-
Notifications
You must be signed in to change notification settings - Fork 338
/
Copy pathmkosi.1
1852 lines (1850 loc) · 84.8 KB
/
mkosi.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
.\" Automatically generated by Pandoc 2.14.0.3
.\"
.TH "mkosi" "1" "2016-" "" ""
.hy
.SH NAME
.PP
mkosi \[em] Build Bespoke OS Images
.SH SYNOPSIS
.PP
\f[C]mkosi [options\&...] build\f[R]
.PP
\f[C]mkosi [options\&...] clean\f[R]
.PP
\f[C]mkosi [options\&...] summary\f[R]
.PP
\f[C]mkosi [options\&...] shell [command line\&...]\f[R]
.PP
\f[C]mkosi [options\&...] boot [nspawn settings\&...]\f[R]
.PP
\f[C]mkosi [options\&...] qemu\f[R]
.PP
\f[C]mkosi [options\&...] ssh\f[R]
.PP
\f[C]mkosi [options\&...] serve\f[R]
.PP
\f[C]mkosi [options\&...] bump\f[R]
.PP
\f[C]mkosi [options\&...] genkey\f[R]
.PP
\f[C]mkosi [options\&...] help\f[R]
.SH DESCRIPTION
.PP
\f[C]mkosi\f[R] is a tool for easily building customized OS images.
It\[cq]s a fancy wrapper around \f[C]dnf --installroot\f[R],
\f[C]debootstrap\f[R], \f[C]pacstrap\f[R] and \f[C]zypper\f[R] that may
generate disk images with a number of bells and whistles.
.SS Command Line Verbs
.PP
The following command line verbs are known:
.TP
\f[B]\f[CB]build\f[B]\f[R]
This builds the image, based on the settings passed in on the command
line or read from a \f[C]mkosi.default\f[R] file.
This verb is the default if no verb is explicitly specified.
This command must be executed as \f[C]root\f[R].
Any arguments passed after \f[C]build\f[R] are passed as arguments to
the build script (if there is one).
.TP
\f[B]\f[CB]clean\f[B]\f[R]
Remove build artifacts generated on a previous build.
If combined with \f[C]-f\f[R], also removes incremental build cache
images.
If \f[C]-f\f[R] is specified twice, also removes any package cache.
.TP
\f[B]\f[CB]summary\f[B]\f[R]
Outputs a human-readable summary of all options used for building an
image.
This will parse the command line and \f[C]mkosi.default\f[R] file as it
would do on \f[C]build\f[R], but only output what it is configured for
and not actually build anything.\[ga]
.TP
\f[B]\f[CB]shell\f[B]\f[R]
This builds the image if it is not built yet, and then invokes
\f[C]systemd-nspawn\f[R] to acquire an interactive shell prompt in it.
If this verb is used an optional command line may be specified which is
then invoked in place of the shell in the container.
Combine this with \f[C]-f\f[R] in order to rebuild the image
unconditionally before acquiring the shell, see below.
This command must be executed as \f[C]root\f[R].
.TP
\f[B]\f[CB]boot\f[B]\f[R]
Similar to \f[C]shell\f[R] but boots the image up using
\f[C]systemd-nspawn\f[R].
If this verb is used an optional command line may be specified which is
passed as \[lq]kernel command line\[rq] to the init system in the image.
.TP
\f[B]\f[CB]qemu\f[B]\f[R]
Similar to \f[C]boot\f[R] but uses \f[C]qemu\f[R] to boot up the image,
i.e.\ instead of container virtualization VM virtualization is used.
This verb is only supported on images that contain a boot loader,
i.e.\ those built with \f[C]Bootable=yes\f[R] (see below).
This command must be executed as \f[C]root\f[R] unless the image already
exists and \f[C]-f\f[R] is not specified.
.TP
\f[B]\f[CB]ssh\f[B]\f[R]
When the image is built with the \f[C]Ssh=yes\f[R] option, this command
connects to a booted (\f[C]boot\f[R], \f[C]qemu\f[R] verbs) container/VM
via SSH.
Make sure to run \f[C]mkosi ssh\f[R] with the same config as
\f[C]mkosi build\f[R] was run with so that it has the necessary
information available to connect to the running container/VM via SSH.
.TP
\f[B]\f[CB]serve\f[B]\f[R]
This builds the image if it is not built yet, and then serves the output
directory (i.e.\ usually \f[C]mkosi.output/\f[R], see below) via a small
embedded HTTP server, listening on port 8081.
Combine with \f[C]-f\f[R] in order to rebuild the image unconditionally
before serving it.
This command is useful for testing network based acquisition of OS
images, for example via \f[C]machinectl pull-raw \&...\f[R] and
\f[C]machinectl pull-tar \&...\f[R].
.TP
\f[B]\f[CB]bump\f[B]\f[R]
Determines the current image version string (as configured with
\f[C]ImageVersion=\f[R]/\f[C]--image-version=\f[R]), increases its last
dot-separated component by one and writes the resulting version string
to \f[C]mkosi.version\f[R].
This is useful for implementing a simple versioning scheme: each time
this verb is called the version is bumped in preparation for the
subsequent build.
Note that \f[C]--auto-bump\f[R]/\f[C]-B\f[R] may be used to
automatically bump the version after each successful build.
.TP
\f[B]\f[CB]genkey\f[B]\f[R]
Generate a pair of SecureBoot keys for usage with the
\f[C]SecureBootKey=\f[R]/\f[C]--secure-boot-key=\f[R] and
\f[C]SecureBootCertificate=\f[R]/\f[C]--secure-boot-certificate=\f[R]
options.
.TP
\f[B]\f[CB]help\f[B]\f[R]
This verb is equivalent to the \f[C]--help\f[R] switch documented below:
it shows a brief usage explanation.
.SS Execution flow
.PP
Execution flow for \f[C]mkosi build\f[R].
Columns represent the execution context.
Default values/calls are shown in parentheses.
When building with \f[C]--incremental\f[R] mkosi creates a cache of the
distribution installation for both images if not already existing and
replaces the distribution installation in consecutive runs with data
from the cached one.
.IP
.nf
\f[C]
HOST . BUILD . FINAL
. IMAGE . IMAGE
. .
start . .
| . .
v . .
build script? -------exists-----> copy .
| . skeleton trees .
| . (mkosi.skeleton/) .
none . | .
| . v .
v . install .
skip . distribution, .
build image . packages and .
| . build packages, .
| . run .
| . prepare script .
| . (mkosi.prepare build) .
| . or if incremental .
| . use cached build image .
| . | .
| . v .
| . copy .
| . build sources .
| . (./) .
| . | .
| . v .
| . copy .
| . extra trees .
| . (mkosi.extra/) .
| . | .
| . v .
| . run .
| . postinstall script .
| . (mkosi.postinst build) .
| . | .
| .-------------------------\[aq] .
| | . .
| v . .
| run . .
| finalize script . .
|(mkosi.finalize build). .
| | . .
| \[aq]-------------------------. .
| . | .
| . v .
| . run .
| . build script .
| . (mkosi.build) .
| . | .
\[aq]-----------------------------------+------------------------.
. . |
. . v
. . copy
. . skeleton trees
. . (mkosi.skeleton/)
. . |
. . v
. . install
. . distribution
. . and packages,
. . run
. . prepare script
. . (mkosi.prepare final)
. . or if incremental
. . use cached final image
. . |
. . v
. . copy
. . build results
. . |
. . v
. . copy
. . extra trees
. . (mkosi.extra/)
. . |
. . v
. . run
. . postinstall script
. . (mkosi.postinst final)
. . |
. . v
. . |
. . perform cleanup
. . (remove files, packages,
. . package metadata)
. . |
.--------------------------------------------------\[aq]
| . .
v . .
run . .
finalize script . .
(mkosi.finalize final) . .
| . .
.---------\[aq] . .
| . .
v . .
end . .
. .
HOST . BUILD . FINAL
. IMAGE . IMAGE
. .
\f[R]
.fi
.SS Supported output formats
.PP
The following output formats are supported:
.IP \[bu] 2
Raw \f[I]GPT\f[R] disk image, with ext4 as root (\f[I]gpt_ext4\f[R])
.IP \[bu] 2
Raw \f[I]GPT\f[R] disk image, with xfs as root (\f[I]gpt_xfs\f[R])
.IP \[bu] 2
Raw \f[I]GPT\f[R] disk image, with btrfs as root (\f[I]gpt_btrfs\f[R])
.IP \[bu] 2
Raw \f[I]GPT\f[R] disk image, with squashfs as read-only root
(\f[I]gpt_squashfs\f[R])
.IP \[bu] 2
Plain squashfs image, without partition table, as read-only root
(\f[I]plain_squashfs\f[R])
.IP \[bu] 2
Plain directory, containing the OS tree (\f[I]directory\f[R])
.IP \[bu] 2
btrfs subvolume, with separate subvolumes for \f[C]/var\f[R],
\f[C]/home\f[R], \f[C]/srv\f[R], \f[C]/var/tmp\f[R]
(\f[I]subvolume\f[R])
.IP \[bu] 2
Tar archive (\f[I]tar\f[R])
.IP \[bu] 2
CPIO archive (\f[I]cpio\f[R]) in the format appropriate for a kernel
initrd
.PP
When a \f[I]GPT\f[R] disk image is created, the following additional
options are available:
.IP \[bu] 2
A swap partition may be added in
.IP \[bu] 2
The image may be made bootable on \f[I]EFI\f[R] and \f[I]BIOS\f[R]
systems
.IP \[bu] 2
Separate partitions for \f[C]/srv\f[R] and \f[C]/home\f[R] may be added
in
.IP \[bu] 2
The root, \f[C]/srv\f[R] and \f[C]/home\f[R] partitions may optionally
be encrypted with LUKS.
.IP \[bu] 2
A dm-verity partition may be added in that adds runtime integrity data
for the root partition
.SS Configuration Settings
.PP
The following settings can be set through configuration files (the
syntax with \f[C]SomeSetting=value\f[R]) and on the command line (the
syntax with \f[C]--some-setting=value\f[R]).
For some command line parameters, a single-letter shortcut is also
allowed.
In the configuration files, the setting must be in the appropriate
section, so the settings are grouped by section below.
.PP
Command line options that take no argument are shown without \[lq]=\[rq]
in their long version.
In the config files, they should be specified with a boolean argument:
either \[lq]1\[rq], \[lq]yes\[rq], or \[lq]true\[rq] to enable, or
\[lq]0\[rq], \[lq]no\[rq], \[lq]false\[rq] to disable.
.SS [Distribution] Section
.TP
\f[B]\f[CB]Distribution=\f[B]\f[R], \f[B]\f[CB]--distribution=\f[B]\f[R], \f[B]\f[CB]-d\f[B]\f[R]
The distribution to install in the image.
Takes one of the following arguments: \f[C]fedora\f[R],
\f[C]debian\f[R], \f[C]ubuntu\f[R], \f[C]arch\f[R], \f[C]opensuse\f[R],
\f[C]mageia\f[R], \f[C]centos\f[R], \f[C]centos_epel\f[R],
\f[C]clear\f[R], \f[C]photon\f[R], \f[C]openmandriva\f[R],
\f[C]rocky\f[R], \f[C]rocky_epel\f[R], \f[C]alma\f[R],
\f[C]alma_epel\f[R].
If not specified, defaults to the distribution of the host.
.TP
\f[B]\f[CB]Release=\f[B]\f[R], \f[B]\f[CB]--release=\f[B]\f[R], \f[B]\f[CB]-r\f[B]\f[R]
The release of the distribution to install in the image.
The precise syntax of the argument this takes depends on the
distribution used, and is either a numeric string (in case of Fedora
Linux, CentOS, \&..., e.g.\ \f[C]29\f[R]), or a distribution version
name (in case of Debian, Ubuntu, \&..., e.g.\ \f[C]artful\f[R]).
If neither this option, nor \f[C]Distribution=\f[R] is specified,
defaults to the distribution version of the host.
If the distribution is specified, defaults to a recent version of it.
.TP
\f[B]\f[CB]Mirror=\f[B]\f[R], \f[B]\f[CB]--mirror=\f[B]\f[R], \f[B]\f[CB]-m\f[B]\f[R]
The mirror to use for downloading the distribution packages.
Expects a mirror URL as argument.
.TP
\f[B]\f[CB]Repositories=\f[B]\f[R], \f[B]\f[CB]--repositories=\f[B]\f[R]
Additional package repositories to use during installation.
Expects one or more URLs as argument, separated by commas.
This option may be used multiple times, in which case the list of
repositories to use is combined.
Use \[lq]!*\[rq] to remove all repositories from to the list or use
e.g.\ \[lq]!repo-url\[rq] to remove just one specific repository.
For Arch Linux, additional repositories must be passed in the form
\f[C]<name>::<url>\f[R] (e.g.\ \f[C]myrepo::https://myrepo.net\f[R]).
.TP
\f[B]\f[CB]UseHostRepositories=\f[B]\f[R], \f[B]\f[CB]--use-host-repositories\f[B]\f[R]
This option is only applicable for RPM-based distributions:
\f[I]CentOS\f[R], \f[I]Fedora Linux\f[R], \f[I]Mageia\f[R],
\f[I]Photon\f[R], \f[I]Rocky Linux\f[R], \f[I]Alma Linux\f[R] and
\f[I]OpenMandriva\f[R].
Allows use of the host\[cq]s existing RPM repositories.
By default, a hardcoded set of default RPM repositories is generated and
used.
Use \f[C]--repositories=\f[R] to identify a custom set of repositories
to be enabled and used for the build.
.TP
\f[B]\f[CB]RepositoryDirectory\f[B]\f[R], \f[B]\f[CB]--repository-directory\f[B]\f[R]
This option can (for now) only be used with RPM-based istributions and
Arch Linux.
It identifies a directory containing extra repository definitions that
will be used when installing packages.
The files are passed directly to the corresponding package manager and
should be written in the format expected by the package manager of the
image\[cq]s distro.
.TP
\f[B]\f[CB]Architecture=\f[B]\f[R], \f[B]\f[CB]--architecture=\f[B]\f[R]
The architecture to build the image for.
Note that this currently only works for architectures compatible with
the host\[cq]s architecture.
.SS [Output] Section
.TP
\f[B]\f[CB]Format=\f[B]\f[R], \f[B]\f[CB]--format=\f[B]\f[R], \f[B]\f[CB]-t\f[B]\f[R]
The image format type to generate.
One of \f[C]directory\f[R] (for generating OS images inside a local
directory), \f[C]subvolume\f[R] (similar, but as a btrfs subvolume),
\f[C]tar\f[R] (similar, but a tarball of the image is generated),
\f[C]cpio\f[R] (similar, but a cpio archive is generated),
\f[C]gpt_ext4\f[R] (a block device image with an ext4 file system inside
a GPT partition table), \f[C]gpt_xfs\f[R] (similar, but with an xfs file
system), \f[C]gpt_btrfs\f[R] (similar, but with an btrfs file system),
\f[C]gpt_squashfs\f[R] (similar, but with a squashfs file system),
\f[C]plain_squashfs\f[R] (a plain squashfs file system without a
partition table).
.TP
\f[B]\f[CB]ManifestFormat=\f[B]\f[R], \f[B]\f[CB]--manifest-format=\f[B]\f[R]
The manifest format type or types to generate.
A comma-delimited list consisting of \f[C]json\f[R] (the standard JSON
output format that describes the packages installed),
\f[C]changelog\f[R] (a human-readable text format designed for diffing).
Defaults to \f[C]json\f[R].
.TP
\f[B]\f[CB]Output=\f[B]\f[R], \f[B]\f[CB]--output=\f[B]\f[R], \f[B]\f[CB]-o\f[B]\f[R]
Path for the output image file to generate.
Takes a relative or absolute path where the generated image will be
placed.
If neither this option nor \f[C]OutputDirectory=\f[R] is used, the image
is generated under the name \f[C]image\f[R], but its name suffixed with
an appropriate file suffix (e.g.\ \f[C]image.raw.xz\f[R] in case
\f[C]gpt_ext4\f[R] is used in combination with \f[C]xz\f[R]
compression).
If the \f[C]ImageId=\f[R] option is configured it is used instead of
\f[C]image\f[R] in the default output name.
If an image version is specified via \f[C]ImageVersion=\f[R], it is
included in the default name, e.g.\ a specified image version of
\f[C]7.8\f[R] might result in an image file name of
\f[C]image_7.8.raw.xz\f[R].
.TP
\f[B]\f[CB]OutputSplitRoot=\f[B]\f[R], \f[B]\f[CB]--output-split-root=\f[B]\f[R], \f[B]\f[CB]OutputSplitVerify=\f[B]\f[R], \f[B]\f[CB]--output-split-verity=\f[B]\f[R], \f[B]\f[CB]OutputSplitKernel=\f[B]\f[R], \f[B]\f[CB]--output-split-kernel=\f[B]\f[R]
Paths for the split-out output image files, when
\f[C]SplitArtifacts=yes\f[R] is used.
If unspecified, the relevant split artifact files will be named like the
main image, but with \f[C].root\f[R], \f[C].verity\f[R], and
\f[C].efi\f[R] suffixes inserted (and in turn possibly suffixed by
compression suffix, if compression is enabled).
.TP
\f[B]\f[CB]OutputDirectory=\f[B]\f[R], \f[B]\f[CB]--output-dir=\f[B]\f[R], \f[B]\f[CB]-O\f[B]\f[R]
Path to a directory where to place all generated artifacts (i.e.\ the
generated image when an output path is not given, \f[C]SHA256SUMS\f[R]
file, etc.).
If this is not specified and the directory \f[C]mkosi.output/\f[R]
exists in the local directory, it is automatically used for this
purpose.
If the setting is not used and \f[C]mkosi.output/\f[R] does not exist,
all output artifacts are placed adjacent to the output image file.
.TP
\f[B]\f[CB]WorkspaceDirectory=\f[B]\f[R], \f[B]\f[CB]--workspace-dir=\f[B]\f[R]
Path to a directory where to store data required temporarily while
building the image.
This directory should have enough space to store the full OS image,
though in most modes the actually used disk space is smaller.
If not specified, and \f[C]mkosi.workspace/\f[R] exists in the local
directory, it is used for this purpose.
Otherwise, a subdirectory in the temporary storage area is used
(\f[C]$TMPDIR\f[R] if set, \f[C]/var/tmp/\f[R] otherwise).
The data in this directory is removed automatically after each build.
It\[cq]s safe to manually remove the contents of this directory should
an \f[C]mkosi\f[R] invocation be aborted abnormally (for example, due to
reboot/power failure).
If the \f[C]btrfs\f[R] output modes are selected this directory must be
backed by \f[C]btrfs\f[R] too.
.TP
\f[B]\f[CB]Force=\f[B]\f[R], \f[B]\f[CB]--force\f[B]\f[R], \f[B]\f[CB]-f\f[B]\f[R]
Replace the output file if it already exists, when building an image.
By default when building an image and an output artifact already exists
\f[C]mkosi\f[R] will refuse operation.
Specify this option once to delete all build artifacts from a previous
run before re-building the image.
If incremental builds are enabled, specifying this option twice will
ensure the intermediary cache files are removed, too, before the
re-build is initiated.
If a package cache is used (also see the \[lq]Files\[rq] section below),
specifying this option thrice will ensure the package cache is removed
too, before the re-build is initiated.
For the \f[C]clean\f[R] operation this option has a slightly different
effect: by default the verb will only remove build artifacts from a
previous run, when specified once the incremental cache files are
deleted too, and when specified twice the package cache is also removed.
.PP
.TP
\f[B]\f[CB]GPTFirstLBA=\f[B]\f[R], \f[B]\f[CB]--gpt-first-lba=\f[B]\f[R]
Override the first usable LBA (Logical Block Address) within the GPT
header.
This defaults to \f[C]2048\f[R], which is actually the desired value.
However, some tools, e.g.\ the \f[C]prl_disk_tool\f[R] utility from the
Parallels virtualization suite require this to be set to \f[C]34\f[R],
otherwise they might fail to resize the disk image and/or partitions
inside it.
.TP
\f[B]\f[CB]Bootable=\f[B]\f[R], \f[B]\f[CB]--bootable\f[B]\f[R], \f[B]\f[CB]-b\f[B]\f[R]
Generate a bootable image.
By default this will generate an image bootable on UEFI systems.
Use \f[C]BootProtocols=\f[R] to select support for a different boot
protocol.
.TP
\f[B]\f[CB]BootProtocols=\f[B]\f[R], \f[B]\f[CB]--boot-protocols=\f[B]\f[R]
Pick one or more boot protocols to support when generating a bootable
image, as enabled with \f[C]Bootable=\f[R].
Takes a comma-separated list of \f[C]uefi\f[R] or \f[C]bios\f[R].
May be specified more than once in which case the specified lists are
merged.
If \f[C]uefi\f[R] is specified the \f[C]sd-boot\f[R] UEFI boot loader is
used, if \f[C]bios\f[R] is specified the GNU Grub boot loader is used.
Use \[lq]!*\[rq] to remove all previously added protocols or
\[lq]!protocol\[rq] to remove one protocol.
.TP
\f[B]\f[CB]KernelCommandLine=\f[B]\f[R], \f[B]\f[CB]--kernel-command-line=\f[B]\f[R]
Use the specified kernel command line when building bootable images.
By default command line arguments get appended.
To remove all arguments from the current list pass \[lq]!*\[rq].
To remove specific arguments add a space separated list of \[lq]!\[rq]
prefixed arguments.
For example adding \[lq]!* console=ttyS0 rw\[rq] to a
\f[C]mkosi.default\f[R] file or the command line arguments passes
\[lq]console=ttyS0 rw\[rq] to the kernel in any case.
Just adding \[lq]console=ttyS0 rw\[rq] would append these two arguments
to the kernel command line created by lower priority configuration files
or previous \f[C]KernelCommandLine=\f[R] command line arguments.
.TP
\f[B]\f[CB]SecureBoot=\f[B]\f[R], \f[B]\f[CB]--secure-boot\f[B]\f[R]
Sign the resulting kernel/initrd image for UEFI SecureBoot.
.TP
\f[B]\f[CB]SecureBootKey=\f[B]\f[R], \f[B]\f[CB]--secure-boot-key=\f[B]\f[R]
Path to the PEM file containing the secret key for signing the UEFI
kernel image, if \f[C]SecureBoot=\f[R] is used.
.TP
\f[B]\f[CB]SecureBootCertificate=\f[B]\f[R], \f[B]\f[CB]--secure-boot-certificate=\f[B]\f[R]
Path to the X.509 file containing the certificate for the signed UEFI
kernel image, if \f[C]SecureBoot=\f[R] is used.
.TP
\f[B]\f[CB]SecureBootCommonName=\f[B]\f[R], \f[B]\f[CB]--secure-boot-common-name=\f[B]\f[R]
Common name to be used when generating SecureBoot keys via mkosi\[cq]s
\f[C]genkey\f[R] command.
Defaults to \f[C]mkosi of %u\f[R], where \f[C]%u\f[R] expands to the
username of the user invoking mkosi.
.TP
\f[B]\f[CB]SecureBootValidDays=\f[B]\f[R], \f[B]\f[CB]--secure-boot-valid-days=\f[B]\f[R]
Number of days that the keys should remain valid when generating
SecureBoot keys via mkosi\[cq]s \f[C]genkey\f[R] command.
Defaults to two years (730 days).
.TP
\f[B]\f[CB]ReadOnly=\f[B]\f[R], \f[B]\f[CB]--read-only\f[B]\f[R]
Set the read-only flag on the root partition in the partition table.
Only applies to \f[C]gpt_ext4\f[R], \f[C]gpt_xfs\f[R],
\f[C]gpt_btrfs\f[R], \f[C]subvolume\f[R] output formats, and is implied
on \f[C]gpt_squashfs\f[R] and \f[C]plain_squashfs\f[R].
The read-only flag is essentially a hint to tools using the image (see
https://systemd.io/DISCOVERABLE_PARTITIONS/).
In particular, all systemd tools like \f[C]systemd-nspawn\f[R] and
\f[C]systemd-gpt-auto-generator\f[R] will mount such partitions
read-only, but tools from other project may ignore the flag.
.TP
\f[B]\f[CB]Minimize=\f[B]\f[R], \f[B]\f[CB]--minimize\f[B]\f[R]
Attempt to make the resulting root file system as small as possible by
removing free space from the file system.
Only supported for \f[C]gpt_ext4\f[R] and \f[C]gpt_btrfs\f[R].
For ext4 this relies on \f[C]resize2fs -M\f[R], which reduces the free
disk space but is not perfect and generally leaves some free space.
For btrfs the results are optimal and no free space is left.
.TP
\f[B]\f[CB]Encrypt=\f[B]\f[R], \f[B]\f[CB]--encrypt\f[B]\f[R]
Encrypt all partitions in the file system or just the root file system.
Takes either \f[C]all\f[R] or \f[C]data\f[R] as argument.
If \f[C]all\f[R], the root, \f[C]/home\f[R] and \f[C]/srv\f[R] file
systems will be encrypted using dm-crypt/LUKS (with its default
settings).
If \f[C]data\f[R], the root file system will be left unencrypted, but
\f[C]/home\f[R] and \f[C]/srv\f[R] will be encrypted.
The passphrase to use is read from the \f[C]mkosi.passphrase\f[R] file
in the current working directory.
Note that the UEFI System Partition (ESP) containing the boot loader and
kernel to boot is never encrypted since it needs to be accessible by the
firmware.
.TP
\f[B]\f[CB]Verity=\f[B]\f[R], \f[B]\f[CB]--verity\f[B]\f[R]
Add a \[lq]Verity\[rq] integrity partition to the image.
Takes a boolean or the special value \f[C]signed\f[R], and defaults to
disabled.
If enabled, the root partition (or \f[C]/usr/\f[R] partition, in case
\f[C]UsrOnly=\f[R] is enabled) is protected with \f[C]dm-verity\f[R]
against offline modification, the verification data is placed in an
additional GPT partition.
Implies \f[C]ReadOnly=yes\f[R].
If this is enabled, the Verity root hash is written to an output file
with \f[C].roothash\f[R] or \f[C].usrhash\f[R] suffix.
If set to \f[C]signed\f[R], Verity is also enabled, but the resulting
root hash is then also signed (in PKCS#7 format) with the signature key
configured with \f[C]SecureBootKey=\f[R].
Or in other words: the SecureBoot key pair is then used to both sign the
kernel, if that is enabled, and the root/\f[C]/usr/\f[R] file system.
This signature is then stored in an additional output file with the
\f[C].roothash.p7s\f[R] or \f[C].usrhash.p7s\f[R] suffix in DER format.
It is also written to an additional partition in the image.
The latter allows generating self-contained signed disk images,
implementing the Verity provisions described in the Discoverable
Partitions Specification (https://systemd.io/DISCOVERABLE_PARTITIONS).
.TP
\f[B]\f[CB]CompressFs=\f[B]\f[R], \f[B]\f[CB]--compress-fs=\f[B]\f[R]
Enable or disable internal compression in the file system.
Only applies to output formats with squashfs or btrfs.
Takes one of \f[C]zlib\f[R], \f[C]lzo\f[R], \f[C]zstd\f[R],
\f[C]lz4\f[R], \f[C]xz\f[R] or a boolean value as argument.
If the latter is used compression is enabled/disabled and the default
algorithm is used.
In case of the \f[C]squashfs\f[R] output formats compression is implied,
but this option may be used to select the algorithm.
.TP
\f[B]\f[CB]CompressOutput=\f[B]\f[R], \f[B]\f[CB]--compress-output=\f[B]\f[R]
Configure compression for the resulting image or archive.
The argument can be either a boolean or a compression algorithm
(\f[C]xz\f[R], \f[C]zstd\f[R]).
\f[C]xz\f[R] compression is used by default.
Note that when applied to block device image types this means the image
cannot be started directly but needs to be decompressed first.
This also means that the \f[C]shell\f[R], \f[C]boot\f[R], \f[C]qemu\f[R]
verbs are not available when this option is used.
Implied for \f[C]tar\f[R] and \f[C]cpio\f[R].
.TP
\f[B]\f[CB]Compress=\f[B]\f[R], \f[B]\f[CB]--compress=\f[B]\f[R]
Enable compression.
Using this option is equivalent to either \f[C]CompressFs=\f[R] or
\f[C]CompressOutput=\f[R]; the appropriate type of compression is
selected automatically.
.TP
\f[B]\f[CB]Mksquashfs=\f[B]\f[R], \f[B]\f[CB]--mksquashfs=\f[B]\f[R]
Set the path to the \f[C]mksquashfs\f[R] executable to use.
This is useful in case the parameters for the tool shall be augmented,
as the tool may be replaced by a script invoking it with the right
parameters, this way.
.TP
\f[B]\f[CB]QCow2=\f[B]\f[R], \f[B]\f[CB]--qcow2\f[B]\f[R]
Encode the resulting image as QEMU QCOW2 image.
This only applies to \f[C]gpt_ext4\f[R], \f[C]gpt_xfs\f[R],
\f[C]gpt_btrfs\f[R], \f[C]gpt_squashfs\f[R].
QCOW2 images can be read natively by \f[C]qemu\f[R], but not by the
Linux kernel.
This means the \f[C]shell\f[R] and \f[C]boot\f[R] verbs are not
available when this option is used, however \f[C]qemu\f[R] will work.
.TP
\f[B]\f[CB]Hostname=\f[B]\f[R], \f[B]\f[CB]--hostname=\f[B]\f[R]
Set the image\[cq]s hostname to the specified name.
.TP
\f[B]\f[CB]ImageVersion=\f[B]\f[R], \f[B]\f[CB]--image-version=\f[B]\f[R]
Configure the image version.
This accepts any string, but it is recommended to specify a series of
dot separated components.
The version may also be configured in a file \f[C]mkosi.version\f[R] in
which case it may be conveniently managed via the \f[C]bump\f[R] verb or
the \f[C]--auto-bump\f[R] switch.
When specified the image version is included in the default output file
name, i.e.\ instead of \f[C]image.raw\f[R] the default will be
\f[C]image_0.1.raw\f[R] for version \f[C]0.1\f[R] of the image, and
similar.
The version is also passed via the \f[C]$IMAGE_VERSION\f[R] to any build
scripts invoked (which may be useful to patch it into
\f[C]/etc/os-release\f[R] or similar, in particular the
\f[C]IMAGE_VERSION=\f[R] field of it).
.TP
\f[B]\f[CB]ImageId=\f[B]\f[R], \f[B]\f[CB]--image-id=\f[B]\f[R]
Configure the image identifier.
This accepts a freeform string that shall be used to identify the image
with.
If set the default output file will be named after it (possibly suffixed
with the version).
If this option is used the root, \f[C]/usr/\f[R] and Verity partitions
in the image will have their labels set to this (possibly suffixed by
the image version).
The identifier is also passed via the \f[C]$IMAGE_ID\f[R] to any build
scripts invoked (which may be useful to patch it into
\f[C]/etc/os-release\f[R] or similar, in particular the
\f[C]IMAGE_ID=\f[R] field of it).
.TP
\f[B]\f[CB]WithUnifiedKernelImages=\f[B]\f[R], \f[B]\f[CB]--without-unified-kernel-images\f[B]\f[R]
If specified, mkosi does not build unified kernel images and instead
installs kernels with a separate initrd and boot loader config to the
efi or bootloader partition.
.TP
\f[B]\f[CB]HostonlyInitrd=\f[B]\f[R], \f[B]\f[CB]--hostonly-initrd\f[B]\f[R]
If specified, mkosi will run the tool to create the initrd such that a
non-generic initrd is created that will only be able to run on the
system mkosi is run on.
Currently mkosi uses dracut for all supported distributions except Clear
Linux and this option translates to enabling dracut\[cq]s hostonly
option.
.TP
\f[B]\f[CB]UsrOnly=\f[B]\f[R], \f[B]\f[CB]--usr-only\f[B]\f[R]
If specified, \f[C]mkosi\f[R] will only add the \f[C]/usr/\f[R]
directory tree (instead of the whole root file system) to the image.
This is useful for fully stateless systems that come up pristine on
every single boot, where \f[C]/etc/\f[R] and \f[C]/var/\f[R] are
populated by \f[C]systemd-tmpfiles\f[R]/\f[C]systemd-sysusers\f[R] and
related calls, or systems that are originally shipped without a root
file system, but where \f[C]systemd-repart\f[R] adds one on the first
boot.
.TP
\f[B]\f[CB]SplitArtifacts=\f[B]\f[R], \f[B]\f[CB]--split-artifacts\f[B]\f[R]
If specified and building an image with a partition table, also write
out the root file system partition, its Verity partition (if configured)
and the generated unified kernel (if configured) into separate output
files.
This is useful in A/B update scenarios where an existing disk image
shall be augmented with a new version of a root or \f[C]/usr\f[R]
partition along with its Verity partition and unified kernel.
.TP
\f[B]\f[CB]NoChown=\f[B]\f[R], \f[B]\f[CB]--no-chown\f[B]\f[R]
By default, if \f[C]mkosi\f[R] is run inside a \f[C]sudo\f[R]
environment all generated artifacts have their UNIX user/group ownership
changed to the user which invoked \f[C]sudo\f[R].
With this option this may be turned off and all generated files are
owned by \f[C]root\f[R].
.TP
\f[B]\f[CB]TarStripSELinuxContext=\f[B]\f[R], \f[B]\f[CB]--tar-strip-selinux-context\f[B]\f[R]
If running on a SELinux-enabled system (Fedora Linux, CentOS, Rocky
Linux, Alma Linux), files inside the container are tagged with SELinux
context extended attributes (\f[C]xattrs\f[R]), which may interfere with
host SELinux rules in building or further container import stages.
This option strips SELinux context attributes from the resulting tar
archive.
.TP
\f[B]\f[CB]MachineID=\f[B]\f[R], \f[B]\f[CB]--machine-id\f[B]\f[R]
Set the machine\[cq]s ID to the specified value.
If unused, a random ID will be used while building the image and the
final image will be shipped without a machine ID.
.SS [Content] Section
.TP
\f[B]\f[CB]BasePackages=\f[B]\f[R], \f[B]\f[CB]--base-packages\f[B]\f[R]
Takes a boolean or the special value \f[C]conditional\f[R].
If true, automatically install packages to ensure basic functionality,
as appropriate for the given image type.
For example, \f[C]systemd\f[R] is always included,
\f[C]systemd-udev\f[R] and \f[C]dracut\f[R] if the image is bootable,
and so on.
If false, only packages specified with \f[C]Packages=\f[R] will be
installed.
If \f[C]conditional\f[R], the list of packages to install will be
extended with boolean dependencies (c.f.
https://rpm.org/user_doc/boolean_dependencies.html), to install specific
packages when \f[I]other\f[R] packages are in the list.
For example, \f[C]systemd-udev\f[R] may be automatically included if the
image is bootable and \f[C]systemd\f[R] is installed.
With this, various \[lq]base\[rq] packages still need to be specified if
they should be included, but the corresponding \[lq]extension\[rq]
packages will be added automatically when appropriate.
This feature depends on support in the package manager, so it is not
implemented for all distributions.
.TP
\f[B]\f[CB]Packages=\f[B]\f[R], \f[B]\f[CB]--package=\f[B]\f[R], \f[B]\f[CB]-p\f[B]\f[R]
Install the specified distribution packages (i.e.\ RPM, DEB, \&...) in
the image.
Takes a comma separated list of package specifications.
This option may be used multiple times in which case the specified
package lists are combined.
Packages specified this way will be installed both in the development
and the final image.
Use \f[C]BuildPackages=\f[R] to specify packages that shall only be used
for the image generated in the build image, but that shall not appear in
the final image.
The types and syntax of \[lq]package specifications\[rq] that are
allowed depend on the package installer (e.g.\ \f[C]dnf\f[R] or
\f[C]yum\f[R] for \f[C]rpm\f[R]-based distros or \f[C]apt\f[R] for
\f[C]deb\f[R]-based distros), but may include package names, package
names with version and/or architecture, package name globs, paths to
packages in the file system, package groups, and virtual provides,
including file paths.
To remove a package e.g.\ added by a \f[C]mkosi.default\f[R]
configuration file prepend the package name with \f[C]!\f[R].
For example -p \[lq]!apache2\[rq] would remove the apache2 package.
To replace the apache2 package by the httpd package just add -p
\[lq]!apache2,httpd\[rq] to the command line arguments.
To remove all packages use \[lq]!*\[rq].
Example: when using an distro that uses \f[C]dnf\f[R],
\f[C]Packages=meson libfdisk-devel.i686 git-* prebuilt/rpms/systemd-249-rc1.local.rpm /usr/bin/ld \[at]development-tools python3dist(mypy)\f[R]
would install the \f[C]meson\f[R] package (in the latest version), the
32-bit version of the \f[C]libfdisk-devel\f[R] package, all available
packages that start with the \f[C]git-\f[R] prefix, a \f[C]systemd\f[R]
rpm from the local file system, one of the packages that provides
\f[C]/usr/bin/ld\f[R], the packages in the \[lq]Development Tools\[rq]
group, and the package that contains the \f[C]mypy\f[R] python module.
.TP
\f[B]\f[CB]WithDocs=\f[B]\f[R], \f[B]\f[CB]--with-docs\f[B]\f[R]
Include documentation in the image built.
By default if the underlying distribution package manager supports it
documentation is not included in the image built.
The \f[C]$WITH_DOCS\f[R] environment variable passed to the
\f[C]mkosi.build\f[R] script indicates whether this option was used or
not.
.TP
\f[B]\f[CB]WithTests=\f[B]\f[R], \f[B]\f[CB]--without-tests\f[B]\f[R], \f[B]\f[CB]-T\f[B]\f[R]
If set to false (or when the command-line option is used), the
\f[C]$WITH_TESTS\f[R] environment variable is set to \f[C]0\f[R] when
the \f[C]mkosi.build\f[R] script is invoked.
This is supposed to be used by the build script to bypass any unit or
integration tests that are normally run during the source build process.
Note that this option has no effect unless the \f[C]mkosi.build\f[R]
build script honors it.
.TP
\f[B]\f[CB]Cache=\f[B]\f[R], \f[B]\f[CB]--cache=\f[B]\f[R]
Takes a path to a directory to use as package cache for the distribution
package manager used.
If this option is not used, but a \f[C]mkosi.cache/\f[R] directory is
found in the local directory it is automatically used for this purpose.
The directory configured this way is mounted into both the development
and the final image while the package manager is running.
.TP
\f[B]\f[CB]SkeletonTree=\f[B]\f[R], \f[B]\f[CB]--skeleton-tree=\f[B]\f[R]
Takes a path to a directory to copy into the OS tree before invoking the
package manager.
Use this to insert files and directories into the OS tree before the
package manager installs any packages.
If this option is not used, but the \f[C]mkosi.skeleton/\f[R] directory
is found in the local directory it is automatically used for this
purpose (also see the \[lq]Files\[rq] section below).
Instead of a directory, a tar file may be provided.
In this case it is unpacked into the OS tree before the package manager
is invoked.
This mode of operation allows setting permissions and file ownership
explicitly, in particular for projects stored in a version control
system such as \f[C]git\f[R] which retain full file ownership and access
mode metadata for committed files.
If the tar file \f[C]mkosi.skeleton.tar\f[R] is found in the local
directory it will be automatically used for this purpose.
.TP
\f[B]\f[CB]ExtraTree=\f[B]\f[R], \f[B]\f[CB]--extra-tree=\f[B]\f[R]
Takes a path to a directory to copy on top of the OS tree the package
manager generated.
Use this to override any default configuration files shipped with the
distribution.
If this option is not used, but the \f[C]mkosi.extra/\f[R] directory is
found in the local directory it is automatically used for this purpose
(also see the \[lq]Files\[rq] section below).
As with the skeleton tree logic above, instead of a directory, a tar
file may be provided too.
\f[C]mkosi.skeleton.tar\f[R] will be automatically used if found in the
local directory.
.TP
\f[B]\f[CB]CleanPackageMetadata=\f[B]\f[R], \f[B]\f[CB]--clean-package-metadata=\f[B]\f[R]
Enable/disable removal of package manager databases, caches, and logs at
the end of installation.
Can be specified as true, false, or \[lq]\f[C]auto\f[R]\[rq] (the
default).
With \[lq]\f[C]auto\f[R]\[rq], files will be removed if the respective
package manager executable is \f[I]not\f[R] present at the end of the
installation.
.TP
\f[B]\f[CB]RemoveFiles=\f[B]\f[R], \f[B]\f[CB]--remove-files=\f[B]\f[R]
Takes a comma-separated list of globs.
Files in the image matching the globs will be purged at the end.
.TP
\f[B]\f[CB]RemovePackages=\f[B]\f[R], \f[B]\f[CB]--remove-package=\f[B]\f[R]
Takes a comma-separated list of package specifications for removal, in
the same format as \f[C]Packages=\f[R].
The removal will be performed as one of the last steps.
This step is skipped if \f[C]CleanPackageMetadata=no\f[R] is used.
This option is currently only implemented for distributions using
\f[C]dnf\f[R].
.TP
\f[B]\f[CB]Environment=\f[B]\f[R], \f[B]\f[CB]--environment=\f[B]\f[R]
Adds variables to the environment that the
build/prepare/postinstall/finalize scripts are executed with.
Takes a space-separated list of variable assignments or just variable
names.
In the latter case, the values of those variables will be passed through
from the environment in which \f[C]mkosi\f[R] was invoked.
This option may be specified more than once, in which case all listed
variables will be set.
If the same variable is set twice, the later setting overrides the
earlier one.
.TP
\f[B]\f[CB]BuildSources=\f[B]\f[R], \f[B]\f[CB]--build-sources=\f[B]\f[R]
Takes a path to a source tree to copy into the development image, if the
build script is used.
This only applies if a build script is used, and defaults to the local
directory.
Use \f[C]SourceFileTransfer=\f[R] to configure how the files are
transferred from the host to the container image.
.TP
\f[B]\f[CB]BuildDirectory=\f[B]\f[R], \f[B]\f[CB]--build-dir=\f[B]\f[R]
Takes a path of a directory to use as build directory for build systems
that support out-of-tree builds (such as Meson).
The directory used this way is shared between repeated builds, and
allows the build system to reuse artifacts (such as object files,
executable, \&...) generated on previous invocations.
This directory is mounted into the development image when the build
script is invoked.
The build script can find the path to this directory in the
\f[C]$BUILDDIR\f[R] environment variable.
If this option is not specified, but a directory
\f[C]mkosi.builddir/\f[R] exists in the local directory it is
automatically used for this purpose (also see the \[lq]Files\[rq]
section below).
.TP
\f[B]\f[CB]IncludeDirectory=\f[B]\f[R], \f[B]\f[CB]--include-directory=\f[B]\f[R]
Takes a path of a directory to use as the include directory.
This directory is mounted at \f[C]/usr/include\f[R] when building the
build image and running the build script.
This means all include files installed to \f[C]/usr/include\f[R] will be
stored in this directory.
This is useful to make include files available on the host system for
use by language servers to provide code completion.
If this option is not specified, but a directory
\f[C]mkosi.includedir/\f[R] exists in the local directory, it is
automatically used for this purpose (also see the \[lq]Files\[rq]
section below).
.TP
\f[B]\f[CB]InstallDirectory=\f[B]\f[R], \f[B]\f[CB]--install-directory=\f[B]\f[R]
Takes a path of a directory to use as the install directory.
The directory used this way is shared between builds and allows the
build system to not have to reinstall files that were already installed
by a previous build and didn\[cq]t change.
The build script can find the path to this directory in the
\f[C]$DESTDIR\f[R] environment variable.
If this option is not specified, but a directory
\f[C]mkosi.installdir\f[R] exists in the local directory, it is
automatically used for this purpose (also see the \[lq]Files\[rq]
section below).
.TP
\f[B]\f[CB]BuildPackages=\f[B]\f[R], \f[B]\f[CB]--build-package=\f[B]\f[R]
Similar to \f[C]Packages=\f[R], but configures packages to install only
in the first phase of the build, into the development image.
This option should be used to list packages containing header files,
compilers, build systems, linkers and other build tools the
\f[C]mkosi.build\f[R] script requires to operate.
Note that packages listed here are only included in the image created
during the first phase of the build, and are absent in the final image.
Use \f[C]Packages=\f[R] to list packages that shall be included in both.
Packages are appended to the list.
Packages prefixed with \[lq]!\[rq] are removed from the list.
\[lq]!*\[rq] removes all packages from the list.
.TP
\f[B]\f[CB]Password=\f[B]\f[R], \f[B]\f[CB]--password=\f[B]\f[R]
Set the password of the \f[C]root\f[R] user.
By default the \f[C]root\f[R] account is locked.
If this option is not used, but a file \f[C]mkosi.rootpw\f[R] exists in
the local directory, the root password is automatically read from it.
.TP
\f[B]\f[CB]PasswordIsHashed=\f[B]\f[R], \f[B]\f[CB]--password-is-hashed\f[B]\f[R]
Indicate that the password supplied for the \f[C]root\f[R] user has
already been hashed, so that the string supplied with
\f[C]Password=\f[R] or \f[C]mkosi.rootpw\f[R] will be written to
\f[C]/etc/shadow\f[R] literally.
.TP
\f[B]\f[CB]Autologin=\f[B]\f[R], \f[B]\f[CB]--autologin\f[B]\f[R]
Enable autologin for the \f[C]root\f[R] user on \f[C]/dev/pts/0\f[R]
(nspawn), \f[C]/dev/tty1\f[R] (QEMU) and \f[C]/dev/ttyS0\f[R] (QEMU with
\f[C]QemuHeadless=yes\f[R]) by patching \f[C]/etc/pam.d/login\f[R].
.TP
\f[B]\f[CB]SkipFinalPhase=\f[B]\f[R], \f[B]\f[CB]--skip-final-phase=\f[B]\f[R]
Causes the (second) final image build stage to be skipped.
This is useful in combination with a build script, for when you care
about the artifacts that were created locally in \f[C]$BUILDDIR\f[R],
but ultimately plan to discard the final image.
.TP
\f[B]\f[CB]BuildScript=\f[B]\f[R], \f[B]\f[CB]--build-script=\f[B]\f[R]
Takes a path to an executable that is used as build script for this
image.
If this option is used the build process will be two-phased instead of
single-phased.
The specified script is copied onto the development image and executed
inside an \f[C]systemd-nspawn\f[R] container environment.
If this option is not used, but the \f[C]mkosi.build\f[R] file found in
the local directory it is automatically used for this purpose (also see
the \[lq]Files\[rq] section below).
Specify an empty value to disable automatic detection.
.TP
\f[B]\f[CB]PrepareScript=\f[B]\f[R], \f[B]\f[CB]--prepare-script=\f[B]\f[R]
Takes a path to an executable that is invoked inside the image right
after installing the software packages.
It is the last step before the image is cached (if incremental mode is
enabled).
This script is invoked inside a \f[C]systemd-nspawn\f[R] container
environment, and thus does not have access to host resources.
If this option is not used, but an executable script
\f[C]mkosi.prepare\f[R] is found in the local directory, it is
automatically used for this purpose.
Specify an empty value to disable automatic detection.
.TP
\f[B]\f[CB]PostInstallationScript=\f[B]\f[R], \f[B]\f[CB]--postinst-script=\f[B]\f[R]
Takes a path to an executable that is invoked inside the final image
right after copying in the build artifacts generated in the first phase
of the build.
This script is invoked inside a \f[C]systemd-nspawn\f[R] container
environment, and thus does not have access to host resources.
If this option is not used, but an executable \f[C]mkosi.postinst\f[R]
is found in the local directory, it is automatically used for this
purpose.
Specify an empty value to disable automatic detection.
.TP
\f[B]\f[CB]FinalizeScript=\f[B]\f[R], \f[B]\f[CB]--finalize-script=\f[B]\f[R]
Takes a path to an executable that is invoked outside the final image
right after copying in the build artifacts generated in the first phase
of the build, and after having executed the \f[C]mkosi.postinst\f[R]
script (see \f[C]PostInstallationScript=\f[R]).
This script is invoked directly in the host environment, and hence has
full access to the host\[cq]s resources.
If this option is not used, but an executable \f[C]mkosi.finalize\f[R]
is found in the local directory, it is automatically used for this
purpose.
Specify an empty value to disable automatic detection.
.TP
\f[B]\f[CB]SourceFileTransfer=\f[B]\f[R], \f[B]\f[CB]--source-file-transfer=\f[B]\f[R]
Configures how the source file tree (as configured with
\f[C]BuildSources=\f[R]) is transferred into the container image during
the first phase of the build.
Takes one of \f[C]copy-all\f[R] (to copy all files from the source
tree), \f[C]copy-git-cached\f[R] (to copy only those files
\f[C]git ls-files --cached\f[R] lists), \f[C]copy-git-others\f[R] (to
copy only those files \f[C]git ls-files --others\f[R] lists),
\f[C]mount\f[R] to bind mount the source tree directly.
Defaults to \f[C]copy-git-cached\f[R] if a \f[C]git\f[R] source tree is
detected, otherwise \f[C]copy-all\f[R].
When you specify \f[C]copy-git-more\f[R], it is the same as
\f[C]copy-git-cached\f[R], except it also includes the \f[C].git/\f[R]
directory.
.TP
\f[B]\f[CB]SourceFileTransferFinal=\f[B]\f[R], \f[B]\f[CB]--source-file-transfer-final=\f[B]\f[R]
Same as \f[C]SourceFileTransfer=\f[R], but for the final image instead
of the build image.
Takes the same values as \f[C]SourceFileFransfer=\f[R] except
\f[C]mount\f[R].
By default, sources are not copied into the final image.
.TP
\f[B]\f[CB]SourceResolveSymlinks=\f[B]\f[R], \f[B]\f[CB]--source-resolve-symlinks\f[B]\f[R]
If given, any symbolic links in the source file tree are resolved and
the file contents are copied to the build image.
If not given, they are left as symbolic links.
This only applies if \f[C]SourceFileTransfer=\f[R] is
\f[C]copy-all\f[R].
Defaults to leaving them as symbolic links.
.TP
\f[B]\f[CB]SourceResolveSymlinksFinal=\f[B]\f[R], \f[B]\f[CB]--source-resolve-symlinks-final\f[B]\f[R]
Same as \f[C]SourceResolveSymlinks=\f[R], but for the final image
instead of the build image.
.TP
\f[B]\f[CB]WithNetwork=\f[B]\f[R], \f[B]\f[CB]--with-network\f[B]\f[R]