Repository navigation
Conversation
chewi
added
the
jenkins-ci
chewi
force-pushed
the
chewi/sysext-udev
branch
from
November 12, 2026 14:16
43cfeab to
9f16b86
Compare
chewi
force-pushed
the
chewi/sysext-udev
branch
from
November 12, 2026 14:28
9f16b86 to
46b1b95
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
The boot-time systemd-sysext.service merge needs validation beyond bootengine’s --root merge, but missing upstream unit definitions leave the interaction between the tmpfiles helper’s default dependencies and the backport’s synchronous job wait unresolved.
No open issues 🎉
3 resolved since last review
Review effort: Balanced
So far we did not correctly label /usr because it broke certain things like Docker. With the sysext Docker and new policies we should try again. First generate the policy before branching off the base squashfs (which already misses a lot of things because they the most postprocessing is done late in finish_image!). Then label /usr and also the sysext contents in their folder - not in the overlay mount because this would operate on the whole image. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
We need this to fix the zfs sysext. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
No need to prod it if the sysext doesn't include any systemd units. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This fixes the zfs sysext, which tried to delay udevd until after the sysext is merged, but that recently broke. We probably can't order things that way round any more. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
A new systemd unit is needed for this because the one that systemd ships is only suitable for use at boot time. Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
chewi
force-pushed
the
chewi/sysext-udev
branch
from
November 13, 2026 11:31
46b1b95 to
40a9b99
Compare
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Enabling full-root SELinux labeling and moving policy compilation earlier require human runtime validation of enforcing-mode boot and container compatibility, which the reported ZFS checks do not establish.
No open issues 🎉
Review effort: Balanced
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The zfs sysext tried to delay udevd until after the sysext is merged, but that recently broke. We probably can't order things that way round any more. This change triggers udev when the sysext is merged instead, which is better anyway. I had to backport the
EXTENSION_RESTART_UNITSfrom systemd 262 to do this.I also made it so that:
EXTENSION_RELOAD_MANAGERis only added when the sysext includes systemd units.See below for a detailed discussion between myself and Copilot on the best approach to take here.
How to use
With a second disk attached, manually add the zfs sysext, reboot, verify that it doesn't hang like before, create the zpool, reboot again, and check that it loaded the zfs kernel module. You can also (un)merge the sysext while checking for activity in
systemctl status systemd-udev-trigger.service.Testing done
I've manually done the above. I'll kick off Jenkins from here.
changelog/directory (user-facing change, bug fix, security fix, update) -- (it wasn't broken in a release)/bootand/usrsize, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.