Bootc: OCI Images That Boot Directly to Bare Metal

▶ Watch (0:30)

Bootc has been a CNCF sandbox project since Salt Lake in 2024. The model packs a Linux kernel, bootloader, and supporting files into a standard OCI image. That image deploys directly to bare metal or virtual machines, with no intermediate container runtime. None of the container annotations in the OCI image apply. The system boots straight into your Linux kernel and systemd. Updates are image-based and transactional, giving clean integration with security tooling and podman. The image can also be written directly to disk.

Three New Bootc Features Worth Knowing

▶ Watch (1:20)

Systemd soft reboots let bootc queue a new OS image without cycling through hardware and kernel initialization, as long as no kernel state changed. A separate tool, systemd-reinstall-bootc, converts a running system into a bootc system, useful for brownfield migrations. Integration with Kured, which orchestrates updates inside a Kubernetes cluster, also now works. Walters said someone told him bootc and Kured “just works.” Each feature targets a different part of the deploy and update cycle, from initial conversion through ongoing cluster management.

BCVK: Closing the Gap Between Container Build and Production VM

▶ Watch (2:05)

BCVK, the Bootc Virtualization Kit, is new. After a podman build, instead of updating an existing system in place, BCVK lets you run that container as a full ephemeral VM. The kernel, initramfs, and systemd all come from the container. The container root is mounted via virtFS, which keeps startup fast. Walters described it as sitting between podman run and a production deploy on cloud or bare metal. It also streamlines integration with libvirt. Walters suggested the same approach could run inside kubelet by default, since kubelet already has a container runtime.

Composefs: Versioned, Immutable, Integrity-Checked Storage

▶ Watch (3:16)

Composefs is a separate CNCF project, donated at the same time as bootc. The goal is a versioned, immutable file system with on-disk integrity. The architecture splits metadata from data. A small metadata-only filesystem holds symlinks and can have fsverity enabled. The data plane stores plain files in an object store, also with fsverity. That chain produces DMverity-style integrity while sharing on-disk and in-memory data across images. The original C implementation is stable. A rewrite in Rust is close to stable and is what Walters called out as especially exciting.

End-to-End Integrity from Power-On to App Container

▶ Watch (4:15)

With bootc, integrity starts at system power-on through secure boot. The firmware chain integrates with the Unified Kernel Image (UKI), a systemd project. The digest of the composefs object is embedded in the UKI inside the container image. That chain covers every file built into the OCI image from the moment the machine starts. Walters also described plans to extend this integrity model to generic OCI images, covering apps run through podman, Flatpak, or containerd, not just the base OS image.

Notable Quotes

we chose to make our society dependent on computers. And I just like to say I think free and open source software, what we build here is super important to make sure businesses and people stay in control. Colin Walters · ▶ 00:15

the more I thought about this the more I realized we should actually do this by default in cubvert like because the coover already has a container runtime it could mount via verts and then it would be a production path just an idea if you’re a cubert dev in the audience Colin Walters · ▶ 03:02

we have a very ambitious goal, which is basically to become a really good versioned immutable file system storage system that supports uh on disk integrity Colin Walters · ▶ 03:24

Key Takeaways

  • Bootc embeds a full Linux kernel in an OCI image and boots it directly to bare metal or VMs.
  • BCVK adds an ephemeral VM step between podman build and a production deploy, mounted via virtFS.
  • A Rust rewrite of composefs nears stability, bringing DMverity-style integrity to all OCI image content.

About the Speaker(s)

Colin Walters is a Distinguished Engineer at Red Hat, Inc. He works on bootc and other projects at Red Hat, Inc., and has contributed to free and open source software for 27 to 28 years.