Hardening OS Distribution: Verifiable and sealed OS with bootc and composefs
summary
Describes an OCI-native OS path that consumes OCI images, materializes them with composefs, and boots a signed unified kernel image (UKI) verified by fsverity digests placed on the kernel command line. Build uses multi-stage container builds, signs systemd-boot with keys passed via podman secrets, and produces a sealed UKI ComposeFS-backed system shipped as RHEL 10.2 tech preview. Includes BCVK VM tooling, a live install/upgrade flow, and a demo where a tampered file causes boot-time verification to fail.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:25OS security matters
- 3:11Sealed OS threat scenarios
- 5:40What is composefs
- 9:57Composefs ecosystem
- 11:05Sealed OS with bootc
- 14:39Secure boot and trust chain
- 17:54UKI generation
- 22:04bootc UKI verification
- 24:13Live demo bootc composefs
- 27:03composefs runtime and state
- 28:29Stateless OS configs
- 29:32composefs future plans
- 30:40Q&A
related talks
37mUKIs and composefs support for Bootable Containers
46mVerifiable End To End Secure OCI Native Machines
37mSimplify security compliance with bootable containers
43mTowards Secure Unified Kernel Images for Generic Linux Distributions and Every...
01h 05mImmutable and Stateless Systems with systemd
42mPractical Application of Verified Boot
13mIBM Secure Execution for RedHat CoreOS
55mVerified Boot: From ROM to Userspace