homelab-node (2018948d5cd5f9e0a582356601bff226c5e1f4e8)
Published 2026-09-28 04:19:29 +00:00 by alex
Installation
docker pull git.piqueras.me/alex/homelab-node:2018948d5cd5f9e0a582356601bff226c5e1f4e8sha256:3dd2c2412ac816fed2a39553ac49d4e03a305a83e20d8dc7a7c5073264ea76a5About this package
fedora-bootc with Ignition, k3s, tailscale, k3s-selinux, keepalived, iscsi, pam_oath, kanidm-unixd and the CSI connectto policy
Image layers
| ostree export of commit 236594078e6ff81f8c9163afb6060456aa46934338b9143a303b35fa2cfde1e4 |
| python3-botocore-1.43.96-1.fc44.noarch |
| nvidia-gpu-firmware-20260916-1.fc44.noarch |
| kernel-modules-7.2.6-200.fc44.x86_64 |
| kernel-modules-core-7.2.6-200.fc44.x86_64 |
| podman-5:5.8.7-1.fc44.x86_64 |
| atheros-firmware-20260916-1.fc44.noarch |
| python3-libs-3.14.7-1.fc44.x86_64 |
| libicu-77.1-3.fc44.x86_64 |
| rpm-6.0.2-1.fc44.x86_64 |
| linux-firmware-20260916-1.fc44.noarch |
| mt7xxx-firmware-20260916-1.fc44.noarch |
| qemu-user-static-mips-2:10.2.2-1.fc44.x86_64 |
| kernel-core-7.2.6-200.fc44.x86_64 |
| amd-gpu-firmware-20260916-1.fc44.noarch |
| skopeo-1:1.22.3-1.fc44.x86_64 |
| bootc-1.16.10-1.fc44.x86_64 |
| qemu-user-static-ppc-2:10.2.2-1.fc44.x86_64 |
| glib2-2.88.3-1.fc44.x86_64 |
| qemu-user-static-aarch64-2:10.2.2-1.fc44.x86_64 |
| microcode_ctl-2:2.1-74.fc44.x86_64 |
| qemu-user-static-xtensa-2:10.2.2-1.fc44.x86_64 |
| rpm-ostree-2026.2-1.fc44.x86_64 |
| systemd-udev-259.9-1.fc44.x86_64 |
| qemu-user-static-sparc-2:10.2.2-1.fc44.x86_64 |
| systemd-259.9-1.fc44.x86_64 |
| intel-gpu-firmware-20260916-1.fc44.noarch |
| toolbox-0.3-4.fc44.x86_64 |
| file-libs-5.46-10.fc44.x86_64 |
| fwupd-2.1.7-1.fc44.x86_64 |
| samba-client-libs-2:4.24.6-1.fc44.x86_64 |
| qemu-user-static-riscv-2:10.2.2-1.fc44.x86_64 |
| qemu-user-static-arm-2:10.2.2-1.fc44.x86_64 |
| coreutils-common-9.10-5.fc44.x86_64 |
| python3-libdnf5-5.4.5.0-1.fc44.x86_64 |
| NetworkManager-libnm-1:1.56.1-2.fc44.x86_64 |
| hwdata-0.411-1.fc44.noarch |
| 183 components |
| systemd-resolved-259.9-1.fc44.x86_64 |
| vim-minimal-2:9.2.1119-1.fc44.x86_64 and systemd-shared-259.9-1.fc44.x86_64 and systemd-libs-259.9-1.fc44.x86_64 and systemd-pam-259.9-1.fc44.x86_64 and python3-boto3-1.43.96-1.fc44.noarch |
| 12 components |
| glibc-2.43-8.fc44.x86_64 |
| 12 components |
| 12 components |
| 12 components |
| libldb-2:4.24.6-1.fc44.x86_64 and samba-common-2:4.24.6-1.fc44.noarch and libsmbclient-2:4.24.6-1.fc44.x86_64 and glibc-common-2.43-8.fc44.x86_64 |
| 12 components |
| 12 components |
| 11 components |
| 9 components |
| 12 components |
| 12 components |
| 12 components |
| 12 components |
| 12 components |
| 12 components |
| 12 components |
| 6 components |
| 24 components |
| 24 components |
| 19 components |
| 24 components |
| 24 components |
| initramfs (kernel 7.2.6-200.fc44.x86_64) and rpmostree-unpackaged-content |
| Reserved for new packages |
| /bin/sh -c mkdir -p /usr/lib/bootc/install |
| COPY file:526af9442f0a5e694e0f6d5a73217247aced12d520df733d57e991c3f3f00920 in /usr/lib/bootc/install/10-homelab.toml |
| /bin/sh -c dnf install -y --setopt=install_weak_deps=False ignition && dnf clean all |
| COPY file:659c722370b7173db3e73db64ba7fef37130abc672ac192409e5602f76cbaa65 in /usr/lib/bootupd/grub2-static/configs.d/05_ignition.cfg |
| COPY file:278c7f793360cfc017c249ad785eeda2d3d1d7bec415487307d3772ad86cb3a3 in /usr/libexec/coreos-ignition-firstboot-complete |
| COPY file:f9d62210a5b65409f28fd539d4184401ef75ee26bcba72ca5a9ef34e1d33ad13 in /usr/lib/systemd/system/coreos-ignition-firstboot-complete.service |
| /bin/sh -c chmod 0755 /usr/libexec/coreos-ignition-firstboot-complete && systemctl enable coreos-ignition-firstboot-complete.service |
| COPY file:53589bfccbfb45f90443cd247495240d865d699298c66f296a277f5ae18653c5 in /usr/lib/dracut/modules.d/41ignition-var/module-setup.sh |
| COPY multi:360f9720afa41f4df03a251b5a0244b585e9d860121a5cf7d1adf04a415392b4 in /usr/lib/dracut/modules.d/41ignition-var/ |
| /bin/sh -c set -eu; chmod 0755 /usr/lib/dracut/modules.d/41ignition-var/module-setup.sh; kver=$(ls /usr/lib/modules | head -1); dracut --force --no-hostonly --add ignition --add ignition-var "/usr/lib/modules/${kver}/initramfs.img" "${kver}"; lsinitrd "/usr/lib/modules/${kver}/initramfs.img" | grep -q 'ignition-fetch.service' || { echo "FATAL: ignition module missing from initramfs"; exit 1; }; for u in ignition-ostree-mount-var ignition-ostree-populate-var; do lsinitrd "/usr/lib/modules/${kver}/initramfs.img" | grep -q "$u.service" || { echo "FATAL: $u.service missing from initramfs -- /var will be read-only for Ignition" >&2; exit 1; }; done; lsinitrd "/usr/lib/modules/${kver}/initramfs.img" | grep -q 'ignition-complete.target.requires/ignition-ostree-mount-var.service' || { echo "FATAL: mount-var is in the initramfs but nothing requires it, so it will never run" >&2; exit 1; } |
| ARG K3S_VERSION |
| ARG K3S_SHA256 K3S_VERSION |
| |2 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 /bin/sh -c set -eu; tag=$(printf '%s' "${K3S_VERSION}" | sed 's/+/%2B/'); curl -fsSL -o /tmp/k3s "https://github.com/k3s-io/k3s/releases/download/${tag}/k3s"; echo "${K3S_SHA256} /tmp/k3s" | sha256sum -c -; install -m0755 /tmp/k3s /usr/bin/k3s; rm -f /tmp/k3s |
| ARG K3S_SHA256 K3S_VERSION TS_VERSION |
| ARG K3S_SHA256 K3S_VERSION TS_SHA256 TS_VERSION |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; curl -fsSL -o /tmp/ts.tgz "https://pkgs.tailscale.com/stable/tailscale_${TS_VERSION}_amd64.tgz"; echo "${TS_SHA256} /tmp/ts.tgz" | sha256sum -c -; tar xzf /tmp/ts.tgz -C /tmp; install -m0755 "/tmp/tailscale_${TS_VERSION}_amd64/tailscaled" /usr/bin/tailscaled; install -m0755 "/tmp/tailscale_${TS_VERSION}_amd64/tailscale" /usr/bin/tailscale; rm -rf /tmp/ts.tgz "/tmp/tailscale_${TS_VERSION}_amd64" |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c printf '%s\n' '[rancher-k3s-common-stable]' 'name=Rancher K3s Common (stable)' 'baseurl=https://rpm.rancher.io/k3s/stable/common/coreos/noarch' 'enabled=1' 'gpgcheck=1' 'repo_gpgcheck=0' 'gpgkey=https://rpm.rancher.io/public.key' > /etc/yum.repos.d/rancher-k3s-common.repo |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c dnf install -y --setopt=install_weak_deps=False k3s-selinux keepalived iscsi-initiator-utils audit checkpolicy policycoreutils-python-utils pam_oath && dnf clean all |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c rm -f /etc/yum.repos.d/rancher-k3s-common.repo |
| COPY file:e3832e58554cba8c7800417b0ee3a8433f8bdb4c261227c9befa7cc323abf318 in /usr/share/selinux/homelab/csi-connectto.te |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; mkdir -p /usr/share/selinux/homelab; checkmodule -M -m -o /tmp/csi-connectto.mod /usr/share/selinux/homelab/csi-connectto.te; semodule_package -o /usr/share/selinux/homelab/csi-connectto.pp -m /tmp/csi-connectto.mod; rm -f /tmp/csi-connectto.mod; test -s /usr/share/selinux/homelab/csi-connectto.pp |
| COPY file:1ea4579fbd854f203da5dbe5fe0655f69fe1c32e4243d1c1d1650789068a4d2a in /usr/share/selinux/homelab/kanidm-unixd.te |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; checkmodule -M -m -o /tmp/kanidm-unixd.mod /usr/share/selinux/homelab/kanidm-unixd.te; semodule_package -o /usr/share/selinux/homelab/kanidm-unixd.pp -m /tmp/kanidm-unixd.mod; rm -f /tmp/kanidm-unixd.mod; test -s /usr/share/selinux/homelab/kanidm-unixd.pp |
| COPY file:bd7e98e1b8fce5ad2c5e01c962558824100b4116442ddd1b0fa17411fbb1135f in /usr/lib/systemd/system/ |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c systemctl enable install-homelab-selinux.service |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; getent group sudo >/dev/null || groupadd -r sudo; if ! getent passwd admin >/dev/null; then useradd -u 1000 -U -M -d /var/home/admin -s /bin/bash -G wheel -c "Homelab break-glass" admin; fi; getent passwd admin; getent group sudo |
| COPY file:5d2e4407e2092e15c25ea509dc0ad70975dd6ffbd2db20c223f0901237995460 in /usr/lib/tmpfiles.d/homelab-admin-home.conf |
| COPY file:ed28ff7e2cb707fb0dec1ad5f0a970d52529203b6bc7263e559fb3a846c52dd6 in /usr/libexec/homelab-breakglass |
| COPY file:75c491c981855721508933281eba2c1bf0b9354f39ed18bd73378e4163168793 in /usr/lib/systemd/system/ |
| COPY file:7d24a9889132284c37fba09fffa5b86df95d3e5d83c3d480d0d6075afe42da22 in /etc/ssh/sshd_config.d/10-password-auth.conf |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; printf '# The break-glass account. It has no ssh key by design; see\n# /etc/ssh/sshd_config.d/10-password-auth.conf.\nadmin ALL=(ALL) ALL\n' > /etc/sudoers.d/10-admin; chmod 0440 /etc/sudoers.d/10-admin; chmod 0644 /etc/ssh/sshd_config.d/10-password-auth.conf; chmod 0755 /usr/libexec/homelab-breakglass; visudo -c >/dev/null; ssh-keygen -q -t ed25519 -N '' -f /tmp/hk; sshd -t -f /etc/ssh/sshd_config -h /tmp/hk; admin_t() { sshd -T -C user=admin,host=h,addr=127.0.0.1 -f /etc/ssh/sshd_config -h /tmp/hk | awk -v k="$1" '$1==k{print $2}'; }; [ "$(admin_t passwordauthentication)" = yes ] || { echo "FATAL: admin cannot use its break-glass password over ssh" >&2; exit 1; }; [ "$(admin_t authorizedkeysfile)" = none ] || { echo "FATAL: admin can be given an authorized_keys file -- see 10-password-auth.conf" >&2; exit 1; }; [ "$(admin_t authorizedkeyscommand)" = none ] || { echo "FATAL: admin would accept a key from the directory; break-glass must not depend on it" >&2; exit 1; }; [ "$(admin_t kbdinteractiveauthentication)" = no ] || { echo "FATAL: kbdinteractive is on, which returns password auth by another door" >&2; exit 1; }; [ "$(sshd -T -C user=nobody,host=h,addr=127.0.0.1 -f /etc/ssh/sshd_config -h /tmp/hk | awk '/^passwordauthentication/{print $2}')" = no ] || { echo "FATAL: password auth is enabled for everyone, not just admin" >&2; exit 1; }; rm -f /tmp/hk /tmp/hk.pub |
| |4 K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c systemctl enable homelab-breakglass.service |
| ARG K3S_SHA256 K3S_VERSION KANIDM_URI TS_SHA256 TS_VERSION |
| ARG K3S_SHA256 K3S_VERSION KANIDM_URI LOGIN_GROUPS_TOML TS_SHA256 TS_VERSION |
| ARG ADMIN_GROUPS K3S_SHA256 K3S_VERSION KANIDM_URI LOGIN_GROUPS_TOML TS_SHA256 TS_VERSION |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; FEDORA_VER="$(rpm -E %fedora)"; curl -fsSL -o /etc/yum.repos.d/network:idm.repo "https://download.opensuse.org/repositories/network:/idm/Fedora_${FEDORA_VER}/network:idm.repo"; rpm --import "https://download.opensuse.org/repositories/network:/idm/Fedora_${FEDORA_VER}/repodata/repomd.xml.key"; dnf install -y --setopt=install_weak_deps=False kanidm-unixd-clients oddjob-mkhomedir; rpm -q kanidm-unixd-clients; dnf clean all |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c rm -f /etc/yum.repos.d/network:idm.repo |
| COPY file:56563050f099595fcc9056acd18a5679aa9f57f192d43fb60c1789397d2e15ea in /etc/kanidm/unixd |
| COPY file:351c9813cb988a534381ed6f526d233a7545d5c237ec62a827dceff8c6467902 in /etc/ssh/sshd_config.d/sss_keys.conf |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; install -d -m 0755 /etc/kanidm; printf 'uri = "%s"\n' "${KANIDM_URI}" > /etc/kanidm/config; chmod 0644 /etc/kanidm/config; sed -i "s|@LOGIN_GROUPS_TOML@|${LOGIN_GROUPS_TOML}|" /etc/kanidm/unixd; chmod 0644 /etc/kanidm/unixd; grep -q '@LOGIN_GROUPS_TOML@' /etc/kanidm/unixd && { echo "LOGIN_GROUPS_TOML substitution failed" >&2; exit 1; } || true |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; P=/etc/authselect/custom/kanidm; authselect create-profile kanidm -b sssd; sed -i -E 's/^(passwd:).*/\1 kanidm sss files systemd/' "$P/nsswitch.conf"; sed -i -E 's/^(group:).*/\1 kanidm sss files systemd/' "$P/nsswitch.conf"; for f in system-auth password-auth; do sed -i '/^auth .*pam_kanidm\.so/d' "$P/$f"; sed -i -E '0,/^auth .*pam_localuser\.so/s//auth sufficient pam_kanidm.so ignore_unknown_user\n&/' "$P/$f"; grep -q '^account .*pam_kanidm' "$P/$f" || sed -i -E '0,/^account\s+required\s+pam_unix\.so/s//account sufficient pam_kanidm.so ignore_unknown_user\n&/' "$P/$f"; grep -q '^session .*pam_kanidm' "$P/$f" || sed -i -E '0,/^session\s+required\s+pam_unix\.so/s//session optional pam_kanidm.so\n&/' "$P/$f"; grep -q 'pam_kanidm' "$P/$f" || { echo "pam_kanidm not inserted into $f" >&2; exit 1; }; done; authselect select custom/kanidm with-mkhomedir --force; authselect apply-changes 2>/dev/null || true; for f in system-auth password-auth; do grep -q 'pam_kanidm' "/etc/pam.d/$f" || { echo "FATAL: authselect did not apply the kanidm profile to $f" >&2; exit 1; }; n=$(grep -c '^auth .*pam_kanidm\.so' "/etc/pam.d/$f"); [ "$n" = 1 ] || { echo "FATAL: $n pam_kanidm auth lines in $f, want exactly 1" >&2; exit 1; }; k=$(grep -n '^auth .*pam_kanidm\.so' "/etc/pam.d/$f" | cut -d: -f1); l=$(grep -n '^auth .*pam_localuser\.so' "/etc/pam.d/$f" | head -1 | cut -d: -f1); [ -z "$l" ] || [ "$k" -lt "$l" ] || { echo "FATAL: pam_kanidm is at line $k, BELOW pam_localuser at $l, in $f" >&2; exit 1; }; done |
| COPY file:f30c41699e5bf7fe57ebecc9a1db1cbc384569a1d3c065c7b0fcbbb58cd4df83 in /usr/libexec/homelab-identity-check |
| COPY file:0b8f44bd9d593c28de845637e54aa633c03df4726da2a04638043ff763483651 in /usr/lib/systemd/system/ |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; chmod 0755 /usr/libexec/homelab-identity-check; install -d -m 0755 /var/lib/oath-enroll; printf '# Consumed by oath-enroll(8) and the login notice.\n# Comma-separated list; membership in ANY of these grants OTP sudo.\nADMIN_GROUPS=%s\n' "${ADMIN_GROUPS}" > /etc/oath-enroll.conf; chmod 0644 /etc/oath-enroll.conf |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c systemctl enable kanidm-unixd kanidm-unixd-tasks oddjobd.service homelab-identity-check.service |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c systemctl set-default multi-user.target |
| COPY file:d097a359ee57b89477214476a6ee5712d6ce494ae872886d6d32b00a45f25ec2 in /usr/libexec/homelab-bootc-update |
| COPY file:13084cc65bee141f58faccdb6597a35c635ae8e830e50cfdeed27107e6a5e499 in /usr/lib/systemd/system/ |
| COPY file:495194eb14a2423e4a553a9ac2161b186ff342bb345a422cfc049b154a7d85ce in /usr/lib/systemd/system/bootc-fetch-apply-updates.service.d/10-homelab.conf |
| COPY file:1ba2908679e39dcb4b2754223503d7c566e27fddee7d7ad44f2013466ba26139 in /usr/lib/systemd/system/bootc-fetch-apply-updates.timer.d/10-homelab.conf |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c chmod 0755 /usr/libexec/homelab-bootc-update && systemctl enable bootc-fetch-apply-updates.timer && systemctl enable homelab-fleetlock-steady-state.service |
| COPY file:f2a6ea36d64f88c103acf54b86ea9b159999134f2dc46103f986d5c9b4f88d9c in /etc/pki/homelab/node-image.pub |
| COPY file:d42fbc2aaa29f6f3bd609cf0c5b8cd9cb28252f446c804aef11c865fb9bb0897 in /etc/containers/registries.d/homelab.yaml |
| COPY file:a17c87ac18a597362c71fff6577ddcf768a62f98140da7e529a774e0d2711f7e in /etc/containers/policy.json |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c chmod 0644 /etc/pki/homelab/node-image.pub /etc/containers/policy.json /etc/containers/registries.d/homelab.yaml |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c python3 -c "import json,sys; d=json.load(open('/etc/containers/policy.json')); extra=set(d)-{'default','transports'}; sys.exit(0) if not extra else (print('FATAL: policy.json has keys containers/image will reject:', extra, file=sys.stderr), sys.exit(1))" |
| |7 ADMIN_GROUPS=echo_admin K3S_SHA256=835873f37245fc615f547a2fe2af9402a347875f13fa64a1f136de644955ea3f K3S_VERSION=v1.36.4+k3s1 KANIDM_URI=https://auth.piqueras.me LOGIN_GROUPS_TOML="echo_admin" TS_SHA256=36ddd9b51be57ffc2990cf76323cfa13643bfbb1b8a969f6183fa164741cdef5 TS_VERSION=1.102.3 /bin/sh -c set -eu; for host in $(python3 -c "import json; print(' '.join(sorted({r.split('/')[0] for r in json.load(open('/etc/containers/policy.json'))['transports']['docker'] if r})))"); do grep -q "^ *${host}:" /etc/containers/registries.d/homelab.yaml || { echo "FATAL: policy.json requires signatures for ${host} but registries.d does not enable attachments for it" >&2; exit 1; }; done |
| COPY file:12a17ef1d55e10fa502473b41a5da1eec6d6eecbba4666520191d595d98cd2e5 in /usr/share/doc/homelab/ignition-preset-warning |
| LABEL org.opencontainers.image.title="homelab cluster node" |
| LABEL org.opencontainers.image.description="fedora-bootc with Ignition, k3s, tailscale, k3s-selinux, keepalived, iscsi, pam_oath, kanidm-unixd and the CSI connectto policy" |
| LABEL org.opencontainers.image.source="https://git.piqueras.me/alex/homelab" |
Labels
| Key | Value |
|---|---|
| containers.bootc | 1 |
| io.buildah.version | 1.43.2 |
| org.opencontainers.image.description | fedora-bootc with Ignition, k3s, tailscale, k3s-selinux, keepalived, iscsi, pam_oath, kanidm-unixd and the CSI connectto policy |
| org.opencontainers.image.source | https://git.piqueras.me/alex/homelab |
| org.opencontainers.image.title | homelab cluster node |
| org.opencontainers.image.version | 44.20260922.0 |
| ostree.bootable | true |
| ostree.commit | 236594078e6ff81f8c9163afb6060456aa46934338b9143a303b35fa2cfde1e4 |
| ostree.final-diffid | sha256:12787d84fa137cd5649a9005efe98ec9d05ea46245fdc50aecb7dd007f2035b1 |
| ostree.linux | 7.2.6-200.fc44.x86_64 |
| rpmostree.inputhash | f70abc711a6e89f2b08c84cf61bed3aafe227efd6a248dc6681c8086fa0b5f63 |
Details
2026-09-28 04:19:29 +00:00
2026-10-30 13:03:49 +00:00
Versions (7)
View all
Container
4
OCI / Docker
linux/amd64
1.4 GiB
stable
2026-10-05
fb4e24bc3afafbe1283dd7a7ce3ae89a49ee1bb9
2026-10-05
2018948d5cd5f9e0a582356601bff226c5e1f4e8
2026-09-28