How to Test Sealed Bootable Container Images for Fedora Atomic Desktops

Introduction

Sealed bootable container images are a new way to create fully verified boot chains for Fedora Atomic Desktops. They bundle everything needed—from firmware to the operating system's composefs image—and rely on Secure Boot with UEFI support on x86_64 and aarch64 architectures. These testing images allow you to experiment with passwordless disk unlocking using TPM in a reasonably secure default setup. This guide will walk you through testing the pre-built images or building your own, so you can contribute feedback and help shape the future of bootable containers.

What You Need

• A computer with UEFI firmware (x86_64 or aarch64). Secure Boot is recommended but not required for testing.
• A USB drive (at least 8 GB) for creating a bootable installer.
• A stable internet connection to download images.
• Basic familiarity with the command line for customization (optional).
• Access to the GitHub repository for the latest files and instructions.

Step-by-Step Instructions

Step 1: Ensure Your System Meets Requirements

Before downloading anything, confirm that your system boots with UEFI. These images do not support legacy BIOS. If you're on an aarch64 machine, verify that it uses UEFI as well. While Secure Boot is part of the sealed chain, the testing images are signed with test keys—not official Fedora keys—so you may need to temporarily disable Secure Boot or enroll the test keys (see the repository for details).

Step 2: Download a Pre-Built Image (or Build Your Own)

Head over to the releases page of the GitHub repository and grab the latest pre-built image for your architecture. Alternatively, if you want to customize the image (e.g., add packages or change kernel parameters), you can build your own using the provided containerfile and scripts. Building is more involved but gives you full control. For testing purposes, the pre-built image is recommended.

Step 3: Create a Bootable USB Drive

Use a tool like dd on Linux or Rufus on Windows to write the raw image to your USB drive. For example:

sudo dd if=fedora-atomic-desktops-sealed-*.raw of=/dev/sdX bs=4M status=progress

Replace /dev/sdX with your USB device (be careful not to overwrite your main disk). Once written, you can boot from it directly.

Step 4: Boot the Image and Test

Insert the USB drive and restart your computer. Enter the boot menu (usually F12, F2, or Del) and select the USB drive as the boot device. The system should load systemd-boot and then the Unified Kernel Image (UKI). You may see warnings about a self-signed Secure Boot key—this is normal for test images.

After boot, you’ll land in a live environment. The root account has no password set, and SSH is enabled by default for debugging. Do not use this in production! Try out the TPM-based disk unlocking if your hardware supports it. You can also run bootc status to verify the boot chain integrity.

Step 5: Provide Feedback and Report Issues

Testing is most valuable when you share your experience. Check the known issues list first, then open a new issue on the same repository if you encounter something new. Include details about your hardware, steps to reproduce, and any error messages. Your feedback helps improve the project!

Tips and Important Notes

• Security disclaimer: These are test images. They are not signed with official Fedora keys, so do not use them on production machines or with sensitive data.
• Passwordless root: The root account lacks a password and SSH is enabled. If you leave the system unattended, disable SSH or set a password immediately.
• TPM unlocking: The sealed boot chain enables TPM-based disk unlocking without a password. For this to work, your firmware must support TPM 2.0 and Secure Boot must be active.
• Building from source: If you build your own image, ensure you have the required dependencies (podman, bootc, etc.) and follow the build instructions carefully.
• Reporting issues: When filing a bug, include the output of bootc status and systemd-boot --version. This helps developers pinpoint problems with the UKI or composefs layers.

For deeper technical details on how sealed images work—composefs, UKIs, and the verified boot chain—refer to the talks and documentation linked in the original announcement. Happy testing!