Measured boot from ostree/bootc?

[mangelajo]

I am not 100% aware of all the low level details about how a system is mounted with ostree and the underlying filesystem properties.

But I wondered if we could use the ostree commit reference as a source of truth/hash for the filesystem contents (at least for the ostree-managed files).

Once the system has been mounted at boot, is there any way to make sure or prevent any further modification outside of ostree binaries for root?

[cgwalters]

Once the system has been mounted at boot, is there any way to make sure or prevent any further modification outside of ostree binaries for root?

This is what https://ostreedev.github.io/ostree/composefs/ is for.

But I wondered if we could use the ostree commit reference as a source of truth/hash for the filesystem contents (at least for the ostree-managed files).

However, this doesn't work for derived container images. Ultimately what we need to do is create standardized composefs+containers integration; let's move that to containers/composefs#278