`bootc container ukify` fails with Operation not supported

[Johan-Liebert1]

+ bootc container ukify --rootfs /run/target --karg enforcing=0 -- --signtool sbsign --secureboot-private-key /run/secrets/secureboot_key --secureboot-certificate /run/secrets/secureboot_cert
 --measure --json pretty --output /out/6.12.0-192.el10.x86_64.efi
error: Building UKI: Operation not supported (os error 95)
Error: building at STEP "RUN --network=none --mount=type=tmpfs,target=/run --mount=type=tmpfs,target=/tmp --mount=type=secret,id=secureboot_key --mount=type=secret,id=secureboot_cert --mount=
type=bind,from=packaging,src=/,target=/run/packaging --mount=type=bind,from=base-penultimate,src=/,target=/run/target <<EORUN": while running runtime: exit status 1

This occurs when building the sealed variant for testing with just variant=composefs-sealeduki-sdboot test-tmt

[Johan-Liebert1]

Investing further, the issue seems to be at

https://github.com/containers/composefs-rs/blob/a5e820595cdad4a9e919135c12ee51b16d4efd14/crates/composefs/src/fs.rs#L287

Need to debug a bit more

[jeckersb]

I put up #1980 as a first step to gather more context, try that and then once it breaks we can keep iterating and chasing how it's getting down into read_directory as you posted above. Then at the very least we'll have some useful context additions to merge so the next time we hit something in the same area we'll be better off :)

[Johan-Liebert1]

Seems like an issue with creating a tempfile

error: Building UKI: Computing composefs digest: Reading container root: Reading filtered filesystem from /run/target: Reading filesystem from /run/target: Reading directory /run/target: Reading inode fedora-extra.txt: Reading leaf fedora-extra.txt: Reading leaf content: Ensuring object exists in repository: Storing object data: Storing object with ID sha512:a9df998fc10b16c88d675
a7eb8f45020ff6dae908e249a5746ab6882cc5b31d460d25d8b44fc5a40b4c163e3e91bb2ff93ab74a5c9ffefdb57ce9870848ebe82: Creating tempfile in object subdirectory: Ok("/var/tmp/.tmpKKbgJw/repo/objects"): 

Volume mounting /var/tmp fixes this

[travier]

I think this happens due to fuse-overlayfs as it does not happen for me as root using overlay.

+ bootc container ukify --rootfs /run/target -- --measure --json pretty --output /boot/EFI/Linux/6.19.9-300.fc44.x86_64.efi --signtool sbsign --secureboot-private-key /run/secrets/secureboot_key --secureboot-certificate /run/secrets/secureboot_cert
error: Building UKI: Computing composefs digest: Reading container root: Reading filtered filesystem from /run/target: Reading filesystem from /run/target: Reading directory /run/target: Reading inode etc: Reading directory etc: Reading inode DIR_COLORS: Reading leaf DIR_COLORS: Reading leaf content: Ensuring object exists in repository: Storing object with ID sha512:c7713425b5a76c05418de56f344d27f836038bc0761c7776b240bfc691f4f97bca43eebdd22532fdfe15c337b29994f70e55cc4ee6feb86a1e122c4c680ea446: Creating tempfile in object subdirectory: Operation not supported (os error 95)

Adding --mount=type=tmpfs,target=/var/tmp worked around it indeed.

[cgwalters]

PR in composefs/composefs-rs#276

[jeckersb]

I think this can probably be closed now that composefs/composefs-rs#276 is done?

[travier]

We might still need the crate to be updated here?