BOOTC-MANAGEMENT-SERVICES(7)

🎀 NAME 🎀

bootc-management-services — management services, bestie 💅 (yes that's literally the whole name, and yes this page from the Miscellaneous Information Manual is about gluing a fleet of machines to a central management service)

---

✨ DESCRIPTION ✨

okay SO. when you're running a whole fleet of systems 🌈, the move is usually to hook them all up to a central management service. and like, the way that works is: the service hands you a client, you install that client on every single system, and it phones home to the central service. and — important — a lot of these services make the client do a one time registration first. like a vibe check, but for your machine's identity 🫶.

so here's an example showing how to install the client into a bootc image and run it at startup so it registers the system. this example is assuming your management-client handles all the future connections to the server itself, e.g. via a cron job or a separate systemd service. and like, you could tweak this to make a persistent systemd service if that's what you need 💖. also, the Containerfile here is not optimized — on purpose!! — so that every step is super clear to read. (ngl the better practice is to invoke RUN a single time so you don't stack up layers in the image, but that would make this way less readable, so.)

so, the Containerfile, in all its glory 👑

FROM <bootc base image>

# Typically when using a management service, it will determine when to upgrade the system.
# So, disable bootc-fetch-apply-updates.timer if it is included in the base image.
RUN systemctl disable bootc-fetch-apply-updates.timer

# Install the client from dnf, or some other method that applies for your client
RUN dnf install management-client -y && dnf clean all

# Bake the credentials for the management service into the image
ARG activation_key=

# The existence of .run_next_boot acts as a flag to determine if the
# registration is required to run when booting
RUN touch /etc/management-client/.run_next_boot

COPY <<"EOT" /usr/lib/systemd/system/management-client.service
[Unit]
Description=Run management client at boot
After=network-online.target
ConditionPathExists=/etc/management-client/.run_client_next_boot

[Service]
Type=oneshot
EnvironmentFile=/etc/management-client/.credentials
ExecStart=/usr/bin/management-client register --activation-key ${CLIENT_ACTIVATION_KEY}
ExecStartPre=/bin/rm -f /etc/management-client/.run_next_boot
ExecStop=/bin/rm -f /etc/management-client/.credentials

[Install]
WantedBy=multi-user.target
EOT

# Link the service to run at startup
RUN ln -s /usr/lib/systemd/system/management-client.service \
    /usr/lib/systemd/system/multi-user.target.wants/management-client.service

# Store the credentials in a file to be used by the systemd service
RUN echo -e "CLIENT_ACTIVATION_KEY=${activation_key}" > /etc/management-client/.credentials

# Set the flag to enable the service to run one time
# The systemd service will remove this file after the registration completes the first time
RUN touch /etc/management-client/.run_next_boot

💀 bestie pls copy that block verbatim, character for character. don't go "improving" it, i'm watching 🫶

let's break the vibe down real quick though, because every chunk is doing a job ✨:

• first thing, systemctl disable bootc-fetch-apply-updates.timer — because when a management service is in the picture, it decides when the system upgrades. so if that timer came baked into your base image, it's gotta go 🙈.
• then you install the client, whether that's from dnf or literally any other method that applies to whichever client you're using 💖.
• ARG activation_key= is where you bake the credentials for the management service right into the image 🔐.
• the existence of .run_next_boot is acting as a flag — it's the little "yep, registration still needs to run when we boot" signal 🌸.
• the management-client.service unit is written in via COPY <<"EOT" at /usr/lib/systemd/system/management-client.service, and it runs the client at boot, after network-online.target, only when ConditionPathExists=/etc/management-client/.run_client_next_boot. it reads /etc/management-client/.credentials as its EnvironmentFile, runs /usr/bin/management-client register --activation-key ${CLIENT_ACTIVATION_KEY}, cleans up the flag file beforehand with ExecStartPre=/bin/rm -f /etc/management-client/.run_next_boot, and nukes the credentials afterward with ExecStop=/bin/rm -f /etc/management-client/.credentials.
• then you symlink the unit into multi-user.target.wants at startup, so it's wanted by multi-user.target 👑.
• echo -e "CLIENT_ACTIVATION_KEY=${activation_key}" > /etc/management-client/.credentials drops the credential into that file the systemd service uses 🎀.
• and finally, touch /etc/management-client/.run_next_boot flips the flag so the service gets to run exactly one time — because the service itself removes that file once the first registration completes ✨.

---

🔍 SEE ALSO 🔍

• bootc(8)
• bootc-docs(7)

---

📌 VERSION 📌

v1.17.1

---

and that's the whole page, bestie!! 💜 you just read bootc-management-services(7) from the Miscellaneous Information Manual, and this version info is riding along at v1.17.1. go forth and register your fleet, it's giving main character energy 👑🦋✨