### Manage System Services

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Activates and starts pre-installed system services such as cockpit, docker, or tailscaled.

```bash
sudo systemctl enable --now SERVICENAME.service
```

--------------------------------

### Enable Auto-start for Rootful Podman Containers

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Enables the system-wide podman-restart service to automatically start containers running under the root user on boot.

```bash
sudo systemctl enable podman-restart.service
```

--------------------------------

### Install RPMs via github-release-install.sh

Source: https://context7.com/ublue-os/ucore/llms.txt

Utility script for installing RPM packages directly from GitHub releases. It supports architecture filtering and optional version tagging.

```bash
# Usage: github-release-install.sh ORG_PROJ ARCH_FILTER [LATEST_TAG]

# Install latest mergerfs for Fedora 43 x86_64
./github-release-install.sh trapexit/mergerfs "fc43.x86_64"

# Install specific release
./github-release-install.sh trapexit/mergerfs "fc43.x86_64" "2.40.2"

# Install wezterm for Fedora
./github-release-install.sh wez/wezterm "fedora43.x86_64"
```

--------------------------------

### Enable Auto-start for Rootless Podman Containers

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Configures systemd user services to automatically start containers with restart policies on boot for the core user. Requires enabling linger mode to maintain sessions.

```bash
mkdir -p /var/home/core/.config/systemd/user
cp /lib/systemd/system/podman-restart.service /var/home/core/.config/systemd/user
systemctl --user enable podman-restart.service
systemctl --user list-unit-files | grep podman
loginctl enable-linger $UID
```

--------------------------------

### Automate uCore Installation with Butane/Ignition (YAML/Bash)

Source: https://context7.com/ublue-os/ucore/llms.txt

Configure automated rebasing to uCore during Fedora CoreOS installation using a Butane template. The template generates an Ignition file that orchestrates a two-stage rebase process for both unsigned and signed uCore images. The provided bash commands show how to generate the Ignition file and initiate the installation.

```yaml
# ucore-autorebase.butane - Convert to .ign with: butane ucore-autorebase.butane > ucore-autorebase.ign
variant: fcos
version: 1.4.0
passwd:
  users:
    - name: core
      ssh_authorized_keys:
        - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC... user@host
      password_hash: $6$rounds=4096$salt$hashedpassword
storage:
  directories:
    - path: /etc/ucore-autorebase
      mode: 0754
systemd:
  units:
    - name: ucore-unsigned-autorebase.service
      enabled: true
      contents: |
        [Unit]
        Description=uCore autorebase to unsigned OCI and reboot
        ConditionPathExists=!/etc/ucore-autorebase/unverified
        ConditionPathExists=!/etc/ucore-autorebase/signed
        After=network-online.target
        Wants=network-online.target
        [Service]
        Type=oneshot
        StandardOutput=journal+console
        ExecStart=/usr/bin/rpm-ostree rebase --bypass-driver ostree-unverified-registry:ghcr.io/ublue-os/ucore:stable
        ExecStart=/usr/bin/touch /etc/ucore-autorebase/unverified
        ExecStart=/usr/bin/systemctl disable ucore-unsigned-autorebase.service
        ExecStart=/usr/bin/systemctl reboot
        [Install]
        WantedBy=multi-user.target
    - name: ucore-signed-autorebase.service
      enabled: true
      contents: |
        [Unit]
        Description=uCore autorebase to signed OCI and reboot
        ConditionPathExists=/etc/ucore-autorebase/unverified
        ConditionPathExists=!/etc/ucore-autorebase/signed
        After=network-online.target
        Wants=network-online.target
        [Service]
        Type=oneshot
        StandardOutput=journal+console
        ExecStart=/usr/bin/rpm-ostree rebase --bypass-driver ostree-image-signed:docker://ghcr.io/ublue-os/ucore:stable
        ExecStart=/usr/bin/touch /etc/ucore-autorebase/signed
        ExecStart=/usr/bin/systemctl disable ucore-signed-autorebase.service
        ExecStart=/usr/bin/systemctl reboot
        [Install]
        WantedBy=multi-user.target
```

```bash
# Generate Ignition file and install
butane ucore-autorebase.butane > ucore-autorebase.ign
sudo coreos-installer install /dev/nvme0n1 --ignition-file ucore-autorebase.ign
```

--------------------------------

### Enable System Services with systemctl

Source: https://context7.com/ublue-os/ucore/llms.txt

Enables and starts various system services on uCore, which are pre-installed but disabled by default. This includes web management interfaces, VPN daemons, container runtimes, and file sharing services. Requires root privileges for most services.

```bash
# Enable Cockpit web-based management interface
sudo systemctl enable --now cockpit.socket

# Enable Tailscale VPN daemon
sudo systemctl enable --now tailscaled
tailscale up

# Enable Docker daemon (disabled by default, podman is preferred)
sudo systemctl enable --now docker.socket

# Enable automatic container restart on boot (rootful containers)
sudo systemctl enable podman-restart.service

# Enable automatic container restart for user containers (rootless)
mkdir -p /var/home/core/.config/systemd/user
cp /lib/systemd/system/podman-restart.service /var/home/core/.config/systemd/user
systemctl --user enable podman-restart.service
loginctl enable-linger $UID

# Enable NFS server
sudo systemctl enable --now nfs-server.service

# Enable Samba file sharing
sudo systemctl enable --now smb.service

# Fix Podman and FirewallD conflicts
systemctl enable netavark-firewalld-reload.service
```

--------------------------------

### Verify ucore Image Signatures with Cosign

Source: https://context7.com/ublue-os/ucore/llms.txt

Verifies the digital signatures of uCore container images using cosign and a public key. This ensures the integrity and authenticity of the images. It requires cosign to be installed and the public key to be accessible.

```bash
cosign verify \
  --key https://github.com/ublue-os/ucore/raw/main/cosign.pub \
  ghcr.io/ublue-os/ucore-minimal:stable-nvidia

cosign verify \
  --key https://github.com/ublue-os/ucore/raw/main/cosign.pub \
  ghcr.io/ublue-os/ucore-hci:lts
```

--------------------------------

### Configure Samba File Sharing

Source: https://context7.com/ublue-os/ucore/llms.txt

Configures Samba for SMB/CIFS network file sharing on uCore. This includes firewall configuration, SELinux context setup, user creation, and defining share parameters either through quick methods or the `smb.conf` file. Requires root privileges.

```bash
# Configure firewall for Samba
sudo firewall-cmd --permanent --zone=FedoraServer --add-service=samba
sudo firewall-cmd --reload

# Set SELinux context for Samba shares
sudo semanage fcontext --add --type "samba_share_t" "/var/tank/share(/.*)?"
sudo restorecon -R /var/tank/share

# Or allow Samba to export all directories (less secure)
sudo setsebool -P samba_export_all_rw 1

# Create Samba user
sudo smbpasswd -a core

# Configure user share (quick method)
net usershare add myshare /var/tank/share "My Share" core:F guest_ok=n

# Or configure in /etc/samba/smb.conf
cat >> /etc/samba/smb.conf << 'EOF'
[share]
    path = /var/tank/share
    writable = yes
    valid users = core
    create mask = 0644
    directory mask = 0755
EOF

sudo systemctl enable --now smb.service
```

--------------------------------

### Install uCore via rpm-ostree Rebase (Bash)

Source: https://context7.com/ublue-os/ucore/llms.txt

Rebase an existing Fedora CoreOS system to a uCore OCI image. This process involves an initial rebase to an unverified image, followed by a switch to a signed image for secure updates. Pinning the deployment is recommended for rollback capabilities.

```bash
# Rebase to uCore stable (unsigned, for initial installation)
sudo rpm-ostree rebase ostree-unverified-registry:ghcr.io/ublue-os/ucore:stable

# After first reboot, switch to verified/signed images for secure updates
sudo rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/ucore:stable

# Pin the working deployment to enable rollback if needed
sudo ostree admin pin 0

# Available image variants and tags:
# Images: ucore-minimal, ucore, ucore-hci
# Tags: stable, testing, lts, stable-nvidia, testing-nvidia, lts-nvidia, stable-nvidia-lts, testing-nvidia-lts, lts-nvidia-lts

# Example: Rebase to uCore HCI with NVIDIA support
sudo rpm-ostree rebase ostree-unverified-registry:ghcr.io/ublue-os/ucore-hci:stable-nvidia
```

--------------------------------

### Verify uCore Image Signature with Cosign (Bash)

Source: https://context7.com/ublue-os/ucore/llms.txt

Verify the digital signature of a uCore OCI image using cosign to ensure its authenticity and integrity before installation. This command fetches the public key from the uCore GitHub repository and checks it against the specified image tag.

```bash
# Verify uCore image signature
cosign verify \
  --key https://github.com/ublue-os/ucore/raw/main/cosign.pub \
  ghcr.io/ublue-os/ucore:stable
```

--------------------------------

### Configure syncoid backup timer (systemd)

Source: https://github.com/ublue-os/ucore/blob/main/README.md

This systemd timer unit file, 'syncoid.timer', is used to schedule the execution of syncoid for pulling backups. It should be placed in '/etc/systemd/system/' and enabled using 'systemctl enable syncoid.timer'. The timer is set to run 1 minute after boot and then every 6 hours.

```systemd
[Unit]
Description=Call syncoid to pull backups from source to target

[Timer]
OnBootSec=1min
OnUnitActiveSec=6h

[Install]
WantedBy=timers.target
```

--------------------------------

### Run Containers with GPU Access

Source: https://context7.com/ublue-os/ucore/llms.txt

Commands to execute containers with NVIDIA GPU support using Podman. Includes methods for modern CDI mode, legacy security-opt configurations, and SELinux-disabled scenarios.

```bash
# Run container with GPU access (CDI mode - recommended)
podman run --rm --device nvidia.com/gpu=all nvidia/cuda:12.0-base nvidia-smi

# Run container with GPU access (legacy mode)
podman run --rm --security-opt=label=type:nvidia_container_t \
  --hooks-dir=/usr/share/containers/oci/hooks.d/ \
  nvidia/cuda:12.0-base nvidia-smi

# For some workloads, disable SELinux labeling
podman run --rm --security-opt=label=disable \
  --device nvidia.com/gpu=all \
  nvidia/cuda:12.0-base nvidia-smi
```

--------------------------------

### Create custom uCore OS image (Dockerfile)

Source: https://github.com/ublue-os/ucore/blob/main/README.md

This Dockerfile snippet demonstrates how to create a custom uCore OS image by using the official ucore image as a base. This allows for further customization and building of unique uCore-based operating system images.

```dockerfile
FROM ucore
```

--------------------------------

### Build Custom uCore Images

Source: https://context7.com/ublue-os/ucore/llms.txt

Instructions for building custom images using the Just build system and creating derived images via Containerfiles. This allows users to extend uCore with custom packages and systemd services.

```bash
# Clone and build locally
git clone https://github.com/ublue-os/ucore
cd ucore/ucore

# Build ucore-minimal for stable stream
UCORE_STREAM=stable TARGET_IMAGE=ucore-minimal just build

# Build ucore with NVIDIA drivers
UCORE_STREAM=stable NVIDIA_TAG=-nvidia TARGET_IMAGE=ucore just build

# Build ucore-hci for testing stream
UCORE_STREAM=testing TARGET_IMAGE=ucore-hci just build

# Build with LTS kernel
UCORE_STREAM=lts TARGET_IMAGE=ucore just build

# Custom Containerfile example (FROM ucore)
cat > Containerfile.custom << 'EOF'
FROM ghcr.io/ublue-os/ucore:stable

# Add custom packages
RUN dnf -y install htop iotop && \
    dnf clean all

# Add custom configuration
COPY my-config /etc/my-app/config

# Custom systemd service
COPY my-service.service /usr/lib/systemd/system/
RUN systemctl enable my-service.service
EOF

podman build -f Containerfile.custom -t my-ucore:latest .
```

--------------------------------

### Rebase to Verified UCore Image

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Updates the system to a signed, verified container image using rpm-ostree. This ensures the integrity of the base operating system image.

```bash
sudo rpm-ostree rebase ostree-image-signed:docker://ghcr.io/ublue-os/IMAGE:TAG
```

--------------------------------

### Import ublue-os MOK for SecureBoot

Source: https://context7.com/ublue-os/ucore/llms.txt

Imports the ublue-os Machine-Owner Key (MOK) to ensure compatibility with custom kernel modules under SecureBoot. This process involves using `mokutil` and requires a reboot to complete the key enrollment in the UEFI MOK utility. Includes steps for recovery from boot failures.

```bash
# Import ublue-os signing key for SecureBoot
sudo mokutil --import /etc/pki/akmods/certs/akmods-ublue.der

# Follow prompts to set a password, then reboot
# Enter the UEFI MOK utility on reboot to complete import

# Recovery from SecureBoot boot failure:
# 1. Press ESC at boot error
# 2. At grub> prompt, type: fwsetup
# 3. Disable SecureBoot or enroll the MOK key
```

--------------------------------

### Configure Podman Firewall Reload Service

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Enables the netavark-firewalld-reload service to ensure Podman firewall rules persist after a firewalld reload operation.

```bash
systemctl enable netavark-firewalld-reload.service
```

--------------------------------

### Verify NVIDIA Driver with nvidia-smi

Source: https://context7.com/ublue-os/ucore/llms.txt

Checks if the NVIDIA driver is loaded and functioning correctly using the `nvidia-smi` command. This is a prerequisite for using the NVIDIA Container Toolkit with GPUs in containers.

```bash
# Verify NVIDIA driver is loaded
nvidia-smi
```

--------------------------------

### Configure NFS Server for Network Sharing

Source: https://context7.com/ublue-os/ucore/llms.txt

Sets up the kernel NFS server for network file sharing on uCore. This involves configuring the firewall, setting SELinux contexts for shared directories, and defining export options in `/etc/exports`. Requires root privileges.

```bash
# Configure firewall for NFS
sudo firewall-cmd --permanent --zone=FedoraServer --add-service=nfs
sudo firewall-cmd --reload

# Set SELinux context for read-only NFS shares
sudo semanage fcontext --add --type "public_content_t" "/var/tank/share/ro(/.*)?"
sudo restorecon -R /var/tank/share/ro

# Set SELinux context for read-write NFS shares
sudo semanage fcontext --add --type "public_content_rw_t" "/var/tank/share/rw(/.*)?"
sudo restorecon -R /var/tank/share/rw

# Or allow NFS to export all directories (less secure)
sudo setsebool -P nfs_export_all_rw 1

# Configure exports in /etc/exports
cat >> /etc/exports << 'EOF'
/var/tank/share/ro  192.168.1.0/24(ro,sync,no_subtree_check)
/var/tank/share/rw  192.168.1.0/24(rw,sync,no_subtree_check,no_root_squash)
EOF

# Apply exports and start NFS server
sudo exportfs -ra
sudo systemctl enable --now nfs-server.service
```

--------------------------------

### Configure ZFS Storage Management

Source: https://context7.com/ublue-os/ucore/llms.txt

Manages ZFS storage pools and datasets on uCore, leveraging ZFS kernel modules and tools. This includes loading the ZFS module, creating pools and datasets with specific properties, and configuring automated scrub timers. Requires root privileges and careful consideration of mountpoints due to the immutable root filesystem.

```bash
# Load ZFS module
modprobe zfs

# Enable ZFS module loading at boot
echo zfs > /etc/modules-load.d/zfs.conf

# Create a ZFS pool (must specify mountpoint due to immutable root)
zpool create -m /var/tank tank /dev/sdb

# Fix mountpoint on existing pool
zfs set mountpoint=/var/tank tank

# Create datasets
zfs create tank/data
zfs create -o compression=lz4 tank/compressed
zfs create -o recordsize=1M tank/media

# Enable weekly ZFS scrub timer
systemctl enable --now zfs-scrub-weekly@tank.timer

# Or monthly scrub
systemctl enable --now zfs-scrub-monthly@tank.timer

# Configure Sanoid for automated snapshots
# Create /etc/sanoid/sanoid.conf from template:
cat > /etc/sanoid/sanoid.conf << 'EOF'
[tank/data]
    use_template = production
    recursive = yes

[template_production]
    frequently = 0
    hourly = 36
    daily = 30
    monthly = 3
    yearly = 0
    autosnap = yes
    autoprune = yes
EOF

systemctl enable sanoid.timer
```

--------------------------------

### Toggle SELinux Permissive Mode

Source: https://github.com/ublue-os/ucore/blob/main/README.md

Switches SELinux between enforcing and permissive modes for troubleshooting purposes. It is strongly recommended to keep SELinux enabled.

```bash
# To set permissive mode
setenforce 0
getenforce

# To set enforcing mode
setenforce 1
getenforce
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.