Particularly with FIPS mode, it's required to have /dev/random and /dev/urandom in the initramfs. Today we usually run dracut in a fully privileged environment (e.g. a host system as root, or a build system for Image Builder/rpm-ostree). However, with https://fedoraproject.org/wiki/Changes/OstreeNativeContainer we want to enable a use case that looks like ``` $ cat Dockerfile FROM quay.io/fedora/fedora-coreos:stable ADD /path/to/foo /usr/lib/dracut/modules.d RUN dracut ``` to inject a dracut module and regenerate the initramfs. The default podman/docker policy denies creation of device nodes. However, we don't actually need to create "real" devices - we just need them to end up in the initramfs file. https://github.com/dracutdevs/dracut/pull/2331 is an upstream PR that aims to address this. Can you take a look? Basically we need to ensure that we always have the device nodes in the initramfs, regardless of FIPS mode or not.
Can someone who maintains dracut please take a look at this issue and comment upstream or here? This is part of enabling "CoreOS Layering" for OCP https://docs.openshift.com/container-platform/4.13/post_installation_configuration/coreos-layering.html as well as outside of it.
I've looked into the upsteram PR and apart from the stored {u,}random file it looks OK. I'll look into making this PR viable for upstream.
Thank you so much Pavel! Let me know if there is anything you need from us.
Postponing, as there is some kernel activity expected first, to be able to implement required dracut changes (as in line with PR discussion). Please let me know if I've missed something actionable. [1] https://github.com/dracutdevs/dracut/pull/2331#issuecomment-1662821979