Bare metal deployment mechanics

[jmpolom]

If you use mkosi today, what are the options like for deploying the resulting image(s) to a bare metal system? How do these options change if you want to LUKS encrypt the system volume(s)? Seems like this would all be possible but there are options so I'm curious what people have tried.

[DaanDeMeyer]

@jmpolom Deploying to bare metal is hampered by lack of an end-to-end update solution. systemd-sysupdate will fill this gap but I haven't had the chance to figure out smooth integration of it with mkosi yet.

It works great for rescue or installer images already though. Use mkosi burn to install the image to a USB, make sure linux-firmware is installed in the image, add KernelCommandLine= to get rid of the default console=ttyS0 and it should boot.

[DaanDeMeyer]

Is UKI the only kernel format supported with mkosi? Is a conventional /boot with individual kernel, initrd and grub not supported?

It is supported, see UnifiedKernelImages setting. But that doesn't matter for what I said above, since any solution we come up with needs to work for locked down systems as well.

[jmpolom]

Somehow I missed that option in the man page.

systemd-repart --copy-from /dev/sdb /dev/sda would only copy the usr and ESP partitions.

Why would repart only copy the /usr and ESP partitions with the command example you provided? Based on reading the repart man page with the --copy-from option this is far from an intuitive/obvious outcome.

[DaanDeMeyer]

I'm assuming those are the only partitions on the USB and that the others are created on first boot

[jmpolom]

Does mkosi only create a /usr and ESP partition by default? The documentation suggests you'll get a full directory tree unless you configure it otherwise?

[DaanDeMeyer]

Yes you get full control via mkosi.repart/

[jmpolom]

systemd-repart --copy-from /dev/sdb /dev/sda

The man page describes an IMAGE argument for the --copy-from option. Should this work to get repart to copy a disk image to a block device? The supported image formats aren't described in the man page but I'm assuming a raw image works?