Support building bootc composefs backend image (sealed image)

[henrywang]

BIB can't build bootc composefs backend image (sealed image).

[fedora@fedora-41-debug-vm ~]$ sudo podman run --rm -it --privileged --pull=newer --tls-verify=false --security-opt label=type:unconfined_t -v "$(pwd)/output":/output -v /var/lib/containers/storage:/var/lib/containers/storage quay.io/centos-bootc/bootc-image-builder:latest --type qcow2 --chown "$(id -u "$(whoami)"):$(id -g "$(whoami)")" --rootfs xfs --use-librepo --verbose localhost/bootc:latest
Generating manifest manifest-qcow2.json
2025/12/03 15:21:28 error: cannot build manifest: image localhost/bootc:latest is not a bootc image

[achilleas-k]

Thanks Xiaofeng. Do you have an example base container we can use to reproduce and test this?

[achilleas-k]

Internal ticket for tracking: https://issues.redhat.com/browse/HMS-9844

[cgwalters]

So you have an example base container we can use to reproduce and test this?

https://gitlab.com/fedora/bootc/docs/-/merge_requests/143 is pending build docs, but ghcr.io/bootc-dev/dev-bootc:stream10-uki is a current prebuilt image.

[mvo5]

It seems the issue is that we check if its a bootc image based on the container tags, i.e. containers.bootc:1: https://github.com/osbuild/image-builder-cli/blob/5fd017b3be346716f5d921e6cd7efd6dbca21d05/pkg/setup/setup.go#L161

But for the example container I get:

$ podman image inspect ghcr.io/bootc-dev/dev-bootc:stream10-uki --format={{.Labels}} 
map[bootc.testimage:1 containers.bootc:sealed io.buildah.version:1.39.3 org.opencontainers.image.version:42.20251204.0 ostree.bootable:true ostree.commit:9e625c2404acf1a727a0b5ae9b8f4c0565735fda263c6af84a6ab69de180be96 ostree.final-diffid:sha256:12787d84fa137cd5649a9005efe98ec9d05ea46245fdc50aecb7dd007f2035b1 ostree.linux:6.17.9-200.fc42.x86_64 rpmostree.inputhash:3e828ad92a1eea8fd2a9032dc9626367c6dd6b6aab5447f14b1054fd8bae2dc7]

We could relax the checks but the easiest fix would be to just add the tag to the container in question.