feat: the kernel, initrd, firmware, bootloaders and installer move to plans/keel-boot #47

Merged

marcos-mendez merged 1 commit from feat/boot-layer-plan into 19.x

2026-10-08 04:27:04 -03:00

marcos-mendez commented

2026-10-08 04:01:03 -03:00

(Migrated from github.com)

Change

plans/turnkey/base no longer includes plans/boot and no longer lists grub-pc, tkl-installer, efivar, eject, jitterentropy-rngd, qemu-guest-agent or acpi-support-base. It now lists systemd and systemd-sysv itself, because plans/boot used to bring them.
New plans/keel-boot holds all of them (#include <boot> plus the list above). Keel-Linux/buildtasks products/boot builds it with bt-layer --boot APP.
GRUB's overlay and conf move to overlays/keel-boot and conf/keel-boot. grub-debug is split in two: its journald half (ForwardToWall=no) is something a container needs as well, so it moves to conf/turnkey.d/journald-no-wall.
mk/turnkey-desktop.mk now points at the moved overlay.
tests/plans-boot.bats resolves the plans with cpp the way fab-plan-resolve does. It fails if turnkey/base names a package that keel assemble refuses in a template. CI now installs cpp.

Why each package is VM-only

Package(s)	Reason
linux-image-*, linux-base	kernel; a container runs on the host's
initramfs-tools*, dracut-install, klibc-utils, libklibc, busybox	initrd and its early userspace; busybox is pulled in only by the live initrd
live-boot, live-tools, isolinux, syslinux	boot the live ISO
grub-, os-prober, efivar (+libefi)	bootloader and UEFI variables
tkl-installer, eject	install the ISO onto a disk
firmware-linux-free	device firmware is loaded by a machine's kernel
hdparm	tunes physical disks
qemu-guest-agent	talks to a QEMU host over virtio-serial; LXC has no such channel
acpi-support-base, acpid	ACPI events come from a machine's firmware
jitterentropy-rngd	feeds the kernel's entropy pool, which in a container is the host's

These stay in the container: lvm2, parted and fdisk (webmin-lvm and webmin-fdisk depend on them), kmod, udev, file, zstd and man-db.

Measured

The published core 19.0-9 and web 19.0-4 layers were assembled locally with keel assemble, and the same set of packages was then purged with dpkg. dpkg --audit came back clean and apt-get check passed.

	rootfs (apparent)	tar stream	.tar.zst
core before	903.6 MB	931.2 MB	360.3 MB
core after (40 pkgs incl. 8 orphaned libs)	714.0 MB	736.6 MB	199.8 MB
web before	992.1 MB	1019.9 MB	383.1 MB
web after (32 pkgs)	805.4 MB	828.3 MB	224.0 MB

Cheap wins I checked, none of which needs a change: the apt lists and caches are already empty, because fab cleans them and bt-layer excludes var/cache/apt. /var/log holds 13 KB. Locale and man path-excludes are already in place through localepurge, which keeps man[0-9]. There are no doc path-excludes and none were added (/usr/share/doc is 33 MB).

Merge order

This PR.
Keel-Linux/buildtasks (bt-layer --boot).
Rebuild the layers. keel-release does not rebuild a layer whose tarball still matches its manifest, so run it with --rebuild.
Keel-Linux/keel (template guard).

If keel is merged before the layers are rebuilt, it refuses the old layers.

Decision 0052, point 1: a separate boot layer per appliance, used only by the ISO. The kernel, initrd, firmware, bootloaders and installer leave the shared layers, so the container template never carries them. ## Change - `plans/turnkey/base` no longer includes `plans/boot` and no longer lists grub-pc, tkl-installer, efivar, eject, jitterentropy-rngd, qemu-guest-agent or acpi-support-base. It now lists `systemd` and `systemd-sysv` itself, because `plans/boot` used to bring them. - New `plans/keel-boot` holds all of them (`#include <boot>` plus the list above). Keel-Linux/buildtasks `products/boot` builds it with `bt-layer --boot APP`. - GRUB's overlay and conf move to `overlays/keel-boot` and `conf/keel-boot`. `grub-debug` is split in two: its journald half (`ForwardToWall=no`) is something a container needs as well, so it moves to `conf/turnkey.d/journald-no-wall`. - `mk/turnkey-desktop.mk` now points at the moved overlay. - `tests/plans-boot.bats` resolves the plans with cpp the way fab-plan-resolve does. It fails if `turnkey/base` names a package that `keel assemble` refuses in a template. CI now installs `cpp`. ## Why each package is VM-only | Package(s) | Reason | |---|---| | linux-image-*, linux-base | kernel; a container runs on the host's | | initramfs-tools*, dracut-install, klibc-utils, libklibc, busybox | initrd and its early userspace; busybox is pulled in only by the live initrd | | live-boot*, live-tools, isolinux, syslinux* | boot the live ISO | | grub-*, os-prober, efivar (+libefi*) | bootloader and UEFI variables | | tkl-installer, eject | install the ISO onto a disk | | firmware-linux-free | device firmware is loaded by a machine's kernel | | hdparm | tunes physical disks | | qemu-guest-agent | talks to a QEMU host over virtio-serial; LXC has no such channel | | acpi-support-base, acpid | ACPI events come from a machine's firmware | | jitterentropy-rngd | feeds the kernel's entropy pool, which in a container is the host's | These stay in the container: lvm2, parted and fdisk (webmin-lvm and webmin-fdisk depend on them), kmod, udev, file, zstd and man-db. ## Measured The published core 19.0-9 and web 19.0-4 layers were assembled locally with `keel assemble`, and the same set of packages was then purged with dpkg. `dpkg --audit` came back clean and `apt-get check` passed. | | rootfs (apparent) | tar stream | .tar.zst | |---|---|---|---| | core before | 903.6 MB | 931.2 MB | 360.3 MB | | core after (40 pkgs incl. 8 orphaned libs) | 714.0 MB | 736.6 MB | 199.8 MB | | web before | 992.1 MB | 1019.9 MB | 383.1 MB | | web after (32 pkgs) | 805.4 MB | 828.3 MB | 224.0 MB | Cheap wins I checked, none of which needs a change: the apt lists and caches are already empty, because fab cleans them and bt-layer excludes `var/cache/apt`. `/var/log` holds 13 KB. Locale and man path-excludes are already in place through localepurge, which keeps `man[0-9]`. There are no doc path-excludes and none were added (`/usr/share/doc` is 33 MB). ## Merge order 1. This PR. 2. Keel-Linux/buildtasks (`bt-layer --boot`). 3. Rebuild the layers. `keel-release` does not rebuild a layer whose tarball still matches its manifest, so run it with `--rebuild`. 4. Keel-Linux/keel (template guard). If keel is merged before the layers are rebuilt, it refuses the old layers.