[jdx]

https://entire.io/gh/jdx/mise/trails/676

Summary

On Fedora Atomic hosts (Silverblue, Kinoite, Bazzite, secureblue, ...) /usr is read-only, so mise bootstrap packages apply with a dnf: entry ended in dnf's own error after the prompt:

$ mise bootstrap packages apply --manager dnf
dnf: install gimp? Yes
mise $ dnf install -y gimp
Error: /usr is configured to be read-only. You may be running an image-based or immutable operating system. ...

mise now detects an ostree-booted host (/run/ostree-booted) before running dnf and stops with an explanation:

cannot install dnf packages: this host is booted from an ostree image, so /usr is read-only
Bake the packages into the image, install them in a toolbox, or layer them yourself with
  rpm-ostree install <packages>

Status checks are unchanged (rpm -q already works there), and the file is absent inside a bootc/Containerfile build, so dnf keeps working in image builds. Opt-in layering through rpm-ostree follows in a stacked PR.

Part of discussion #14278.

Test plan

• cargo test --lib dnf

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

🤖 Generated with Claude Code

---

Note

Low Risk
Localized bootstrap UX change for dnf only; no change to install paths on normal Linux hosts or to package status checks.

Overview
dnf bootstrap on Fedora Atomic / ostree hosts now fails fast with a clear message instead of invoking dnf and surfacing a read-only /usr error.

Detection uses the presence of /run/ostree-booted; install and upgrade return guidance to bake packages into the image, use a toolbox, or run rpm-ostree install. Status via rpm -q is unchanged, and non-ostree environments (including bootc Containerfile builds without the marker) still run dnf as before. Docs add a Fedora Atomic hosts section; unit tests cover the marker, error text, and install/upgrade rejection.

^{Reviewed by Cursor Bugbot for commit 97d1e5b. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes
  • On Fedora Atomic hosts, package installation and upgrades now stop with guidance on supported alternatives instead of attempting to run dnf. RPM status checks remain available.
  • dnf continues to work normally on hosts that are not booted from an ostree image, including bootc Containerfile builds.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 2 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: c6f7a2e0-2ec3-4cfb-8a24-a99af6f1134d

📥 Commits

Reviewing files that changed from the base of the PR and between 43c0bdf and 97d1e5b.

📒 Files selected for processing (2)

• docs/bootstrap/packages/dnf.md
• src/system/packages/dnf.rs

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3b2b4cd9-e696-4ac9-be23-1ab5ce7651c9

📥 Commits

Reviewing files that changed from the base of the PR and between f92bddd and 43c0bdf.

📒 Files selected for processing (2)

• docs/bootstrap/packages/dnf.md
• src/system/packages/dnf.rs

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

📝 Walkthrough

Walkthrough

mise checks whether a host is booted from an ostree image before DNF installation or upgrade. If the marker exists, these operations return an error with alternative installation methods. Documentation describes this behavior and notes that RPM status checks remain available.

Changes

DNF on ostree-booted hosts

Layer / File(s)	Summary
Ostree detection and error src/system/packages/dnf.rs	The DNF module checks for /run/ostree-booted and defines an error that describes the read-only /usr condition and suggests alternatives.
Install and upgrade guards src/system/packages/dnf.rs, docs/bootstrap/packages/dnf.md	Install and upgrade return the ostree-specific error when the marker exists. Tests cover detection and operation behavior. The documentation describes the behavior, available alternatives, RPM status checks, and bootc Containerfile builds.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant mise
  participant ostreeMarker as /run/ostree-booted
  participant dnf as DNF
  mise->>ostreeMarker: Check whether the marker exists
  alt Marker exists
    mise-->>mise: Return ostree-specific error
  else Marker does not exist
    mise->>dnf: Continue existing install or upgrade command path
  end

Loading

Merge Risk: ⚪ Minimal · up to 43c0b

On Fedora Atomic hosts, dnf package installs now stop with a clear explanation instead of failing inside dnf. Behavior on other hosts is unchanged, and no actionable merge risk was found.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 1 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: explaining why DNF package installation fails on ostree hosts.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 26.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 15 functions across 1 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

The PR checks /run/ostree-booted before installing or upgrading dnf packages and explains the supported alternatives.

• dnf installs and upgrades stop with guidance on ostree-booted hosts.

The previous and current heads have different merge bases with the target commit, so this review used the full PR diff.

_{Reviews (3) · Last reviewed commit: "Merge origin/main into fix/dnf-ostree-er..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▆▆▃▁█	27,884,702 → 27,944,528	+0.21%	20.14 → 19.10ms	-5.15%
hook-env	▅█▅▁▄	30,207,994 → 30,229,311	+0.07%	20.81 → 20.71ms	-0.47%
ls	▃▂▄▁█	32,098,384 → 32,192,270	+0.29%	21.99 → 21.98ms	-0.06%
registry	▁▂▂▁█	40,163,734 → 40,247,946	+0.21%	18.22 → 17.68ms	-2.98%
startup	▇▅█▁▅	11,072,896 → 11,079,815	+0.06%	12.24 → 12.18ms	-0.49%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{97d1e5b8345c vs 5b983e14a87f · measured on the runner, not pushed to the history.}