mkosi is a command-line tool for building customized, bootable OS images. It wraps distribution package managers (dnf, apt, pacman, zypper, apk) and deeply integrates with systemd components (systemd-nspawn, systemd-repart, systemd-boot, systemd-vmspawn, ukify) to produce disk images, containers, unified kernel images, initrds, and extension images. The tool supports multiple output formats (disk, tar, cpio, uki, esp, sysext, confext, portable, oci, directory, addon) and can generate images for a wide range of Linux distributions including Fedora, Debian, Ubuntu, Arch, CentOS, openSUSE, and more. The architecture is a modular Python application with a central build pipeline orchestrated in mkosi/__init__.py. Configuration is handled via layered INI-style files with conditional [Match]/[Assert] sections, allowing complex multi-image builds. A sandbox abstraction (sandbox.py) isolates tool execution using Linux namespaces, mounts, and seccomp filters. Distribution-specific installers are registered via a class registry pattern in mkosi/distribution/__init__.py. The tool also provides standalone subcommands: mkosi-initrd, mkosi-addon, mkosi-sandbox, each with its own entry point. Key features include incremental caching, SecureBoot signing, verity and TPM support, kernel-install integration, tools tree for reproducible builds, and a comprehensive manifest generation. The codebase is well-structured with clear separation between configuration, sandboxing, package management, and image creation. It has extensive tests (pytest with integration markers) and active CI.