The Containerization of the Operating System: Exploring Bootc and the Future of Linux... Hema Arun

### Overview In this presentation delivered at Open Source Summit India, Hema Arun, Senior Linux Platform Engineer at Emirates National Bank of Dubai, explores the concept of bootable containers (BootC) and the transition toward containerizing the host operating system. Arun frames the problem using a scenario involving a systems engineer tasked with patching thousands of heterogeneous Linux machines during an off-hours zero-day security vulnerability. Traditional operating system management using package managers (e.g., yum, apt) frequently fails due to configuration drift and "snowflake" servers, while monolithic virtual machine templates remain opaque and difficult to version control. BootC applies the paradigms of OCI containers—immutability, GitOps workflows, standard registries, and declarative definitions—directly to host operating system management.

### Key Topics - **Configuration Drift vs. Immutability:** Traditional stateful host operating systems suffer from configuration drift caused by localized changes. BootC shifts host OS management to a stateless, image-based model where the entire OS is treated as an immutable OCI container. - **Project Pedigree and Governance:** BootC originated from pioneers of immutable Linux systems at Red Hat, led by Colin Walters (creator of libostree and rpm-ostree) and container veterans such as Dan Walsh (Podman). In January 2025, BootC achieved CNCF sandbox project status, establishing a vendor-neutral governance model. - **Architectural Differences from Application Containers:** Standard application containers lack an internal kernel and rely on a shared host kernel. In contrast, BootC images package a full Linux kernel, initramfs, and bootloader configurations, enabling them to boot directly onto bare metal or hypervisors. - **Smartphone-Style Atomic Updates and Rollbacks:** BootC mimics mobile operating system updates. Instead of modifying live packages on a running system, a verified image is downloaded to disk, and the system switches execution to the new image upon reboot. If an issue occurs, the system can atomically roll back.

### Technical Details - **Lifecycle Workflow:** The BootC lifecycle consists of five stages: defining OS configurations and package updates in a container file; building the image using container engines (Podman or Docker); pushing the image to a container registry (e.g., Quay); pulling the image onto target nodes; and rebooting to switch execution to the new image via the host's BootC system service. - **Demonstration:** Arun demonstrated building an OS image containing an Apache HTTP server using Podman Desktop with the bootable containers extension. Using the extension, the OCI image was exported into a virtual hard disk (VHD) format—with support also noted for QCOW2, ISO, and AWS AMI formats—and booted in Hyper-V. Arun executed an update to a new application version using the `bootc switch` command followed by a reboot, and subsequently executed a rollback to the prior version with another `bootc switch` and reboot. - **Filesystem Mutability and Storage:** On a BootC-managed host, traditional package operations (like `yum update` or `dnf update`) are not permitted at runtime. The `/etc` and `/var` directories remain writable and persist across reboots for node-specific runtime configuration (such as network settings, hostnames, and user data), while other system directories remain read-only. Updates utilize layered OCI binary diffs rather than duplicating entire disk images.

### Takeaways - **Eliminating Drift in Enterprise Patching:** Shifting the host operating system into declarative container files stored in Git repositories allows automated CI/CD pipelines to manage OS updates consistently across on-premises data centers, cloud infrastructure, and edge devices. - **Container-Native Tooling:** Infrastructure teams can leverage developer tools such as Docker, Podman, and standard OCI registries to maintain, build, version, and inspect host operating systems without bespoke patching scripts. - **Deployment Flexibility:** BootC images can be converted into standard disk formats (AMI, VHD, QCOW2, ISO) for diverse deployment targets, including virtual machines, physical bare metal via Kickstart configurations, and edge or AI/ML computing platforms.