$ show systemd/mkosi
mkosi is a command-line tool for building customized, bootable OS images. It wraps distribution package managers (dnf, apt, pacman, zypper, apk) and deeply integrates with systemd components (systemd-nspawn, systemd-repart, systemd-boot, systemd-vmspawn, ukify) to produce disk images, containers, unified kernel images, initrds, and extension images. The tool supports multiple output formats (disk, tar, cpio, uki, esp, sysext, confext, portable, oci, directory, addon) and can generate images for a wide range of Linux distributions including Fedora, Debian, Ubuntu, Arch, CentOS, openSUSE, and more. The architecture is a modular Python application with a central build pipeline orchestrated in mkosi/__init__.py. Configuration is handled via layered INI-style files with conditional [Match]/[Assert] sections, allowing complex multi-image builds. A sandbox abstraction (sandbox.py) isolates tool execution using Linux namespaces, mounts, and seccomp filters. Distribution-specific installers are registered via a class registry pattern in mkosi/distribution/__init__.py. The tool also provides standalone subcommands: mkosi-initrd, mkosi-addon, mkosi-sandbox, each with its own entry point. Key features include incremental caching, SecureBoot signing, verity and TPM support, kernel-install integration, tools tree for reproducible builds, and a comprehensive manifest generation. The codebase is well-structured with clear separation between configuration, sandboxing, package management, and image creation. It has extensive tests (pytest with integration markers) and active CI.
The LLM identified 2 files worth highlighting for reuse:
Implements a standalone sandbox utility using Linux namespace manipulation, overlay mounts, and seccomp filters. Can be invoked externally as `mkosi-sandbox`. The `enter()` function builds a new execution environment with configurable bind mounts, devices, network isolation, and seccomp profiles. Demonstrates robust use of low-level syscalls via ctypes (open_tree, mount_setattr, move_mount) and includes compatibility handling for multiple architectures. Designed to be reusable by other build tools for reproducible and isolated execution of package managers and scripts.
Provides a `GenericVersion` class implementing the UAPI Group Version Format Specification with total ordering. Supports complex version strings with release tags, pre-release markers, and numeric/semantic segments. Used internally for snapshot ordering, kernel version comparison, and dependency resolution. The class is self-contained (no imports from other mkosi modules except StrEnum) and could be extracted as a standalone library for version comparison in any Python project. Includes a known bug comment about caret handling, indicating active scrutiny.