Atomic AlmaLinux moves to the latest bootc tooling

Key points

AlmaLinux's Atomic SIG has released v13 of atomic-ci, the GitHub Actions workflows that build, sign and publish its bootc images and the respins based on them. The release replaces the rechunking and ISO build tools with the ones the bootc community currently recommends, and adds live-session ISOs and aarch64 ISOs.

What the Atomic SIG maintains

• Atomic Desktop: AlmaLinux 10 bootc images with GNOME, KDE Plasma or COSMIC, plus installer ISOs.
• Atomic Workstation: the GNOME Atomic Desktop image with added tools and configuration for daily use.
• atomic-respin-template: a template repository for building a custom respin on top of those images; Atomic Workstation is built from it.
• atomic-ci: the reusable workflows used by the SIG's own images and by every respin made from the template.

What changed

• Rechunking (splitting the finished image into per-package layers so that updates fetch only what changed) now uses bootc-base-imagectl rechunk instead of hhd-dev/rechunk.
• The new rechunking tool is already included in the AlmaLinux bootc base image, so no extra tool has to be pulled in.
• ISOs are now built with image-builder instead of bootc-image-builder.
• The ISOs boot into a live session of the image, from which the installer can be started.
• The image is on the ISO, so installation works without a network connection.
• The live session includes a partitioning tool for preparing disks beforehand.
• ISOs are now published for aarch64, which previously had images only.

Smaller changes

• Images built from branches are now signed; pull request builds remain unsigned until merged.
• Builds run on Ubuntu 26.04.
• A failed ISO build uploads its logs to help debugging.
• A new hook-script input lets respins customise the live environment and the installer.
• The full list is in the changelog.

Atomic Desktop and Atomic Workstation users

• No action is required.
• The first update after the change downloads the entire image again, because the layers are arranged differently.
• Later updates return to downloading only what changed.

Respin maintainers

• Existing workflows continue to run on v11 for now.
• Some v11 jobs use ubuntu-latest, which GitHub is moving to Ubuntu 26.04 by November 19, 2026; v11 has not been tested there, so the SIG asks maintainers to upgrade soon.
• v13 has breaking changes, and workflows stop working until they are updated.
• Dependabot will open a pull request to bump atomic-ci; apply the changes from the upgrade guide in that same pull request before merging, otherwise builds break.
• Most changes are in the ISO build job: some inputs are renamed or removed.
• iso.toml is dropped, because the installer now configures updates itself.
• Custom steps added to the installer's kickstart must move to a hook-script.
• cleanup.sh and the Makefile should also be updated from the template.
• Adding arm64 to the ISO platforms enables aarch64 ISOs.
• New respins need none of this, since the template already includes the changes.

What's next

• Rechunking will probably move to chunkah eventually, a more general successor to the rpm-ostree code that bootc-base-imagectl rechunk uses today.
• bootc-base-imagectl rechunk can already use it with --chunkah, but the SIG first has to work out whether the switch can be made without breaking updates.
• The larger planned step is bootc's composefs backend, where fs-verity checks that the system files on disk match the image, a check that could eventually be chained back to Secure Boot.
• There is no switch yet: an existing installation cannot currently move from ostree to composefs without a reinstall, and the SIG does not want to require one.
• The move will happen once composefs is fully supported and the upgrade is transparent for existing installations.
• The SIG is considering a separate series of composefs images for early testers and asks for feedback in ~SIG/Atomic.

Getting involved

• Problems after upgrading and ideas can be reported in ~SIG/Atomic or as an issue on atomic-ci.
• The SIG works asynchronously in chat, and its wiki page explains how to get started.

Summary by DistroNews, based on the original post.