New design for initrds

on YouTube ↗39m

" summary

Proposal replaces custom initrd scripts with systemd-based images built by mkosi, producing a compressed CPI initrd plus per-feature system extensions as GPT images with a filesystem, dm-verity data and JSON signatures verified by the kernel. Builds use distro package managers (dnf/apt) so images are reproducible and signed with TPM-backed credentials; current prototype runs on laptops, modules make up about half the initrd and overall images are ~20% larger, distro integration still missing.

AI-written summary · about

" chapters (15)

1. 0:00Introduction
2. 1:27Goals and complexity
3. 5:01Reusing systemd in initrds
4. 7:11System extensions concept
5. 10:43Building initrds with mkosi
6. 13:57Integration with distributions
7. 16:54Reproducible and signed builds
8. 20:06Transition vs extension
9. 23:41Overlaying root filesystem
10. 27:20Kernel coupling and rebuilds
11. 31:17Current initrd size and firmware
12. 33:04Fedora adoption timeline
13. 35:34Packaging and dependencies
14. 36:59Secure Boot and signatures
15. 38:26Q&A

" related talks

• 36mmkosi-initrd in FedoraZbigniew Jędrzejewski-Szmek · DevConf.CZ 2023
• 01h 05mImmutable and Stateless Systems with systemdLennart Poettering · foss-north 2017
• 19mSubsystem Update: Linux Integrity Status UpdateMimi Zohar · Linux Security Summit North America 2019
• 26mIntegrityMimi Zohar · Linux Security Summit 2016
• 35mHardening OS Distribution: Verifiable and sealed OS with bootc and composefsColin Walters · DevConf.CZ 2026
• 01h 01mDiskless Booting of RPi 400 Using Bootp, tftp, iscsi and NFSPascal van Dam · Open Source Summit Europe 2022
• 47msystemd and TPM2Lennart Poettering · Linux Security Summit North America 2023
• 40mAn Operating System of Our OwnHarald Sitter · Akademy 2024