close
Skip to content

Convert OEM packages to sysext, drop several images, revamp Vagrant support#4004

Open
chewi wants to merge 21 commits intomainfrom
chewi/oem-rework
Open

Convert OEM packages to sysext, drop several images, revamp Vagrant support#4004
chewi wants to merge 21 commits intomainfrom
chewi/oem-rework

Conversation

@chewi
Copy link
Copy Markdown
Contributor

@chewi chewi commented May 7, 2026

Brace yourselves, this is a big one! The good news is the difference is about -1600 lines. 😁

Since having the OEM sysext packages built in the "packages" job, they have been ecleaned and then built again later. This fixes that issue and ensures they are always consumed from binary packages.

This drops the per-OEM USE flags. Having a USE flag per OEM is unnecessary when we only really need to know whether the package will be installed in an OEM sysext or not. A single USE flag could do this, but our existing flatcar_target() helper avoids the complexity of binpkg-multi-instance. The flag names were also prone to conflicts (e.g. qemu) and we don't currently make use of them anyway.

This populates the SYSEXT_ID/NAME/VERSION_ID/HOME_URL/BUG_REPORT_URL extension-relhease.d fields in each sysext. These are equivalent to their non-SYSEXT os-release counterparts. Most of these are taken from the sysext's package is it is built from just one, which is often the case. These fields are now used to write the oem-release file later by extracting them with systemd-dissect.

As per flatcar/bootengine#124, this adds the vboxguest kernel module, which allows the VirtualBox image to actually boot. It broke when upstream Ignition changed how the VirtualBox support works.

Also per flatcar/bootengine#124, the Ignition patch to handle unsupported platforms like Vagrant has been dropped because it is more useful to rely on systemd-detect-virt than to simply assume "metal", which does nothing.

As with my other recent PRs, this drops support for Equinix Metal (Packet) and Rackspace. It also drops the vmware_insecure image, which seems pointless, the vagrant_virtualbox image, which is unneeded when the vagrant image already targets VirtualBox, and the vagrant_vmware_fusion image, which we haven't actually built for years.

Dropping vagrant_virtualbox also meant dropping support for that combination in Afterburn. Now that the OEM ID is just vagrant, we can't distinguish it from Parallels. I highly doubt anyone cares, and it brings up closer to upstream.

The main point of this whole PR is to convert the remaining OEM packages to sysexts. This involves reworking how they are built. common-oem-files was a giant hack. oem-release is now generated from the sysexts themselves as mentioned above. grub.cfg is often just a couple of lines, so there's no point in having all this complex logic around generating it, especially when that logic has some exceptions anyway. It's far easier to just explicitly store each variant under build_library/oem. The list of OEMs is now generated by looking for coreos-base/oem-*/*.ebuild.

This totally revamps our Vagrant support, dropping custom code that was merged upstream years ago, adding support for Ignition and cloud-config within the single VirtualBox image, and sharing the JSON metadata between the VirtualBox and Parallels images. Check flatcar/flatcar-website#567 to see what this new support looks like in practise.

The VirtualBox OVF, which is also used by the Vagrant image, has been modernised for new hardware, including a VirtIO storage controller and UEFI. VirtualBox actually uses EDK2 for UEFI.

This drop the OEM sysext dependencies from coreos-devel/board-packages because these are no longer necessary now that they explicitly built with --onlydeps in build_sysext_packages().

This needs to be merged in conjunction with flatcar/bootengine#124 and flatcar/coreos-cloudinit#38.

How to use

There's obviously a lot to unpack here. You can try VirtualBox and Vagrant with my build using the new docs in flatcar/flatcar-website#567.

Testing done

Jenkins completed successfully, except for Digital Ocean, which is unrelated. There are surprisingly few resulting image differences for such a large change. I have obviously done loads of manual testing around this, especially with VirtualBox and Vagrant. Unfortunately, I don't think we have the means to test the other OEMs being migrated, namely CloudSigma, CloudStack, and Exoscale, but I think these are all community supported.

  • Changelog entries added in the respective changelog/ directory (user-facing change, bug fix, security fix, update)
  • Inspected CI output for image differences: /boot and /usr size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.

@chewi chewi self-assigned this May 7, 2026
@chewi chewi requested a review from a team as a code owner May 7, 2026 16:46
chewi added 21 commits May 7, 2026 17:46
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It's handled by dumb-tmpfiles-proc.sh.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Also simplify the exclusion mechanism while we're at it.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It is no longer necessary to build the meta packages from source as they
are now covered by build_packages.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Having a USE flag per OEM is unnecessary when we only really need to
know whether the package will be installed in an OEM sysext or not. A
single USE flag could do this, but our existing flatcar_target() helper
avoids the complexity of binpkg-multi-instance. The flag names were also
prone to conflicts (e.g. qemu) and we don't currently make use of them
anyway.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
These extension-release.d fields are equivalent to their non-SYSEXT
os-release counterparts. SYSEXT_ID is taken from the sysext's name as
given to build_sysext. SYSEXT_NAME, SYSEXT_VERSION_ID, and
SYSEXT_HOME_URL are taken from the package if only one is given.
SYSEXT_NAME is the new name for the OEM_NAME variable.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This allows the VirtualBox image to actually boot. It broke when
upstream Ignition changed how the VirtualBox support works.

VirtualBox supports arm64 these days, so we could enable this in the
common config, but we don't currently produce an arm64 VirtualBox image,
and I don't propose that we start now.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This allows us to drop an Ignition patch.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It turns out we haven't even been building this for years because of a
CI bug. There's no point in reviving it now.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This is what caused vagrant_vmware_fusion to not be built.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
common-oem-files was a giant hack. oem-release can now be easily be
generated from metadata embedded in the sysext image itself. grub.cfg is
often just a couple of lines, so there's no point in having all this
complex logic around generating it, especially when that logic has some
exceptions anyway. It's far easier to just explicitly store each variant
under build_library/oem. The list of OEMs is now generated by looking
for coreos-base/oem-*/*.ebuild.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
The CoreOS support we have been carrying was merged upstream years ago.
The network configuration still needs special handling because our
cloud-init is called coreos-cloudinit, breaking the detection.

Flatcar's documentation used to point users at coreos-vagrant. This is
long dead and used the old Ignition VirtualBox support, which no longer
works. Rather than revive that, we can capture the essence of what
coreos-vagrant did in our base Vagrantfile.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
We currently publish separate metadata for each provider, VirtualBox and
Parallels, but you're supposed to combine these and let Vagrant choose
the provider.

Rewriting an existing output file is a little weird, but this use of jq
makes it relatively safe.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
* 2 CPUs instead of 1 like QEMU.
* 2GB RAM instead of 1GB like QEMU.
* ICH9 chipset instead of PIIX3.
* virtio storage controller instead of IDE.
* VMware SVGA display adapter instead of VBoxVGA.
* USB tablet pointer instead of PS/2 mouse.
* UEFI instead of BIOS.
* UTC clock instead of local.

We don't enable any of the DRM drivers for any of VirtualBox's display
adapters, so it uses efifb regardless, but apparently VMSVGA is best for
Linux guests.

For UEFI, VirtualBox actually uses EDK2. It also supports Secure Boot,
but I haven't tested that.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It is no longer necessary to include these as they are explicitly built
with --onlydeps in build_sysext_packages().

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
@chewi chewi force-pushed the chewi/oem-rework branch from d5537b2 to ba7c393 Compare May 7, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant