Seal the golden OS (Part 2)
Seal the golden OS Dockerfile to bootc to our registry, Ignition on first boot, and a host that has nothing to drift This is the first deep dive under Harden your servers. Own your trust. which lays out the full map. You own the trust chain. If a third party is hacked, you should not be owned. For the host, that means the OS your cattle boot is an artifact you built, signed, and served yourself. Two artifacts are the OS source of truth The OS has exactly two authored sources, and both live in our git: An IaC Dockerfile. CI builds it with bootc into a bootable OCI image, signs it, and pushes it to our LAN registry. The Dockerfile plus the frozen golden supply it consumes is the full OS recipe. Our Ignition config for a minimal ostree-based Fedora CoreOS (or a bootc-derived sibling). Ignition runs on first boot, sets identity and hardening, and starts containerized workloads pulled from our registry. Ansible is not the OS source of truth. It orchestrates the herd from CI,...