Project Lightning Talk: What's Exciting Now In Bootc, And What's Next? - Colin Walters, Maintainer

This talk covers the latest developments in Bootsie and ComposifS, two promising projects under the Cloud Native Computing Foundation (CNCF). The speaker, Colin Walters, introduces Bootsie, which serves as an image-based update system designed for direct deployment to bare metal or virtual machines, eliminating the need for intermediate container runtimes. Key features include integration with systemd soft reboots and a new tool called system reinstall Bootsie for converting existing systems. Additionally, the conversation shifts to ComposifS, an ambitious initiative aimed at creating a versioned immutable file system with disk integrity support. The architecture separates metadata from data, enhancing integrity and sharing capabilities, and the project is transitioning to a stable Rust version. Overall, the speaker emphasizes the importance of integrity in both projects and their potential applications.

Thanks all. So I'm super excited to talk to you guys today about what's new in Bootsie and ComposifS, two CNCF projects. My name is Colin Walters. Been working on free and open source software for like 27 28 years now. Uh and the reason why is basically well, you know, we chose to make our society dependent on computers. And I just like to say I think free and

open source software, what we build here is super important to make sure businesses and people stay in control. So that's what motivates me, right? Like that's why I build the technology. So let's talk about Bootsie first. uh we've been CNCF sandbox since salt lake in 2024 and just in a nutshell right with the bootc model there is a kernel a Linux kernel and a bootloadader and some

other stuff in your OCI image and the idea is that you can deploy that we use OCI as a transport and you can deploy that directly to bare metal or virtual machines there's no intermediate container runtime you know none of the uh container annotations in the OCI image apply we just directly run in your Linux kernel, systemd, all that stuff. And we're an image based update system,

right? So you have transactional updates, good integration with security tools, all that stuff. And good integration with systemd as we'll see, and also good integration with podman. And you can install that container directly to a disk. So that was bootsy in a nutshell. Let's talk about bootsy features. So one of the things I like is we add a good integration with systemd soft reboots. The idea is

you're running your image, you've built your OS, but now you want to deploy a new update. If you didn't change any kernel state, basically boots can prepare the next route and cue it for systemd to switch route to it. So you don't pay the cost of transitioning through hardware and uh kernel initialization. So that's nice. We also have uh a new tool called system reinstall bootsy that

helps you uh convert an existing system a running one into a bootsy system which is uh very handy for some uh brownfield work. And of course, we're building out integration with other CNCF projects like Kurd, which orchestrates updates in your Kubernetes cluster. I had someone tell me Bootsie and Kurd, hopefully I'm pronouncing that right, just works. And there's a lot more. But let's dive in. So that

was Bootsie. Something that is brand new since uh as of pretty recently is called BCVK. And basically the idea is it's Bootsie Virtualization Kit. So the idea is you have a you do a podman build. You got your container there. Now you can update an existing system in place, right? You can iterate that way. But sometimes you just want to quickly run that container as a VM,

but again with the kernel and an RAM FS and systemd all from your container. We're not trying to make microVMs. It's it's basically a quick but full ephemeral VM. And the idea is that we mount the container route via VertS. So this gets you like a really quick iteration cycle. gives you another space between basically podman build or podman run or docker run to uh to an

ephemeral VM but then we can also use that to streamline integration with livert so it's a pre-production tool but it helps close that dev cycle before you go deploy on cloud or bare metal so brief interlude the more I thought about this the more I realized we should actually do this by default in cubvert like because the coover already has a container runtime it could mount via

verts and then it would be a production path just an idea if you're a cubert dev in the audience So that's all about Bootsie, but we have C Composer Fest, which is also a separate CNCF project donated at the same time. And there's been a lot going on in it. I'm really excited to talk about it because we have a very ambitious goal, which is basically to

become a really good versioned immutable file system storage system that supports uh on disk integrity. So the the architecture in a nutshell is we split the metadata plane from the data plane. We have a tiny little metadata only a fs that has your sim links all that stuff and you can enable fsvarity on that and then the data plane is plain objects in an object store plain

files that also have fsver varity. The combination of this chain of stuff gets you DMverity style integrity but compos gets you sharing of on disk uh and in memory data and uh the initial C version is stable but we got a next generation written in rust that we're aiming to stabilize very soon and definitely very excited about that. So here's the integrity story in a nutshell. So

the first one with bootsy the idea is we have integrity from system power on through secure boot you know your computer comes up through the firmware and you integrating with a systemd created project called the UKI basically we embed the digest of that compos in the UKI that's in your container image and then you get from system power on integrity of all the files that you built

into your OCI image. What I'm really excited about though is we have plans to extend this to the composer model to generic OCI images so that you have that kind of integrity also for you know your apps that you run through podman or flatp pack containerd that type of stuff. Um so if interested in any of all these technologies uh or you just want to pitch your

most favorite feature come talk to us we'll be at the community pavilion. There's a QR code um for feedback about the talk and that's it. I'm out of time. Thank you. >> Wow right on time. Thank you, Colin.