ryanabx-containers

My container images: full OS images for rpm-ostree/bootc, and a toolbox image for development.

---

What's in here?

This repository contains all of my container definitions, built by GitHub Actions and published to GHCR. They fall into two categories:

• OS images — full, bootable images built on top of Fedora's rpm-ostree desktop images. These are meant to be deployed as an operating system (see bootc and rpm-ostree), not run like a normal container.
• Toolbox images — plain container images with my development toolchain pre-installed, meant to be used with toolbox on an immutable (Fedora Silverblue/Kinoite etc.) host.

Image	Type	Base	Description
ryanabx/ryanabx-dev	Toolbox	fedora:44	My personal development toolbox
ryanabx/ryanabx-kinoite	OS image	fedora-ostree-desktops/kinoite:44	Kinoite + my package set
ryanabx/cosmic-nightly	OS image	fedora-ostree-desktops/cosmic-atomic:44	Fedora COSMIC with my nightly COPR

---

Containers

ghcr.io/ryanabx/ryanabx-dev

My toolbox container. It contains everything I need to develop from an immutable OS: language toolchains, linters, language servers, editors, and a bunch of other utilities. It's a regular container image — you don't boot it, you run software in it.

Usage

Create a toolbox from the image:

toolbox create -i ghcr.io/ryanabx/ryanabx-dev:latest

Then enter it any time with:

toolbox enter

For example, to run VS Code inside it:

toolbox run code

Note

Some tasks (such as pmbootstrap) need access to the host's device nodes — create the toolbox as root for those:

sudo toolbox create -i ghcr.io/ryanabx/ryanabx-dev:latest

ghcr.io/ryanabx/ryanabx-kinoite

An rpm-ostree image built on top of Fedora Kinoite with the extra packages I use installed on top. This is the image I use for my day-to-day operating system!

Usage

On an existing rpm-ostree machine, you can deploy this image as the system:

sudo rpm-ostree rebase ostree-unverified-registry:ghcr.io/ryanabx/ryanabx-kinoite:latest

or use it as a base layer for your own bootc-based image:

FROM ghcr.io/ryanabx/ryanabx-kinoite:latest
RUN dnf install -y <something>

ghcr.io/ryanabx/cosmic-nightly

Basically just Fedora COSMIC but with my nightly COPR attached. This comes with the latest COSMIC packages before Fedora upstream gets them! I use this personally for Fedora COSMIC and COSMIC upstream development.

Like ryanabx-kinoite, this is a full rpm-ostree OS image:

sudo ostree admin deploy --image=ghcr.io/ryanabx/cosmic-nightly:latest

---

Verifying Signatures

Every image published by the workflows in .github/workflows/ is signed with cosign using keyless Sigstore: the signature is made with GitHub's OIDC identity for this repository (no long-lived signing key), and is stored as a sibling OCI artifact next to the image on GHCR.

Verify a signature with:

cosign verify \
  --certificate-identity ".*ryanabx-containers.*" \
  --certificate-oidc-issuer "https://github.com" \
  ghcr.io/ryanabx/ryanabx-kinoite:latest

Replace the image reference as needed (ryanabx-dev, cosmic-nightly). A successful run prints the embedded GitHub certificate, which includes the repository and workflow that produced the image. Verify against a digest (ghcr.io/ryanabx/ryanabx-kinoite@sha256:…) to pin an exact build.

Note

These signatures are not checked automatically by rpm-ostree/ostree when pulling from ostree-unverified-registry:; run cosign verify yourself (e.g. before a rebase or in an update script) if you want an extra trust gate.

---

Development

• Container definitions live in Containerfiles/.
• CI workflows live in .github/workflows/; images are rebuilt on push and on a daily cron, published to GHCR, and signed with keyless Sigstore (see Verifying Signatures).
• Notes on building rpm-ostree images locally with bootc live in docs/notes.md.

License

Distributed under the MIT License.