[customizations.disk.partitions.logical_volumes]]
name = "rhel-root"
mountpoint = "/"
label = "system"
minsize = "20 GiB"
type = "xfs"
[[customizations.disk.partitions.logical_volumes]]
name = "rhel-var"
mountpoint = "/var"
label = "var"
minsize = "25 GiB"
type = "xfs"
[[customizations.disk.partitions.logical_volumes]]
mountpoint = "/var/log"
type = "xfs"
minsize = "4 GiB"
label = "log"
name = "rhel-var_log"

Another nice feature of bootc-image-builder is creating off-line installation images via Anaconda/kickstart. Users can now pass custom kickstart files to provide the exact configuration required for fully automated or, when desired, interactive installations. bootc-image-builder will handle the ostreecontainer command and ensure the embedded image is called. See below:

[customizations.installer.kickstart]
contents = """
text --non-interactive
zerombr
clearpart --all --initlabel --disklabel=gpt
autopart --noswap --type=lvm
network --bootproto=dhcp --device=link --activate --onboot=on
"""

Wrap it up

There has never been a better time to get started with image mode for RHEL. We encourage everyone to get hands-on using our intro lab, check out our documentation, and start thinking about where this fits in your environment. I want to thank the many engineers and community members who contributed to this release, and all of our wonderful customers who provided their input and feedback along the way. Many of us believe that image-based deployments of Linux is the future and the next wave for where the industry is headed. At Red Hat, we are passionate that the Linux Container ecosystem provides the best path to deliver on this vision.