composefs: Add support for android boot (both regular and ukiboot) by alexlarsson · Pull Request #2490 · bootc-dev/bootc

alexlarsson · 2026-09-23T17:38:12Z

Add experimental aboot support to the composefs backend. This supports both
Android boot v2 images on systems with boot_a/boot_b partitions and no ESP,
and ukiboot images on systems with an ESP.

The series adds bootc container aboot to build boot artifacts, teaches
container inspect and composefs installation to recognize them, and implements
slot-aware status, updates, rollback, reconciliation, and garbage collection.
Updates are staged without writing a boot partition; at shutdown, bootc
verifies the artifacts and uses aboot-deploy to flash the inactive slot.

There is also some generic changes:

Include dtb in deploy digest
Show queued rollbacks in bootc status.

This is marked draft atm, because it pulls in the composefs-rs branch from composefs/composefs-rs#399. Once that is landed we should do a release and update bootc to that instead.

I have follow-on work to use this to build images, which I have used to test stuff:

I was able with this to use a Dockerfile to build Fedora 44 images that boot on x86_64/aarch64 with ukiboot, and aarch64 with u-boot with android boot support. I think we can later add some integration test for this, but atm its a bit painful until all the other dependency changes have landed.

cgwalters · 2026-09-23T19:15:42Z

+
+```toml
+[install]
+bootloader = "none"


Echoing a comment from before, can't we just detect aboot.img (and aboot-update and do this by default)?

Should we also require bootupd to not be present? I think we should - that's how the current systemd-boot flow is supported.

I changed the code to automatically detect this, so there is no need to specify bootloader.

I'm not sure if refusing to use it if bootupd is present is necessarily very helpful though? What exactly is the point of that?

I'm not sure if refusing to use it if bootupd is present is necessarily very helpful though? What exactly is the point of that?

I think either an image should support/use bootupd or it doesn't.

There's some messy things, like we ended up with bootupd even on s390x/zipl even though it doesn't do anything there. Some discussions have tended to we should always have bootupd even if it's a no-op, which personally I find confusing.

AFAICS this use case won't gain anything from it, so we should just not have it installed.

I'm not saying it would gain anything from it, and you shouldn't normally have bootupd installed. But, I can also see it running into issue when you're for random reasons get bootupd into an image (say inherited from some base image) and suddenly its refusing to work for a not entirely clear reason.

cgwalters · 2026-09-23T19:17:32Z

+bootloader = "none"
+```
+
+The disk layout must (in `disk.yaml`) provide the platform's `boot_a` and `boot_b`


disk.yaml is an image builder concept, let's describe it slightly more generically (for example it might be good to have an example specification of these in systemd-repart format?)

That said...one thing we could do is change to-disk (our default partitioner) to include repart definitions (after #2314 ) lands and automatically use them if aboot.img is detected.

I rewrote the docs to be more generic. Working on install to-disk separately

cgwalters · 2026-09-23T19:24:58Z

+An update stores the new boot image (and optional vbmeta image) under
+`/state/deploy/<deployment-id>/aboot/`. A persistent pending record under
+`/state/boot/aboot/` tracks those artifacts and their hashes. Staging does not write
+either boot partition. At shutdown, bootc verifies the artifacts, records the attempt, and
+calls `aboot-deploy` to flash the inactive slot.
+


I'd like to study/understand this more, it's part of the core control loop and I don't think we got it quite right with ostree, would be good not to repeat that.

I want to be crystal clear about what is source of truth vs not, what needs to be persistent etc.

Lets take this discussion to #2491, but I'm very interested in how you think ostree got this wrong.

cgwalters · 2026-09-23T19:25:28Z

+`bootc container aboot` computes the V1 and V2 composefs digests of the rootfs,
+adds both to the kernel command line, and invokes `aboot-update` to create the
+artifact. See [EROFS formats](experimental-composefs.md#erofs-formats) for why
+both digests are included. `/etc/aboot.cfg` controls whether `aboot-update`


(We should evnetually support a /usr/lib variant too I think)

Yeah, probably,

cgwalters · 2026-09-23T19:35:36Z

Copying over composefs/composefs-rs#399 (comment) - would have been nice to have a rough sketch of a design draft for this linked and gather a bit of consensus on it.

Could have basically just been fe1ea1a#diff-8df22b9d26bdc5a49b7c7557b59e35583771fb6bd56bb735479048f176cec622 filed as an issue?

It may still be worth filing one as the right place to discuss high level things as opposed to implementation code concerns.

alexlarsson · 2026-09-24T07:18:09Z

@cgwalters I've done this work as much to learn about the composefs bootc backend as to do the work, because I had not looked at it before. So, it would have been hard for me to come up with the design up front. However, I agree that we need a highlevel discussion, and that will fit better in an issue, then we can do the code nitpicking here later. I'll type one up to get us started.

alexlarsson · 2026-09-24T13:54:37Z

I moved the independent stuff to separate MRs and rebased this.

alexlarsson · 2026-09-25T11:49:37Z

I rebased on master and fixed some CI failures. I also changed things around so now we just always auto-detect the backend, no need to hand-specify a bootloader.

This changes some APIs, and we need the corresponding changes in bootc from: bootc-dev/bootc#2490 We'll re-enable this once that is merged. Signed-off-by: Alexander Larsson <alexl@redhat.com>

alexlarsson · 2026-09-28T20:24:29Z

I updated this to the composefs-rs 0.9.3 release and removed the draft marking.
I think this is good enough as an initial experimental version at least.

This changes some APIs, and we need the corresponding changes in bootc from: bootc-dev/bootc#2490 We'll re-enable this once that is merged. Signed-off-by: Alexander Larsson <alexl@redhat.com>

alexlarsson · 2026-09-30T11:20:04Z

Rebased on main

Johan-Liebert1 · 2026-09-30T11:45:53Z

                handle_bls_conf(storage, cfs_cmdline, boot_dir, true)?;
            }
        },
+        BootType::Aboot => anyhow::bail!("aboot backwards compatibility is not implemented"),


I think we would want to make this a no-op with a debug log maybe. Erroring out doesn't seem right. This code shouldn't run for aboot anyway as the backwards compatibility stuff here completely predates aboot support

Yeah, i made this a debug log instead.

alexlarsson · 2026-09-30T16:13:24Z

I don't understand why the cs9 integration fails. It seems to not be able to download the yum metadata for baseos.

Also, i started working on a "install to-disk" implementation, however I ran into a swap issue: bootc-dev/bcvk#390. I'd like to get this PR landed before I start adding more aboot stuff though.

alexlarsson · 2026-10-01T07:22:36Z

rebased to fix conflict

alexlarsson · 2026-10-01T14:08:55Z

rebased again to fix conflict

This adds support for android boot. Signed-off-by: Alexander Larsson <alexl@redhat.com>

Add the Aboot boot type and map composefs-boot aboot entries to it. Reject aboot operations before modifying bootloader state until the deployment and lifecycle paths are implemented. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

Move kernel selection, composefs digest calculation, and kernel command-line assembly out of the ukify implementation. This prepares the same inputs for reuse by the aboot image builder. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

This is similar to `bootc container ukify`, but builds aboot images using aboot-update. Signed-off-by: Alexander Larsson <alexl@redhat.com>

…boot() This is just some code motion that will make later changes easier to do. Signed-off-by: Alexander Larsson <alexl@redhat.com>

If the container has an aboot-*.img file, then its type is aboot or aboot-efi (depending on the payload type). We also add this to the json output. This will be read by e.g. image-builder. Signed-off-by: Alexander Larsson <alexl@redhat.com>

Allow composefs installation with Android boot v2 and ukiboot payloads. Validate the embedded composefs command line and record a boot digest covering the kernel, initrd, and optional DTB. This automatically Use bootloader=none for aboot v2 images without requiring an ESP. For ukiboot images it uses bootloader=ukiboot and provisions the EFI loader and slot addons. Prefer files from /boot in the untransformed source image, allowing signed binaries to override the packaged copies under /usr. Partition payloads remain the responsibility of the image builder. Updates, slot tracking, and post-boot management are left for later. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

Aboot systems do not use BLS entries or necessarily have an ESP, so identify them from the booted deployment origin before initializing boot storage. Record the deployment observed in the active A/B slot using a generated reconciliation service. Add a mutation lock for future update operations and helpers to atomically record or invalidate slot mappings. An absent mapping represents an invalid slot and does not retain a deployment. Skip ESP discovery and legacy boot-entry migration for aboot systems. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

Build aboot status from the running deployment, transient staged state, and valid observed slot mappings without inspecting BLS or ESP files. Use the resulting deployment list as the GC roots for aboot. Treat missing or malformed slot mappings as invalid, skip bootloader artifact cleanup, and leave shared objects to repository reachability GC. Keep soft reboot disabled and explicitly reject rollback and deployment deletion until controller-aware implementations are available. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

Implement staging, finalization, and boot-time reconciliation for aboot deployments. Stage the boot image and optional vbmeta alongside the deployment and record their hashes in persistent pending state. At shutdown, verify the payloads, record the attempt, invalidate the non-booted slot mapping when known, and invoke aboot-deploy. On the following boot, use the active deployment to determine whether the attempt succeeded. Clean up successful attempts while retaining failed candidates without automatically retrying them. Persist download-only state, support applying previously downloaded updates, and reconstruct the transient staged state during reconciliation. Assisted-by: AI Signed-off-by: Alexander Larsson <alexl@redhat.com>

alexlarsson · 2026-10-02T10:13:03Z

rebased to fix conflicts

Signed-off-by: Alexander Larsson <alexl@redhat.com>

github-actions Bot added area/install Issues related to `bootc install` area/documentation Updates to the documentation labels Sep 23, 2026

bootc-bot Bot requested a review from cgwalters September 23, 2026 17:38

cgwalters mentioned this pull request Sep 23, 2026

Add support for android boot composefs/composefs-rs#399

Merged

cgwalters reviewed Sep 23, 2026

View reviewed changes

Comment thread crates/lib/src/bootc_composefs/boot.rs

alexlarsson mentioned this pull request Sep 24, 2026

Support aboot in composefs backend #2491

Open

alexlarsson force-pushed the aboot-support branch from fe1ea1a to 293d135 Compare September 24, 2026 13:53

alexlarsson force-pushed the aboot-support branch from 293d135 to 1f705ac Compare September 25, 2026 11:41

alexlarsson mentioned this pull request Sep 28, 2026

Add support for aboot images and aarch64 bootc-dev/bcvk#385

Merged

alexlarsson force-pushed the aboot-support branch from 1f705ac to b8caa13 Compare September 28, 2026 20:21

alexlarsson marked this pull request as ready for review September 28, 2026 20:22

bootc-bot Bot requested a review from jeckersb September 28, 2026 20:23

alexlarsson force-pushed the aboot-support branch from b8caa13 to 05705fe Compare September 28, 2026 20:23

alexlarsson force-pushed the aboot-support branch 3 times, most recently from 72e8eec to 0d03ff7 Compare September 30, 2026 10:53

github-actions Bot added the area/ostree Issues related to ostree label Sep 30, 2026

alexlarsson force-pushed the aboot-support branch 4 times, most recently from 05705fe to f39c6af Compare September 30, 2026 11:19

alexlarsson force-pushed the aboot-support branch from f39c6af to a70dc59 Compare September 30, 2026 11:43

Johan-Liebert1 reviewed Sep 30, 2026

View reviewed changes

alexlarsson force-pushed the aboot-support branch 5 times, most recently from 19f2b94 to feee29b Compare September 30, 2026 14:12

cgwalters-bot mentioned this pull request Oct 1, 2026

bootc composefs: test architectures beyond x86_64 (incl. s390x/zipl) cgwalters-forge/tracker#260

Open

alexlarsson force-pushed the aboot-support branch from feee29b to 5fc1904 Compare October 1, 2026 07:17

alexlarsson force-pushed the aboot-support branch from 5fc1904 to 3b79d6b Compare October 1, 2026 14:08

alexlarsson force-pushed the aboot-support branch from 3b79d6b to 3f87769 Compare October 2, 2026 09:39

alexlarsson added 10 commits October 2, 2026 11:43

Bump composefs-rs to 0.9.3

c20dd13

This adds support for android boot. Signed-off-by: Alexander Larsson <alexl@redhat.com>

Add bootc container aboot to create aboot images

77debad

This is similar to `bootc container ukify`, but builds aboot images using aboot-update. Signed-off-by: Alexander Larsson <alexl@redhat.com>

bootc: Break out install_composefs_bootloader() from setup_composefs_…

2dbacd6

…boot() This is just some code motion that will make later changes easier to do. Signed-off-by: Alexander Larsson <alexl@redhat.com>

alexlarsson force-pushed the aboot-support branch from 3f87769 to 680b288 Compare October 2, 2026 10:12

Add basic experimental aboot support docs.

955a534

Signed-off-by: Alexander Larsson <alexl@redhat.com>

alexlarsson force-pushed the aboot-support branch 2 times, most recently from 219af05 to 955a534 Compare October 2, 2026 14:55

cgwalters added this to the 1.17 milestone Oct 2, 2026

Conversation

alexlarsson commented Sep 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cgwalters commented Sep 23, 2026

Uh oh!

alexlarsson commented Sep 24, 2026

Uh oh!

alexlarsson commented Sep 24, 2026

Uh oh!

alexlarsson commented Sep 25, 2026

Uh oh!

alexlarsson commented Sep 28, 2026

Uh oh!

alexlarsson commented Sep 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexlarsson commented Sep 30, 2026

Uh oh!

alexlarsson commented Oct 1, 2026

Uh oh!

alexlarsson commented Oct 1, 2026

Uh oh!

alexlarsson commented Oct 2, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants