https://lesitedefrancois.be/en/tags/immutable/Recent content in Immutable on Le Site de FrançoisHugo -- gohugo.ioen© 2026 Françoishttps://lesitedefrancois.be/en/security/bootc/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/bootc/<p><strong>bootc</strong> is a CNCF sandbox project, created by Colin Walters, that applies the OCI container model to operating system delivery. Where conventional container images package an application to run inside a host OS, a bootc image packages the entire OS — kernel (under <code>/usr/lib/modules</code>), initrd, systemd units, firmware, and all userspace — as a standard <strong>OCI</strong> image that can be built with <code>podman build</code> or <code>buildah</code>, stored in any OCI-conformant registry, signed with standard supply chain tools, and pulled to a machine where it becomes the running system. At runtime the base OS is not running inside a container; systemd is pid 1 as usual. The container image format is purely a transport and build model, not an execution model.</p>https://lesitedefrancois.be/en/security/rhcos/Mon, 01 Jan 0001 00:00:00 +0000https://lesitedefrancois.be/en/security/rhcos/<p><strong>RHCOS (Red Hat Enterprise Linux CoreOS)</strong> is the operating system that runs on every OpenShift control plane and worker node. It is not a general-purpose Linux distribution — it is a purpose-built, immutable, container-optimised OS designed to run exclusively as a managed node in an OpenShift cluster. Its security posture is architecturally different from a hardened RHEL installation: rather than hardening a mutable system through configuration management, RHCOS makes the OS layer structurally resistant to modification by design. The root filesystem&rsquo;s <code>/usr</code> tree is <strong>read-only</strong> (enforced at mount time by rpm-ostree and, in recent versions, by <strong>composefs</strong> over the OSTree object store), <code>/etc</code> and <code>/var</code> are writable but managed exclusively by the <strong>Machine Config Operator (MCO)</strong>, and no package manager is available at runtime for ad-hoc software installation. An operator who wants to change any node-level configuration — kernel arguments, sysctl settings, systemd units, certificates, kubelet configuration — creates a <strong>MachineConfig</strong> object in the OpenShift API; the MCO renders it into an Ignition config, applies it to the target MachineConfigPool (master, worker, or custom), and drains and reboots the affected nodes in a rolling fashion. Direct SSH access to nodes for configuration changes is explicitly unsupported and actively discouraged — <code>oc debug node/&lt;name&gt;</code> is the supported emergency access path, dropping into a privileged container on the node&rsquo;s host namespaces under audit.</p>