Learn Rocky Linux - Bootable Containers (bootc) & Image Mode

#Introduction

In the previous episode 17, you tuned system performance. Now we step into one of the most interesting changes in the Linux server world: image mode. Imagine the entire operating system — kernel, libraries, configuration — packaged as a single container image. Not just a container on top of an OS, but the OS itself becoming the image.

This approach, called bootc or bootable container, fundamentally changes how servers are managed. Upgrades are no longer "hoping dnf works smoothly", but "pulling a new image and rebooting" — exactly like pulling a new container image. This episode takes you into that world.

#Image Mode and Basic Concepts

#OS as a Container Image

In image mode, the operating system is distributed as a container image that contains the entire OS filesystem. Its metadata is stored in the container labels, including the /usr/lib/ostree/container file and special labels:

podman inspect --format '{{.Labels}}' quay.io/rockylinux/rockylinux:10

cat /usr/lib/ostree/container

The container file inside the image holds a reference to the container image this system came from — the identity that enables image-based updates and rollbacks.

#Why Image Mode

Image mode's advantages are manifold: full consistency (every server is identical from the same image), atomic updates (always in a complete state), instant rollback to the previous image, and CI/CD-based validation — OS images are tested like applications before release.

#Managing with Bootc

#Checking Status

bootc is the management tool for bootable containers. Start with status:

bootc status

bootc --version

#Switch Image

Moving from one OS image to another — or upgrading to a new image — is done with bootc switch:

bootc switch quay.io/rockylinux/rockylinux:10

bootc upgrade

#Atomic Updates and Rollback

Updates in image mode are atomic: the system pulls a new image, marks it as the next deployment, then reboots. If there's a problem, roll back to the previous deployment:

bootc status

bootc rollback
reboot

bootc rollback returns to the previous deployment instantly — a safety net far more reassuring than recovering from a backup.

#Building a Custom OS Image

#Containerfile for an OS

A custom OS image is built like a regular container image — with a Containerfile that installs packages via dnf:

FROM quay.io/rockylinux/rockylinux:10
 
RUN dnf5 -y install \
      openssh-server \
      firewalld \
      tuned \
    && dnf5 clean all
 
RUN systemctl enable sshd
RUN systemctl enable firewalld

podman build -t localhost/rocky-web:v1 .

Note the new pattern: systemctl enable inside the image marks services to be active at boot — systemd understands units in image mode without a running daemon.

#Bootc-Image-Builder

An image built with a Containerfile is a regular container image. To turn it into an installable OS image for disk, use bootc-image-builder:

podman run --rm -it \
  --privileged \
  --pull=newer \
  -v ./output:/output \
  -v /var/lib/containers/storage:/var/lib/containers/storage \
  quay.io/centos-bootc/bootc-image-builder:latest \
  --type qcow2 localhost/rocky-web:v1

ls -lh output/

bootc-image-builder produces installable artifacts — qcow2, ISO, or cloud formats — from an OS image, ready for VM, cloud, or bare metal.

#Running Image Mode

To test an image, run it directly with Podman (episode 20):

podman run --rm -it localhost/rocky-web:v1 bash

cat /usr/lib/ostree/container

The ability to run an "OS" as a container is an interesting bridge between containers and operating systems — and it gives you a way to test OS images quickly before deploying them.

#Image Mode Deployment

#UBC and the Ecosystem

Image mode lives in the Universal Base Container (UBC) ecosystem — container images used as the base for building both OS images and application images. The modern deployment flow:

1. The OS image is built in a CI pipeline and pushed to a registry.
2. A server pulls it from the registry with bootc switch and reboots.
3. The next server is deployed by pulling the same image — identical with zero configuration drift.

skopeo inspect docker://quay.io/rockylinux/rockylinux:10

This approach fits perfectly with GitOps and configuration management: OS images are versioned, reviewed, and tested like application code — then rolled out to thousands of servers with consistent results.

#Closing

In this episode 18, you understood Rocky Linux image mode: the concept of the operating system as a container image with identity in /usr/lib/ostree/container, management with atomic bootc switch, upgrade, and rollback, building custom OS images with a Containerfile and bootc-image-builder, and image-based deployment with the UBC ecosystem.

Key takeaways:

• Image mode packages the entire OS as a container image with atomic updates.
• bootc switch and bootc upgrade change the system; bootc rollback restores it instantly.
• OS images are built with a Containerfile using dnf5 install and systemctl enable.
• bootc-image-builder produces installable artifacts like qcow2 from an OS image.
• Image mode deployment ensures full consistency across servers and CI/CD integration.

In the next episode 19, we will discuss virtualization with KVM/libvirt — installing the virtualization group, provisioning VMs with virt-install, managing with virsh, storage pools and volumes, and bridged networking and snapshots. The system can now be imaged; next up, running many systems on one piece of hardware!