OCI images for Ignite (via Firecracker) / Footloose

[travier]

This feature request is extracted from the discussion at #144 as it needs significant work to happen and is thus a request distinct from producing and supporting Vagrant images.

Ignite (based on Firecracker) and Footloose require OCI images to run Linux based OS either in a Firecracker microVM or directly in a container. We currently do not create OCI images as it is not the goal of Fedora CoreOS to be the base layer of a container image for applications (you can use standard Fedora or RHEL UBI for that, or any other base images).

On top of OCI images being available, there are upstream changes to Ignite and Footloose that are required to support running with a subset of Fedora CoreOS features:

• Ignite:

  • Support for passing Ignition configs (need investigation). Some Ignition features may not work.
  • Support for extracting the kernel, initrd & kargs to pass them directly to firecraker.
  • Any rpm-ostree feature (updates, package overlays, setting kargs) will not work.

• Footloose:

  • Any rpm-ostree feature (updates, package overlays, setting kargs) will not work as Footloose does not run VMs thus we do not run a kernel, do not have a bootloader, etc.
  • ostree root setup (done in the initrd) as to be replicated in Footlose.

[jdoss]

I would love to be able to have a FCOS rootfs that would let me configure it with an Ignition configuration to get a microVM launched with Firecracker. Maybe this is a different issue as I don't specifically ant to use Ignite. Let me know this needs a different issue.

My ideal state would be to provide a kernel and a rootfs that would be configured via Ignition on boot. This would allow for small and flexible workloads to be able to be launched quickly. Not having updates is OK in my mind because I would rather do the updates to the rootfs/kernel via CI and new microVMs are launched if we want to apply updates in production.

[dustymabe]

@travier - any updates here?

[travier]

The work on shipping FCOS as a container might unblock things here. I'm not working on this and only reported that to make the discussion clearer in the parent issue.