-
Notifications
You must be signed in to change notification settings - Fork 97
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Install limited amount of modules for UKI Ubuntu #2566
Conversation
Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
That was fast! But this should be a separated image no? Or are we shipping this by default?
@Itxaka that's where I'm not sure, I don't see why not ship it like this and if we see that it doesn't work in many places then we go back to the "big" image, but in general I think the space issue will be a concern for any user |
I would say, we keep them separated until we can provide the modules/fw into the system with an extra step during install or image build or something no? Otherwise we are exchanging something that works out of the box for 95% of systems with something that might or might not work out of the box for an unknown percentage of systems with no workaround other than....rebuild the image yourself directly and install those packages. IMHO provided images by us should be pretty generic and support as much software as possible, even if we have to notice that some EFI implementations will not be able to boot those image, then point to this nano images as an alternative, less supported, more difficult ones. But that's just my opinion. For sure if someone is gonna consume this, we need to get them in our workflow to test them in case we add a dep like a module that is missing. The rest is up for debate. |
We probably are also winning in the EFI firmware part with smaller images. After all fedora does not ship so much stuff and seems ok... One for the other lol |
@Itxaka yeah good question, what is more generic, cuz if the image does not fit, then it doesn't matter that it has all the generics. But I don't have a strong opinion, we can go either or. I think this is something that maybe we can offer multiple options, with the least amount of firmware to all the firmware and let the user decide since they are the ones with the hardware |
Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
Yep indeed, I think it would be good to offer both options. Full firmware, most of the stuff supported out of the box. Downsides, it may not boot in all hardware. Lite, should boot in most of the systems out there. Downsides, it may not support all your hardware, might require post install steps to provide extra modules/firmware So we cover both ways and have alternatives for the uki stuff. |
I'm still getting a huge ISO from this branch:
am I supposed to pass a flag to earthly or something? |
@jimmykarily yes you need to pass |
|
I'm stupid 🤦 . This is not meant to build an iso ( |
Signed-off-by: Mauro Morales <contact@mauromorales.com>
Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [kairos-io/kairos](https://github.com/kairos-io/kairos) | minor | `v3.0.14` -> `v3.1.2` | --- > [!WARNING] > Some dependencies could not be looked up. Check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>kairos-io/kairos (kairos-io/kairos)</summary> ### [`v3.1.2`](https://github.com/kairos-io/kairos/releases/tag/v3.1.2) [Compare Source](https://github.com/kairos-io/kairos/compare/v3.1.1...v3.1.2) ####⚠️ The following issues have been resolved, so it is safe to upgrade again: Kairos user ids change on upgrade, breaking ssh login [#​2797](https://github.com/kairos-io/kairos/issues/2797) Long duration hang during boot [#​2802](https://github.com/kairos-io/kairos/issues/2802) #### What's Changed - 🤖 Check that install/recovery services are off during active boot by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2775](https://github.com/kairos-io/kairos/pull/2775) - 🐧 Disable pcrlock for all systemd distros by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2778](https://github.com/kairos-io/kairos/pull/2778) - 🐛 Empty machine-id instead of removing it by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2784](https://github.com/kairos-io/kairos/pull/2784) - 🐛 Fix +base-image for Remote Execution by [@​sdwilsh](https://github.com/sdwilsh) in [https://github.com/kairos-io/kairos/pull/2808](https://github.com/kairos-io/kairos/pull/2808) **Full Changelog**: kairos-io/kairos@v3.1.1...v3.1.2 ### [`v3.1.1`](https://github.com/kairos-io/kairos/releases/tag/v3.1.1) [Compare Source](https://github.com/kairos-io/kairos/compare/v3.1.0...v3.1.1) ### Upgrade issues Be advised that there is currently an issue when upgrading from 3.0.x to 3.1.x in which the user ids will change. This will result in any files owned by the user under its /home directory to lose permissions which can lead to not being able to ssh (ssh keys will have a different user id) We are currently working on a workaround, so you are advised to not upgrade until 3.1.2 is released with a fix for this. #### What's Changed Bug fixes 🐛 - Disable make cache timer on fedora by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2717](https://github.com/kairos-io/kairos/pull/2717) - It's not possible to login on an Alpine 3.19 RPi fixed by [@​Itxaka](https://github.com/Itxaka) [#​2439](https://github.com/kairos-io/kairos/issues/2439) - Expired password on system with no rtc (e.g. rpi4) on Alpine fixed by [@​Itxaka](https://github.com/Itxaka) [#​1994](https://github.com/kairos-io/kairos/issues/1994) - cgroup_memory not mounted in Alpine rpi4 fixed by [@​Itxaka](https://github.com/Itxaka) [#​2002](https://github.com/kairos-io/kairos/issues/2002) - reset from the GRUB menu on alpine, gets stuck in an endless loop [@​Itxaka](https://github.com/Itxaka) [#​2136](https://github.com/kairos-io/kairos/issues/2136) #### Known Issues - RPi EFI booting no longer supported on kernels shipped with Ubuntu 24.04+ [#​2249](https://github.com/kairos-io/kairos/issues/2249) **Full Changelog**: kairos-io/kairos@v3.1.0...v3.1.1 ### [`v3.1.0`](https://github.com/kairos-io/kairos/releases/tag/v3.1.0) [Compare Source](https://github.com/kairos-io/kairos/compare/v3.0.14...v3.1.0) ### Upgrade issues Be advised that there is currently an issue when upgrading from 3.0.x to 3.1.x in which the user ids will change. This will result in any files owned by the user under its /home directory to lose permissions which can lead to not being able to ssh (ssh keys will have a different user id) We are currently working on a workaround, so you are advised to not upgrade until 3.1.2 is released with a fix for this. #### Potential Breaking Changes By default, Uki artifacts (identified by the -uki suffix) no longer include Linux modules and firmware in the image. Real-world testing has shown that many EFI firmwares are very particular about the size of the EFI image, often refusing to boot if the file exceeds 300-400MB. Given the wide variety of EFI firmware implementations, predicting whether a UKI EFI file will boot on different hardware is challenging. To enhance compatibility, we decided to slim down the UKI files by removing the largest components: the Linux modules and firmware packages. This results in EFI files around 200-300MB, which are much more likely to boot correctly across various EFI implementations. However, this change comes with a trade-off. Smaller images, while being more compatible with a wide range of EFI firmwares, may lack comprehensive hardware support because they do not include all the Linux modules and firmware packages. This means that certain hardware components may not function correctly or optimally when using these slimmer UKI images. On the other hand, larger UKI images, which include all necessary modules and firmware for extensive hardware support, provide better functionality and compatibility with a broad range of hardware. However, these larger images are more likely to encounter boot issues due to EFI firmware limitations, as many EFI implementations refuse to boot files larger than 300-400MB. We publish -uki artifacts ourselves, which are the slimmed versions, as examples of how to build a slimmer UKI artifact. While these serve as a reference, we recommend always building your own custom images to tailor them to your specific hardware needs. If you need to include those packages for full hardware support, you can create a custom artifact to add them back, as detailed in the Kairos docs. We recommend keeping your UKI EFI files as small as possible to maximize boot success across different EFI firmware implementations. While smaller images offer better compatibility, they may lack full hardware support. Conversely, larger images, which include all necessary modules and firmware, provide comprehensive hardware support but may fail to boot due to EFI firmware constraints. Check out how to build your own base images with the [Kairos Factory](https://kairos.io/docs/reference/kairos-factory/) #### What's Changed 💿 UKI - UKI: measured systemd-sysext by [@​Itxaka](https://github.com/Itxaka) [#​2117](https://github.com/kairos-io/kairos/issues/2117) - UKI: Verify images signature before upgrade by [@​Itxaka](https://github.com/Itxaka) [#​2200](https://github.com/kairos-io/kairos/issues/2200) - UKI: Enroll keys during setup [#​2048](https://github.com/kairos-io/kairos/issues/2048) - Install limited amount of modules for UKI Ubuntu by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2566](https://github.com/kairos-io/kairos/pull/2566) 🐧 - Support for Ubuntu 24.04 LTS by [@​mauromorales](https://github.com/mauromorales) [#​2138](https://github.com/kairos-io/kairos/issues/2138) and deprecation of 23.10 - Support for Fedora 40 by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2502](https://github.com/kairos-io/kairos/pull/2502) and deprecation of previous versions - refactor debian dockerfile to build arm by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2542](https://github.com/kairos-io/kairos/pull/2542) - Bump opensuse Leap to 15.6 by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2623](https://github.com/kairos-io/kairos/pull/2623) 🐛 - fix(nvidia): do not ship nohang in nvidia-arm builds by [@​mudler](https://github.com/mudler) in [https://github.com/kairos-io/kairos/pull/2433](https://github.com/kairos-io/kairos/pull/2433) - Allow https protocol in ipxe by [@​jimmykarily](https://github.com/jimmykarily) in [https://github.com/kairos-io/kairos/pull/2468](https://github.com/kairos-io/kairos/pull/2468) - fix(orin): disable ISCSI in the initramfs generation by [@​mudler](https://github.com/mudler) in [https://github.com/kairos-io/kairos/pull/2474](https://github.com/kairos-io/kairos/pull/2474) - 🐛 Move nfs-utils to common build target in opensuse flavor by [@​kaiehrhardt](https://github.com/kaiehrhardt) in [https://github.com/kairos-io/kairos/pull/2495](https://github.com/kairos-io/kairos/pull/2495) - 🐛 Install cryptsetup for all arches in opensuse by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2691](https://github.com/kairos-io/kairos/pull/2691) 📖 - 📖 chore: fix typos by [@​xiaoxianBoy](https://github.com/xiaoxianBoy) in [https://github.com/kairos-io/kairos/pull/2441](https://github.com/kairos-io/kairos/pull/2441) - readme: add links to project governance by [@​mudler](https://github.com/mudler) in [https://github.com/kairos-io/kairos/pull/2498](https://github.com/kairos-io/kairos/pull/2498) - Update LICENSE by [@​mudler](https://github.com/mudler) in [https://github.com/kairos-io/kairos/pull/2503](https://github.com/kairos-io/kairos/pull/2503) - Add OpenSSF best practices badge by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2639](https://github.com/kairos-io/kairos/pull/2639) - Add clomonitor badge by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2640](https://github.com/kairos-io/kairos/pull/2640) - Link to GH Security Draft Advisory form by [@​mauromorales](https://github.com/mauromorales) in [https://github.com/kairos-io/kairos/pull/2650](https://github.com/kairos-io/kairos/pull/2650) 🔧 - More options for enki outputs by [@​Itxaka](https://github.com/Itxaka) in [https://github.com/kairos-io/kairos/pull/2515](https://github.com/kairos-io/kairos/pull/2515) #### New Contributors - [@​xiaoxianBoy](https://github.com/xiaoxianBoy) made their first contribution in [https://github.com/kairos-io/kairos/pull/2441](https://github.com/kairos-io/kairos/pull/2441) **Full Changelog**: kairos-io/kairos@v3.0.14...v3.1.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/marinatedconcrete/config). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40MjUuMSIsInVwZGF0ZWRJblZlciI6IjM4LjU2LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Shawn Wilsher <me@shawnwilsher.com>
Not sure if this is the right approach but since it's quite simple to test this with the multi stage dockerfile then I wanted to give it a go
Not an original idea, recommended by Kevin
relates to #2565