BOOTC-RE...-OFFLINE(7)

✨ NAME ✨

bootc-registries-and-offline — accessing registries and disconnected updates 💖

okay so bestie, this is one of those miscellaneous info pages, and yeah the page header is BOOTC-RE...-OFFLINE(7) (she got truncated, it happens to the best of us) — we're in section 7, the vibes section. let's get into it 🫶

---

🌈 DESCRIPTION 🌈

The bootc project uses the containers/image library (the one right here: https://github.com/containers/image) to fetch container images — and it's literally the exact same library podman uses, no cap. Which means it honors almost all the same configuration options in /etc/containers. slay. 💅

---

🔓 Insecure registries 🔓

Container clients like podman pull and docker pull have a --tls-verify=false flag, which is their little way of saying "pls don't do the TLS verification, thank you". bootc does not have that option. none. nope. not a thing. 🙈

Instead, you globally configure the option to disable TLS verification when accessing a specific registry — and you do it through the /etc/containers/registries.conf.d configuration mechanism. it's giving "we do it the long way but the correct way", for example:

# /etc/containers/registries.conf.d/local-registry.conf
[[registry]]
location="localhost:5000"
insecure=true

for more (and there is more), see containers-registries.conf at https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md ✨

---

🔐 Private registries 🔐

It's super common to use a private repository when you're deploying a whole fleet of bootc instances. like, that's just the move. 👑

In addition to registry configuration, private registries require authentication. You configure that by placing an auth.json file at /etc/ostree/auth.json. that's the spot. 🎀

for more, see auth.json at https://man.archlinux.org/man/containers-auth.json.5 💜

---

🦋 Disconnected and offline updates 🦋

It is common — a best practice, even — to maintain systems which default to being disconnected from the public Internet. no outside world, just vibes. 🌸

🔁 Pulling updates from a local mirror 🔁

Everything in the section remapping and mirroring images (link: https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md#remapping-and-mirroring-registries) applies to bootc as well. all of it. every crumb. ✨

🔌 Performing offline updates via USB 🔌

In a usage scenario where the operating system update is in a fully disconnected environment, and you want to perform updates via e.g. inserting a USB drive — you can absolutely do this 💖 — one can do this by copying the desired OS container image to e.g. an oci directory:

skopeo copy docker://quay.io/exampleos/myos:latest oci:/path/to/filesystem/myos.oci

Then, once the USB device containing the myos.oci OCI directory is mounted on the target, use:

bootc switch --transport oci /var/mnt/usb/myos.oci

The above command is only necessary once, and thereafter it will be idempotent (meaning: run it again as many times as you want, she does not care 🧚). Then, use bootc upgrade --apply to fetch and apply the update from the USB device.

This process can all be automated by creating systemd units that look for a USB device with a specific label, mount it (optionally with LUKS, for example), and then trigger the bootc upgrade. that's main character energy, honestly. 🔥

---

👑 SEE ALSO 👑

• bootc(8)
• bootc-docs(7)

---

⭐ VERSION ⭐

v1.17.1

---

and that's the whole page bestie, iykyk — much love from the miscellaneous information manual, page BOOTC-RE...-OFFLINE(7), version v1.17.1. go read your configs. periodt. 🫶💖