From b7e3268ef09864ea7052b58deaadd8f3f73a735b Mon Sep 17 00:00:00 2001
From: Dusty Mabe <dusty@dustymabe.com>
Date: Wed, 20 Nov 2024 15:40:14 -0500
Subject: [PATCH] manifests: updates for FCOS manifest

There have been a lot of changes to the CoreOS definitions in [1].
Let's update the test manifest here to more closely match what is
running in the field there.

[1] https://github.com/coreos/coreos-assembler/tree/dcd60cfe01f1d42e8d5f63a77db8172f2f1101ae/src/osbuild-manifests
---
 .../manifests/fedora-coreos-container.json    | 403 +++++++++++++++---
 .../fedora-coreos-container.mpp.yaml          | 356 +++++++++++++---
 2 files changed, 642 insertions(+), 117 deletions(-)

diff --git a/test/data/manifests/fedora-coreos-container.json b/test/data/manifests/fedora-coreos-container.json
index 09df14f5..204c049f 100644
--- a/test/data/manifests/fedora-coreos-container.json
+++ b/test/data/manifests/fedora-coreos-container.json
@@ -490,11 +490,47 @@
         }
       ]
     },
+    {
+      "name": "deployed-tree",
+      "build": "name:build",
+      "stages": [
+        {
+          "type": "org.osbuild.container-deploy",
+          "inputs": {
+            "images": {
+              "type": "org.osbuild.containers",
+              "origin": "org.osbuild.source",
+              "references": {
+                "sha256:eff4685d197e6224eca444ae41d5092c6541fbabc5ce2ebfea2232fd75b9741b": {
+                  "name": "registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos:testing"
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
     {
       "name": "tree",
       "build": "name:build",
       "source-epoch": 1659397331,
       "stages": [
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts",
+            "target": "tree:///"
+          },
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:deployed-tree"
+              ]
+            }
+          }
+        },
         {
           "type": "org.osbuild.ostree.init-fs"
         },
@@ -524,7 +560,7 @@
             "paths": [
               {
                 "path": "/boot/efi",
-                "mode": 448
+                "mode": 493
               }
             ]
           }
@@ -543,7 +579,8 @@
             ],
             "kernel_opts": [
               "rw",
-              "$ignition_firstboot"
+              "$ignition_firstboot",
+              "mitigations=auto,nosmt"
             ]
           },
           "inputs": {
@@ -585,7 +622,7 @@
           "type": "org.osbuild.truncate",
           "options": {
             "filename": "disk.img",
-            "size": "10737418240"
+            "size": "3221225472"
           }
         },
         {
@@ -627,7 +664,7 @@
               {
                 "start": 1050624,
                 "partnum": 4,
-                "size": 4194304,
+                "size": 5238784,
                 "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
                 "name": "root"
               }
@@ -667,7 +704,8 @@
           },
           "options": {
             "uuid": "96d15588-3596-4b3c-adca-a2ff7279ea63",
-            "label": "boot"
+            "label": "boot",
+            "metadata_csum_seed": true
           }
         },
         {
@@ -678,7 +716,7 @@
               "options": {
                 "filename": "disk.img",
                 "start": 1050624,
-                "size": 4194304,
+                "size": 5238784,
                 "lock": true
               }
             }
@@ -688,6 +726,121 @@
             "label": "root"
           }
         },
+        {
+          "type": "org.osbuild.mkdir",
+          "options": {
+            "paths": [
+              {
+                "path": "mount://root/boot",
+                "mode": 493
+              },
+              {
+                "path": "mount://boot/efi",
+                "mode": 493
+              }
+            ]
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/root-mount-point"
+            },
+            {
+              "name": "boot",
+              "type": "org.osbuild.ext4",
+              "source": "disk",
+              "partition": 3,
+              "target": "/boot-mount-point"
+            }
+          ]
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts",
+            "target": "mount://root/"
+          },
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:deployed-tree"
+              ]
+            }
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/"
+            }
+          ]
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts",
+            "target": "mount://root/boot/"
+          },
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:deployed-tree"
+              ]
+            }
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/"
+            },
+            {
+              "name": "boot",
+              "type": "org.osbuild.ext4",
+              "source": "disk",
+              "partition": 3,
+              "target": "/boot"
+            }
+          ]
+        },
         {
           "type": "org.osbuild.copy",
           "inputs": {
@@ -832,7 +985,7 @@
           "type": "org.osbuild.truncate",
           "options": {
             "filename": "disk.img",
-            "size": "10737418240"
+            "size": "3221225472"
           }
         },
         {
@@ -875,7 +1028,7 @@
               {
                 "start": 131328,
                 "partnum": 4,
-                "size": 524288,
+                "size": 654848,
                 "type": "0FC63DAF-8483-4772-8E79-3D69D8477DE4",
                 "name": "root"
               }
@@ -917,7 +1070,8 @@
           },
           "options": {
             "uuid": "96d15588-3596-4b3c-adca-a2ff7279ea63",
-            "label": "boot"
+            "label": "boot",
+            "metadata_csum_seed": true
           }
         },
         {
@@ -928,7 +1082,7 @@
               "options": {
                 "filename": "disk.img",
                 "start": 131328,
-                "size": 524288,
+                "size": 654848,
                 "lock": true,
                 "sector-size": 4096
               }
@@ -939,6 +1093,124 @@
             "label": "root"
           }
         },
+        {
+          "type": "org.osbuild.mkdir",
+          "options": {
+            "paths": [
+              {
+                "path": "mount://root/boot",
+                "mode": 493
+              },
+              {
+                "path": "mount://boot/efi",
+                "mode": 493
+              }
+            ]
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true,
+                "sector-size": 4096
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/root-mount-point"
+            },
+            {
+              "name": "boot",
+              "type": "org.osbuild.ext4",
+              "source": "disk",
+              "partition": 3,
+              "target": "/boot-mount-point"
+            }
+          ]
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts",
+            "target": "mount://root/"
+          },
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:deployed-tree"
+              ]
+            }
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true,
+                "sector-size": 4096
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/"
+            }
+          ]
+        },
+        {
+          "type": "org.osbuild.selinux",
+          "options": {
+            "file_contexts": "input://tree/etc/selinux/targeted/contexts/files/file_contexts",
+            "target": "mount://root/boot/"
+          },
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:deployed-tree"
+              ]
+            }
+          },
+          "devices": {
+            "disk": {
+              "type": "org.osbuild.loopback",
+              "options": {
+                "filename": "disk.img",
+                "partscan": true,
+                "sector-size": 4096
+              }
+            }
+          },
+          "mounts": [
+            {
+              "name": "root",
+              "type": "org.osbuild.xfs",
+              "source": "disk",
+              "partition": 4,
+              "target": "/"
+            },
+            {
+              "name": "boot",
+              "type": "org.osbuild.ext4",
+              "source": "disk",
+              "partition": 3,
+              "target": "/boot"
+            }
+          ]
+        },
         {
           "type": "org.osbuild.copy",
           "inputs": {
@@ -1142,6 +1414,32 @@
         }
       ]
     },
+    {
+      "name": "metal",
+      "build": "name:build",
+      "stages": [
+        {
+          "type": "org.osbuild.copy",
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:raw-metal-image"
+              ]
+            }
+          },
+          "options": {
+            "paths": [
+              {
+                "from": "input://tree/disk.img",
+                "to": "tree:///metal.raw"
+              }
+            ]
+          }
+        }
+      ]
+    },
     {
       "name": "raw-metal4k-image",
       "build": "name:build",
@@ -1210,6 +1508,32 @@
         }
       ]
     },
+    {
+      "name": "metal4k",
+      "build": "name:build",
+      "stages": [
+        {
+          "type": "org.osbuild.copy",
+          "inputs": {
+            "tree": {
+              "type": "org.osbuild.tree",
+              "origin": "org.osbuild.pipeline",
+              "references": [
+                "name:raw-metal4k-image"
+              ]
+            }
+          },
+          "options": {
+            "paths": [
+              {
+                "from": "input://tree/disk.img",
+                "to": "tree:///metal4k.raw"
+              }
+            ]
+          }
+        }
+      ]
+    },
     {
       "name": "raw-qemu-image",
       "build": "name:build",
@@ -1234,6 +1558,13 @@
             ]
           }
         },
+        {
+          "type": "org.osbuild.truncate",
+          "options": {
+            "filename": "disk.img",
+            "size": "10737418240"
+          }
+        },
         {
           "type": "org.osbuild.coreos.platform",
           "options": {
@@ -1277,58 +1608,6 @@
         }
       ]
     },
-    {
-      "name": "metal",
-      "build": "name:build",
-      "stages": [
-        {
-          "type": "org.osbuild.copy",
-          "inputs": {
-            "tree": {
-              "type": "org.osbuild.tree",
-              "origin": "org.osbuild.pipeline",
-              "references": [
-                "name:raw-metal-image"
-              ]
-            }
-          },
-          "options": {
-            "paths": [
-              {
-                "from": "input://tree/disk.img",
-                "to": "tree:///metal.raw"
-              }
-            ]
-          }
-        }
-      ]
-    },
-    {
-      "name": "metal4k",
-      "build": "name:build",
-      "stages": [
-        {
-          "type": "org.osbuild.copy",
-          "inputs": {
-            "tree": {
-              "type": "org.osbuild.tree",
-              "origin": "org.osbuild.pipeline",
-              "references": [
-                "name:raw-metal4k-image"
-              ]
-            }
-          },
-          "options": {
-            "paths": [
-              {
-                "from": "input://tree/disk.img",
-                "to": "tree:///metal4k.raw"
-              }
-            ]
-          }
-        }
-      ]
-    },
     {
       "name": "qemu",
       "build": "name:build",
diff --git a/test/data/manifests/fedora-coreos-container.mpp.yaml b/test/data/manifests/fedora-coreos-container.mpp.yaml
index ee6abc0f..74579c69 100644
--- a/test/data/manifests/fedora-coreos-container.mpp.yaml
+++ b/test/data/manifests/fedora-coreos-container.mpp.yaml
@@ -1,16 +1,20 @@
 version: '2'
 mpp-vars:
-  disk_size_gb: 10
-  bios_boot_size_mb: 1
-  efi_system_size_mb: 127
-  boot_size_mb: 384
-  root_size_mb: 2048
-  sector_size: 512
-  four_k_sector_size: 4096
   # The name to use for deployment stateroot
   osname: fedora-coreos
   # The container image ref to follow for updates
   container_imgref: ostree-remote-registry:fedora:quay.io/fedora/fedora-coreos:stable
+  # The container repo/tag to pull for this test
+  container_repo: registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos
+  container_tag: testing
+  metal_image_size_mb: 3072
+  cloud_image_size_mb: 10240
+  bios_boot_size_mb: 1
+  efi_system_size_mb: 127
+  boot_size_mb: 384
+  sector_size: 512
+  four_k_sector_size: 4096
+  extra_kargs: "mitigations=auto,nosmt"
   # Filesystem UUID and label definitions. These UUIDs
   # are looked for on boot and if found replaced with
   # a new random UUID to make each install unique.
@@ -18,10 +22,18 @@ mpp-vars:
   boot_fs_label: boot
   root_fs_uuid: 910678ff-f77e-4a7d-8d53-86f2ac47a823
   root_fs_label: root
+  # Set the buildroot string to use for most operations here. We create
+  # the buildroot from the target OSTree contents so we have version
+  # matches. Unfortunately for FCOS there is no python so we can't
+  # really use FCOS as the buildroot so we'll use a generic Fedora
+  # buildroot here.
+  buildroot: "name:build"
 mpp-define-images:
   - id: image
+    sector_size:
+        mpp-format-int: "{sector_size}"
     size:
-      mpp-format-string: "{disk_size_gb * 1024 * 1024 * 1024}"
+      mpp-format-string: "{metal_image_size_mb * 1024 * 1024}"
     table:
       uuid: 00000000-0000-4000-a000-000000000001
       label: gpt
@@ -31,27 +43,21 @@ mpp-define-images:
           bootable: true
           size:
             mpp-format-int: "{bios_boot_size_mb * 1024 * 1024 / sector_size}"
-          partnum: 1
         - name: EFI-SYSTEM
           type: C12A7328-F81F-11D2-BA4B-00A0C93EC93B
           size:
             mpp-format-int: "{efi_system_size_mb * 1024 * 1024 / sector_size}"
-          partnum: 2
         - name: boot
           type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
           size:
             mpp-format-int: "{boot_size_mb * 1024 * 1024 / sector_size}"
-          partnum: 3
         - name: root
           type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-          size:
-            mpp-format-int: "{root_size_mb * 1024 * 1024 / sector_size}"
-          partnum: 4
   - id: image4k
     sector_size:
         mpp-format-int: "{four_k_sector_size}"
     size:
-      mpp-format-string: "{disk_size_gb * 1024 * 1024 * 1024}"
+      mpp-format-string: "{metal_image_size_mb * 1024 * 1024}"
     table:
       uuid: 00000000-0000-4000-a000-000000000001
       label: gpt
@@ -71,8 +77,6 @@ mpp-define-images:
             mpp-format-int: "{boot_size_mb * 1024 * 1024 / four_k_sector_size}"
         - name: root
           type: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
-          size:
-            mpp-format-int: "{root_size_mb * 1024 * 1024 / four_k_sector_size}"
 pipelines:
   - mpp-import-pipelines:
       path: fedora-vars.ipp.yaml
@@ -81,10 +85,47 @@ pipelines:
       id: build
     runner:
       mpp-format-string: org.osbuild.fedora{release}
+  # Pull the container into a pipeline
+  # Construct a tree here that is a representation of the filesystem
+  # that you would see on a running OSTree system. i.e. instead of just
+  # /ostree and /sysroot at the toplevel we see /usr/ /var/ /etc/ ... that
+  # you would see inside an OSTree deployment. Having the plain files accessible
+  # allows for this pipeline to be used as a buildroot for some stages
+  # or as inputs for others (i.e. file_context input to the org.osbuild.selinux
+  # stages). This pipeline isn't actually used for built artifacts but
+  # to help during build.
+  #
+  # NOTE: this is only used as a buildroot on RHCOS (FCOS doesn't ship python).
+  - name: deployed-tree
+    build:
+      mpp-format-string: '{buildroot}'
+    stages:
+      - type: org.osbuild.container-deploy
+        inputs:
+          images:
+            type: org.osbuild.containers
+            origin: org.osbuild.source
+            mpp-resolve-images:
+              images:
+                - source: $container_repo
+                  tag: $container_tag
   - name: tree
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     source-epoch: 1659397331
     stages:
+      # Set the context of the root of the tree so that we avoid unlabeled_t files.
+      # https://github.com/coreos/fedora-coreos-tracker/issues/1772
+      - type: org.osbuild.selinux
+        options:
+          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
+          target: tree:///
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:deployed-tree
       - type: org.osbuild.ostree.init-fs
       - type: org.osbuild.ostree.os-init
         options:
@@ -97,13 +138,19 @@ pipelines:
             sysroot:
               readonly: true
               bootloader: none
+              # https://github.com/coreos/fedora-coreos-tracker/issues/1333
               bls-append-except-default: grub_users=""
+              # Opt-in to https://github.com/ostreedev/ostree/pull/2705 which will
+              # add /boot as the prefix on top of BLS config entries. This is OK
+              # because there is a symlink that is created in the root of the boot
+              # filesystem by OSTree (boot -> .) that makes it so that /boot paths
+              # will always work.
               bootprefix: true
       - type: org.osbuild.mkdir
         options:
           paths:
             - path: /boot/efi
-              mode: 448
+              mode: 493
       - type: org.osbuild.ignition
       - type: org.osbuild.ostree.deploy.container
         options:
@@ -117,14 +164,15 @@ pipelines:
           kernel_opts:
             - rw
             - '$ignition_firstboot'
+            - mpp-format-string: '{extra_kargs}'
         inputs:
           images:
             type: org.osbuild.containers
             origin: org.osbuild.source
             mpp-resolve-images:
               images:
-                - source: registry.gitlab.com/redhat/services/products/image-builder/ci/images/fedora-coreos
-                  tag: testing
+                - source: $container_repo
+                  tag: $container_tag
       - type: org.osbuild.ostree.aleph
         options:
           coreos_compat: true
@@ -135,7 +183,8 @@ pipelines:
           deployment:
             default: true
   - name: raw-image
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.truncate
         options:
@@ -180,6 +229,11 @@ pipelines:
             mpp-format-string: '{boot_fs_uuid}'
           label:
             mpp-format-string: '{boot_fs_label}'
+          # Set manually the metadata_csum_seed ext4 option otherwise changing the
+          # filesystem UUID while it's mounted doesn't work. Can remove this when
+          # metadata_csum_seed is default in RHEL, which can be checked by looking
+          # in /etc/mke2fs.conf.
+          metadata_csum_seed: true
       - type: org.osbuild.mkfs.xfs
         devices:
           device:
@@ -196,6 +250,90 @@ pipelines:
             mpp-format-string: '{root_fs_uuid}'
           label:
             mpp-format-string: '{root_fs_label}'
+      # We've created the filesystems. Now let's create the mountpoints (directories)
+      # on the filesystems and label them with appropriate SELinux labels. This also
+      # covers things like filesystem autogenerated files like 'lost+found'. The labeling
+      # will happen once with just the root filesystem mounted and once with the boot
+      # filesystem mounted too (to make sure we get all potentially hidden mountpoints).
+      # https://github.com/coreos/fedora-coreos-tracker/issues/1771
+      - type: org.osbuild.mkdir
+        options:
+          paths:
+            - path: mount://root/boot
+              mode: 493
+            - path: mount://boot/efi
+              mode: 493
+        devices:
+           disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image.layout[''root''].partnum}'
+            target: /root-mount-point
+          - name: boot
+            type: org.osbuild.ext4
+            source: disk
+            partition:
+              mpp-format-int: '{image.layout[''boot''].partnum}'
+            target: /boot-mount-point
+      - type: org.osbuild.selinux
+        options:
+          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
+          target: mount://root/
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:deployed-tree
+        devices:
+          disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image.layout[''root''].partnum}'
+            target: /
+      - type: org.osbuild.selinux
+        options:
+          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
+          target: mount://root/boot/
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:deployed-tree
+        devices:
+          disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image.layout[''root''].partnum}'
+            target: /
+          - name: boot
+            type: org.osbuild.ext4
+            source: disk
+            partition:
+              mpp-format-int: '{image.layout[''boot''].partnum}'
+            target: /boot
       - type: org.osbuild.copy
         inputs:
           tree:
@@ -289,7 +427,8 @@ pipelines:
               deployment:
                 default: true
   - name: raw-4k-image
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.truncate
         options:
@@ -340,6 +479,11 @@ pipelines:
             mpp-format-string: '{boot_fs_uuid}'
           label:
             mpp-format-string: '{boot_fs_label}'
+          # Set manually the metadata_csum_seed ext4 option otherwise changing the
+          # filesystem UUID while it's mounted doesn't work. Can remove this when
+          # metadata_csum_seed is default in RHEL, which can be checked by looking
+          # in /etc/mke2fs.conf.
+          metadata_csum_seed: true
       - type: org.osbuild.mkfs.xfs
         devices:
           device:
@@ -358,6 +502,96 @@ pipelines:
             mpp-format-string: '{root_fs_uuid}'
           label:
             mpp-format-string: '{root_fs_label}'
+      # We've created the filesystems. Now let's create the mountpoints (directories)
+      # on the filesystems and label them with appropriate SELinux labels. This also
+      # covers things like filesystem autogenerated files like 'lost+found'. The labeling
+      # will happen once with just the root filesystem mounted and once with the boot
+      # filesystem mounted too (to make sure we get all potentially hidden mountpoints).
+      # https://github.com/coreos/fedora-coreos-tracker/issues/1771
+      - type: org.osbuild.mkdir
+        options:
+          paths:
+            - path: mount://root/boot
+              mode: 493
+            - path: mount://boot/efi
+              mode: 493
+        devices:
+          disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+              sector-size:
+                  mpp-format-int: "{four_k_sector_size}"
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image4k.layout[''root''].partnum}'
+            target: /root-mount-point
+          - name: boot
+            type: org.osbuild.ext4
+            source: disk
+            partition:
+              mpp-format-int: '{image4k.layout[''boot''].partnum}'
+            target: /boot-mount-point
+      - type: org.osbuild.selinux
+        options:
+          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
+          target: mount://root/
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:deployed-tree
+        devices:
+          disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+              sector-size:
+                  mpp-format-int: "{four_k_sector_size}"
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image4k.layout[''root''].partnum}'
+            target: /
+      - type: org.osbuild.selinux
+        options:
+          file_contexts: input://tree/etc/selinux/targeted/contexts/files/file_contexts
+          target: mount://root/boot/
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:deployed-tree
+        devices:
+          disk:
+            type: org.osbuild.loopback
+            options:
+              filename: disk.img
+              partscan: true
+              sector-size:
+                  mpp-format-int: "{four_k_sector_size}"
+        mounts:
+          - name: root
+            type: org.osbuild.xfs
+            source: disk
+            partition:
+              mpp-format-int: '{image4k.layout[''root''].partnum}'
+            target: /
+          - name: boot
+            type: org.osbuild.ext4
+            source: disk
+            partition:
+              mpp-format-int: '{image4k.layout[''boot''].partnum}'
+            target: /boot
       - type: org.osbuild.copy
         inputs:
           tree:
@@ -455,7 +689,8 @@ pipelines:
               deployment:
                 default: true
   - name: raw-metal-image
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.copy
         inputs:
@@ -496,8 +731,24 @@ pipelines:
              partition:
                mpp-format-int: '{image.layout[''boot''].partnum}'
              target: /boot
+  - name: metal
+    build:
+      mpp-format-string: '{buildroot}'
+    stages:
+      - type: org.osbuild.copy
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:raw-metal-image
+        options:
+          paths:
+            - from: input://tree/disk.img
+              to: tree:///metal.raw
   - name: raw-metal4k-image
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.copy
         inputs:
@@ -540,8 +791,24 @@ pipelines:
              partition:
               mpp-format-int: '{image4k.layout[''boot''].partnum}'
              target: /boot
+  - name: metal4k
+    build:
+      mpp-format-string: '{buildroot}'
+    stages:
+      - type: org.osbuild.copy
+        inputs:
+          tree:
+            type: org.osbuild.tree
+            origin: org.osbuild.pipeline
+            references:
+              - name:raw-metal4k-image
+        options:
+          paths:
+            - from: input://tree/disk.img
+              to: tree:///metal4k.raw
   - name: raw-qemu-image
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.copy
         inputs:
@@ -554,6 +821,12 @@ pipelines:
           paths:
             - from: input://tree/disk.img
               to: tree:///disk.img
+      # Increase the size to the cloud image size
+      - type: org.osbuild.truncate
+        options:
+          filename: disk.img
+          size:
+            mpp-format-string: "{cloud_image_size_mb * 1024 * 1024}"
       - type: org.osbuild.coreos.platform
         options:
           platform: qemu
@@ -582,36 +855,9 @@ pipelines:
              partition:
                mpp-format-int: '{image.layout[''boot''].partnum}'
              target: /boot
-  - name: metal
-    build: name:build
-    stages:
-      - type: org.osbuild.copy
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:raw-metal-image
-        options:
-          paths:
-            - from: input://tree/disk.img
-              to: tree:///metal.raw
-  - name: metal4k
-    build: name:build
-    stages:
-      - type: org.osbuild.copy
-        inputs:
-          tree:
-            type: org.osbuild.tree
-            origin: org.osbuild.pipeline
-            references:
-              - name:raw-metal4k-image
-        options:
-          paths:
-            - from: input://tree/disk.img
-              to: tree:///metal4k.raw
   - name: qemu
-    build: name:build
+    build:
+      mpp-format-string: '{buildroot}'
     stages:
       - type: org.osbuild.qemu
         inputs: