---
# System prepended metadata

title: 20220801_Building-Fedora-CoreOS

---

# 20220801_Building-Fedora-CoreOS


Interesting things that we do in Fedora CoreOS:

- lockfiles
    - bump-lockfile job -> CI run that gates lockfile definition bumping
    - supported by custom koji tags
    - allows package overriding/pinning
    - allows us to build `stable` weeks after `testing`
- COSA
    - runs anywhere you can run a container and have `/dev/kvm`
    - same build tools on laptop and in production pipeline
- tests
    - live alongside our configs
    - easy to write at the same time as new features are written
    - we do test our images on every major cloud provider
        - Azure, AWS, GCP, and OpenStack
- pipelines
    - tests run as part of the build pipeline
    - bulids don't progress if tests don't succeed
    - all architectures are built together from same package set (SA needs clarification on this)
        - if any architecture doesn't succeed then releases don't get promoted
        
        
Introduction
    - Talk about the streams and delivering each of the 3 streams every two weeks on 3 different architectures
        - ^^ this is a feat
        
1st Half of Presentation
    - Hacking/Building FCOS locally and needed pieces
        - The configs repo
        - COSA
            - local overrides
                - rootfs/rpms
        - how to run tests
            - how are our tests defined?

2nd Half of Presentation
    - How do we productize this? How do we deliver FCOS
        - We also use COSA (same thing that is used locally) in our pipeline
        - Running our tests (CI) as part of the builds
        - lockfiles (pinning/overriding packages)
            - explain why we need to pin sometimes
                - need to keep old version of package because we found a bug and not fixed yet, but we don't want to introduce regression in our streams (SA needs clarification here)
            - explain why we need to override sometimes
                - we need package faster than fedora can deliver (SA needs clarification here)
                - our CI gives us confidence that the package is sane
        - multi-arch builds are farmed out to individual nodes of that architecture running Fedora CoreOS