Live ISO builds with krep

krep iso builds a live ISO from a trusted rootfs directory or tar archive. It replaces KreaISO and is not restricted to systemd. Assembly copies the input into a private workspace and does not modify it. It uses no mounts, loop devices, host package installs, or host kernel assets. Linux and root privileges are still required to preserve ownership and device nodes.

Build and run

Build krep as described in the rootfs guide, then run it on a prepared Linux host:

sudo ./out/krep iso --rootfs=/path/rootfs.tar.gz --output=/path/images
sudo ./out/krep iso --rootfs=/path/rootfs --output=/path/images --name=live.iso
# Select a custom final-root init and kernel assets inside the rootfs:
sudo ./out/krep iso --rootfs=/path/rootfs --output=/path/images --init=/opt/custom/init --kernelVersion=VERSION --kernelImage=/boot/custom
# Supply a compatible live initramfs from the host instead of running dracut:
sudo ./out/krep iso --rootfs=/path/rootfs --output=/path/images --initramfs=/path/live-initramfs.img

Only trusted rootfs inputs and overlays are supported. Running archive extraction and filesystem tools as root is not a sandbox for untrusted archives.

Rootfs and init requirements

Provide an executable /sbin/init, or set --init to an absolute path inside the rootfs, not a host path. Symlinks resolve within the rootfs.
Include the init’s interpreter, libraries, service configuration, and console or getty service. The executable check does not validate runtime dependencies. Configure mounts for a live root, not an installed-system root device.
Include a kernel image and its matching modules under /usr/lib/modules/VERSION or /lib/modules/VERSION. Prepare modules.dep with depmod for the target rootfs. Indexed modules are required even with --initramfs.
One module version is selected automatically. Use --kernelVersion for multiple versions. The image search checks /boot/vmlinuz-VERSION, then /boot/Image-VERSION; generic /boot/vmlinuz and /boot/Image are fallbacks only when one module version exists. --kernelImage is rootfs-relative and asserts, but does not prove, that the image matches the selected version.
Include drivers and firmware for the intended hardware and live media: ext4, squashfs, ISO9660, loop, and device-mapper snapshot support. The kernel must support the ext4 features enabled by the host’s mkfs.ext4 defaults.

The builder cannot configure every init system. A Jumpstart rootfs, for example, needs /sbin/init -> /bin/jumpstart and working enabled services. Other init systems need their own configuration.

/etc/kreato-release is optional. Its date and version supply filename metadata; missing values default to the current date and live. [Core] init selects an optional init-specific overlay, not an init allowlist or boot path.

Host tools

Install tools before building; krep does not install them for ISO assembly:

Always: cp, truncate, mkfs.ext4, mksquashfs, grub-mkrescue, xorriso.
Archive input: GNU-compatible tar with ownership, permissions, xattr, and ACL support (--xattrs, --xattrs-include=*, --acls).
Generated initramfs: dracut, udevadm, depmod, modprobe, dmsetup, switch_root, and a complete dracut toolchain with shell/live modules and a working udev provider, daemon, and rules.

Use tools that support the required options, including mkfs.ext4 -d. Install GRUB platform modules for the target architecture and firmware, plus dependencies such as mtools for EFI image creation. Having grub-mkrescue alone does not prove BIOS or UEFI support. Secure Boot is not configured.

Use a native-architecture host with matching dracut and GRUB support. krep does not validate architecture compatibility or configure arbitrary cross-builds. Dracut takes the kernel and modules from the rootfs, not the host. Site dracut configuration is suppressed, but vendor/runtime drop-ins may still apply.

--initramfs bypasses dracut and its host udev/tool preflight, not the other tools or rootfs kernel checks. The supplied image must match the kernel and live layout; krep copies it without validating its contents.

Live layout and secure defaults

The ISO contains an ext4 LiveOS/rootfs.img inside LiveOS/squashfs.img. --imageSizeMiB=0 estimates the ext4 size automatically; a positive value sets its size, not the final ISO size. Allow space for all intermediate images.

Generated dracut images use shell-based base, dmsquash-live, and kernel-modules, omitting systemd and systemd-initrd. GRUB passes init=/sbin/init (or your override) for the final root, not rdinit=, which would bypass live-root setup. The ISO label is ISOIMAGE.

Passwords are preserved by default. Bundled resources do not enable autologin or remove firstboot services. --clearRootPassword explicitly clears only the staged root password and requires a valid root entry in /etc/shadow. It does not enable autologin. Do not treat an image with an empty root password as a secure installed system. Custom overlays can change login policy, so review them carefully.

Resources live in krep/data/iso or installed share/krep/iso. --dataDir selects an explicit ISO resource directory. Common overlay/ files are applied first, then optional overlays/<init-name>/ files selected by release metadata. --grubConfig selects a custom GRUB template; preserve the live boot layout and its @INIT@ placeholder.

Output and recovery

--output selects the output directory. --name=live.iso overrides the default kreatolinux-DATE-VERSION-KERNEL.iso filename; it must be a visible filename ending in .iso, not a path. Existing outputs are refused unless --overwrite is set. Publication is atomic: failed builds do not publish a partial final ISO or replace an existing ISO before completion.

Each build has a private krep-iso-* workspace and an adjacent NAME.iso.lock directory. --workDir selects an existing workspace parent. Both workspace and output must be outside a directory input rootfs. Different outputs can build concurrently; competing builds for the same output fail.

Normal completion, errors, SIGINT, and SIGTERM clean up owned temporary files and locks. SIGKILL, power loss, or cleanup failures can leave workspaces, .krep-iso-*.partial files, and locks. Locks are not reclaimed automatically. Verify that no build or child process uses them before manual removal.

What has been tested

Linux ARM64 integration used Debian’s 6.1.0-53-arm64 kernel and matching rootfs modules. Assembly succeeded with the build host’s module tree removed. QEMU ARM64 UEFI booted the ISO, dracut mounted the writable live root, and a custom BusyBox-based test init reached PID 1 and powered off. Its serial log contained KREP_REAL_LIVE_ROOT_BOOT_OK and INIT_PID=1.