bootc is a CNCF sandbox project, created by Colin Walters, that applies the OCI container model to operating system delivery. Where conventional container images package an application to run inside a host OS, a bootc image packages the entire OS — kernel (under /usr/lib/modules), initrd, systemd units, firmware, and all userspace — as a standard OCI image that can be built with podman build or buildah, stored in any OCI-conformant registry, signed with standard supply chain tools, and pulled to a machine where it becomes the running system. At runtime the base OS is not running inside a container; systemd is pid 1 as usual. The container image format is purely a transport and build model, not an execution model.
The filesystem layout on a deployed bootc system reflects its immutability goals. /usr is mounted read-only, enforced at the kernel level via composefs: the ostree composefs backend mounts the OS tree as a verified, content-addressed filesystem so that any modification to a file — whether deliberate or from bit-rot — produces an I/O error rather than silent corruption. /etc and /var remain writable for local configuration and state. Updates work by pulling a new image version from the registry in the background; the new deployment is staged into the ostree object store and activated on the next reboot, with the previous deployment retained for instant rollback via bootc rollback. Disk images for initial provisioning (ISO, qcow2, AMI) are generated from bootc images using bootc-image-builder, which partitions the disk using the UAPI Discoverable Partitions Specification so that systemd can auto-discover and mount partitions without explicit configuration.
The security story is where bootc connects the rest of this glossary. Because the entire OS is a signed OCI artifact pulled from a registry, the OS image is subject to the same supply chain verification as application containers — cosign signatures, SBOMs, attestations via the OCI referrers API. At the boot level, active work integrates UKI-based measured boot so that the composefs root digest — which commits the entire OS tree — is embedded in the UKI kernel command line and therefore covered by the UKI’s Secure Boot signature and TPM PCR measurements. This creates an end-to-end chain: the LUKS volume key is sealed to PCR values that include the composefs digest, so the disk only unlocks automatically when the system has booted exactly the signed OS image enrolled at provisioning time. For CoCo and confidential computing scenarios, the same composefs digest feeds into the TEE’s attestation report — a TDX RTMR or SEV-SNP launch measurement — allowing a remote relying party to verify not just that a TEE is genuine hardware but that the specific, unmodified OS image it is running is the one the workload owner approved.