Here’s the concrete sysext plan I’d use.
Goal
Build an incus.raw system extension that overlays only /usr, while keeping Incus state on the host in /var/lib/incus, /var/cache/incus, /var/log/incus, and /run/incus.
1. Define The Artifact
Create a separate dakota-incus-sysext build artifact, initially out-of-tree.
The sysext should contain:
name: humanizer version: 2.5.1 description: | Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, passive voice, negative parallelisms, and filler phrases.
mkosi uses GNU tar with --xattrs --pax-option=delete=atime,delete=ctime,delete=mtime to create OCI tar layers. This produces PAX extension headers that composefs-rs's custom Rust tar parser can't handle correctly. composefs-rs has an open issue (#2) acknowledging their "home-brew header handling code" needs PAX cleanup, but no fix is imminent.
The test script workaround sidesteps PAX headers but is lossy:
| === Step 7: Run tests === | |
| --- Running: 01-installation.sh --- | |
| 01-installation.sh 100% 1605 7.2MB/s 00:00 | |
| # Tier 1: Installation validation | |
| # system state: running | |
| ok - System has booted | |
| ok - Root filesystem is read-only | |
| ok - Composefs is active | |
| ok - usr is read-only |
You can keep secure boot on, snow supports chained secure boot from debian's shim.
| #!/bin/bash | |
| set -e | |
| # This script converts a raw image with 512 byte sectors to an iso with 2048 byte sectors. The conversion | |
| # allows for booting of the resulting iso as a (virtual) CDROM. | |
| if [ "$#" -ne 1 ]; then | |
| echo "Usage: $0 <input img>" | |
| exit 1 |
| #!/bin/bash | |
| # filepath: /opt/scripts/daily_backup_docker_stacks.sh | |
| set -e | |
| # Configuration | |
| ## dockge stack directory | |
| COMPOSE_ROOT="/opt/stacks" | |
| ## persistent data directory | |
| PERSIST_ROOT="/opt/persist" |
| #!/bin/bash | |
| # copy dev container files from the template directory into the current directory | |
| dc() { | |
| local template_dir=~/projects/templates | |
| # get the first argument | |
| local template=$1 | |
| if [ -z "$template" ]; then | |
| echo "Please provide a template parameter. Options:" | |
| # list all the templates in the template directory |
| sudo bootc switch ghcr.io/ublue-os/bluefin-dx:beta | |
| layers already present: 2; layers needed: 70 (4.7 GB) | |
| Fetched layers: 4.35 GiB in 2 minutes (32.22 MiB/s) /proc/self/fd/30/usr/etc/selinux/targeted/contexts/files/file_contexts.bin: line 1 error due to: Non-ASCII characters found | |
| /proc/self/fd/30/usr/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin: line 1 error due to: Non-ASCII characters found | |
| ⠈ Deploying /proc/self/fd/24/usr/etc/selinux/targeted/contexts/files/file_contexts.bin: line 1 error due to: Non-ASCII characters found | |
| /proc/self/fd/24/usr/etc/selinux/targeted/contexts/files/file_contexts.homedirs.bin: line 1 error due to: Non-ASCII characters found | |
| ⠈ Deploying | |
| (bootc:22581): GLib-CRITICAL **: 15:35:26.687: g_atomic_ref_count_dec: assertion 'old_va |
