[Epic] OS image factory — custom bootc images via Argo Workflows + BuildStream + Zot

[castrojo]

Contributors build custom bootc OS images on their own cluster using CNCF tooling. The build system is the cluster. The registry is on ghost (Zot).

Build paths — all first-class:

Path	Base	Notes
BuildStream (Apache)	From source	Implement first — already proven in dakota
BlueBuild + Fedora	quay.io/fedora/fedora-bootc:latest	Declarative recipe.yml, dnf modules
Containerfile + Fedora	quay.io/fedora/fedora-bootc:latest	Full control
Containerfile + CentOS Stream 10	quay.io/centos-bootc/centos-bootc:c10s	LTS/enterprise path

All paths use dnf inside Containerfiles at build time. No rpm-ostree.

CNCF stack: bootc (sandbox) · Argo Workflows (graduated) · Argo Events (CNCF) · Zot (sandbox) · KubeVirt (incubating, for ISO output) · cosign (signing step)

Pipeline: Argo Events webhook → Argo Workflows → buildah → Zot push → cosign sign → optional KubeVirt VM for ISO via bootc-image-builder

Open question: Where do contributor recipe.yml / Containerfiles live? Tracked in issue #34.

ISO/disk output (QCOW2, AMI, raw) via bootc-image-builder in a KubeVirt VM. Blocked by KubeVirt (#1).

Principle: NO Helm. Raw Argo Workflows manifests in argo/ via k3s auto-deploy dir. BuildStream is Apache (not CNCF) — documented as exception.

Blocked by: KubeVirt (#1) for ISO path only. OCI image path unblocked.