From 8dcf4f0e85e682c56c154fc67c516c3c511f8963 Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Mon, 27 Jul 2026 17:01:19 +0000 Subject: [PATCH] Deploy bootc-dev/bootc-dev.github.io to bootc-dev/bootc-dev.github.io:gh-pages --- .nojekyll | 0 404.html | 3 + CNAME | 1 + about/about/index.html | 172 +++ about/adopters/index.html | 200 +++ about/changelog/index.html | 156 +++ about/contributing/index.html | 451 ++++++ about/governance/index.html | 336 +++++ about/index.html | 230 ++++ about/maintainers/index.html | 185 +++ about/security/index.html | 186 +++ .../index.html | 596 ++++++++ .../2025-july-11-community-meeting/index.html | 242 ++++ .../2025-july-18-community-meeting/index.html | 253 ++++ .../index.html | 254 ++++ .../index.html | 203 +++ .../index.html | 335 +++++ .../index.html | 368 +++++ .../index.html | 343 +++++ .../index.html | 314 +++++ blog/index.html | 179 +++ elasticlunr.min.js | 10 + favicon.ico | Bin 0 -> 53722 bytes img/cncf-color-bg.svg | 1 + index.html | 323 +++++ juice.css | 1 + logo.png | Bin 0 -> 56323 bytes .../2025-july-11-community-meeting/index.html | 12 + .../2025-july-18-community-meeting/index.html | 12 + news/index.html | 12 + normalize.css | 349 +++++ robots.txt | 4 + rss.xml | 1219 +++++++++++++++++ search_index.en.js | 1 + sitemap.xml | 69 + 35 files changed, 7020 insertions(+) create mode 100644 .nojekyll create mode 100644 404.html create mode 100644 CNAME create mode 100644 about/about/index.html create mode 100644 about/adopters/index.html create mode 100644 about/changelog/index.html create mode 100644 about/contributing/index.html create mode 100644 about/governance/index.html create mode 100644 about/index.html create mode 100644 about/maintainers/index.html create mode 100644 about/security/index.html create mode 100644 blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/index.html create mode 100644 blog/2025-july-11-community-meeting/index.html create mode 100644 blog/2025-july-18-community-meeting/index.html create mode 100644 blog/2026-jul-07-conference-talks-devconf-flock-2026/index.html create mode 100644 blog/2026-jun-05-transient-root-etc-var/index.html create mode 100644 blog/2026-may-04-sealed-images-security-chain/index.html create mode 100644 blog/2026-may-05-sealed-images-key-management/index.html create mode 100644 blog/2026-may-06-sealed-images-building/index.html create mode 100644 blog/2026-may-07-sealed-images-deploying/index.html create mode 100644 blog/index.html create mode 100644 elasticlunr.min.js create mode 100644 favicon.ico create mode 100644 img/cncf-color-bg.svg create mode 100644 index.html create mode 100644 juice.css create mode 100644 logo.png create mode 100644 news/2025-july-11-community-meeting/index.html create mode 100644 news/2025-july-18-community-meeting/index.html create mode 100644 news/index.html create mode 100644 normalize.css create mode 100644 robots.txt create mode 100644 rss.xml create mode 100644 search_index.en.js create mode 100644 sitemap.xml diff --git a/.nojekyll b/.nojekyll new file mode 100644 index 0000000..e69de29 diff --git a/404.html b/404.html new file mode 100644 index 0000000..f8414f0 --- /dev/null +++ b/404.html @@ -0,0 +1,3 @@ + +404 Not Found +

404 Not Found

diff --git a/CNAME b/CNAME new file mode 100644 index 0000000..26e5a53 --- /dev/null +++ b/CNAME @@ -0,0 +1 @@ +bootc.dev diff --git a/about/about/index.html b/about/about/index.html new file mode 100644 index 0000000..84cf7a0 --- /dev/null +++ b/about/about/index.html @@ -0,0 +1,172 @@ + + + + + + About | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ So what is bootc? +
+ + +
+
+ + + +
+ +
About bootc
+

So what is bootc?

+

Imagine the ability to set up your operating system using a file you can check into source control. bootc basically turns your operating system into a containerized system, complete with in-place updates, custom configurations and pre-installed software and drivers, and more. You can share your custom containerized operating system image with others, too.

+

Unlock the power of bootc with shared custom OS images.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/adopters/index.html b/about/adopters/index.html new file mode 100644 index 0000000..8a74710 --- /dev/null +++ b/about/adopters/index.html @@ -0,0 +1,200 @@ + + + + + + Adopters | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + + + +
+
+ bootc Adopters (direct) +
+ via ostree) +
+
+ + +
+ + +
End User Adopters
+
+

Note +Do you want to add yourself to this list? Simply fork the repository and open a PR with the required change. +We have a short description of the adopter types at the bottom of this page. Each type is in alphabetical order.

+
+

bootc Adopters (direct)

+ + + + + + + +
TypeNameSinceWebsiteUse-Case
VendorRed Hat2024https://redhat.comImage Based Linux
VendorHeliumOS2024https://www.heliumos.org/An atomic desktop operating system for your devices
VendorAlmaLinux (Atomic SIG)2025atomic-desktop, atomic-workstationAtomic AlmaLinux desktop respins
VendorCaligra2025workbenchAn OS designed to accelerate knowledge work
VendorCIQ2026https://ciq.comRocky Linux from CIQ (RLC) - Image Based Linux - Standard and Cloud variants
VendorUniversal Blue (Aurora/Bazzite/Bluefin)2024https://universal-blue.org/The reliability of a Chromebook, but with the flexibility and power of a traditional Linux desktop
+

bootc Adopters (indirect, via ostree)

+

Bootc is a relatively new project, but much of the underlying technology and goals is not new. +The underlying ostree project is over 13 years old (as of 2024). This project also relates +to rpm-ostree which has existed a really long time.

+

Not every one of these projects uses bootc directly today, but a toplevel goal of bootc +is to be the successor to ostree, and it is our aim to seamlessly carry forward these users.

+ + + + + + + +
TypeNameSinceWebsiteUse-Case
VendorEndless2014linkA Completely Free, User-Friendly Operating System Packed with Educational Tools, Games, and More
VendorRed Hat2015linkImage Based Linux
VendorApertis2020linkCollaborative OS platform for products
VendorFedora Project2021linkAn atomic desktop operating system aimed at good support for container-focused workflows
VendorPlaytron GameOS2022linkA video game console OS that has integration with the top PC game stores
VendorFyra Labs2024linkBootc powers an experimental variant of Ultramarine Linux
+

Adopter Types

+

End-user: The organization runs bootc in production in some way.

+

Integration: The organization has a product that integrates with bootc, but does not contain bootc.

+

Vendor: The organization packages bootc in their product and sells it as part of their product.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/changelog/index.html b/about/changelog/index.html new file mode 100644 index 0000000..b9496b4 --- /dev/null +++ b/about/changelog/index.html @@ -0,0 +1,156 @@ + + + + + + Changelog | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+ +
Changelog
+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/contributing/index.html b/about/contributing/index.html new file mode 100644 index 0000000..dc1a156 --- /dev/null +++ b/about/contributing/index.html @@ -0,0 +1,451 @@ + + + + + + Contributing | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + + + + + + + + + + + + + + + + + +
+
+ Contributing to bootc +
+ + - Note: Before writing a big patch + +
+ + - Development environment + +
+ + - Key recommended ingredients: + +
+ + - Ensure you're familiar with a bootc system + +
+ + - The Justfile + +
+ + - Running the tests + +
+
+ + +
+ + +
Contributing
+

Contributing to bootc

+

Thanks for your interest in contributing! At the current time, +bootc is implemented in Rust, and calls out to important components +which are written in Go (e.g. https://github.com/containers/image) +as well as C (e.g. https://github.com/ostreedev/ostree/). Depending +on what area you want to work on, you'll need to be familiar with +the relevant language.

+

Note: Before writing a big patch

+

If you plan to contribute a large change, please get in touch before +submitting a pull request by e.g. filing an issue describing your proposed +change. This will help ensure alignment.

+

Development environment

+

There isn't a single approach to working on bootc; however +the primary developers tend to use Linux host systems, +and test in Linux VMs. One specifically recommended +approach is to use toolbox +to create a containerized development environment +(it's possible, though not necessary to create the toolbox +dev environment using a bootc image as well).

+

At the current time most upstream developers use a Fedora derivative +as a base, and the hack/Containerfile defaults +to Fedora. However, bootc itself is not intended to strongly tie to a particular +OS or distribution, and patches to handle others are gratefully +accepted!

+ +
    +
  • A development environment (toolbox or a host) with a Rust and C compiler, etc. +While this isn't specific to bootc, you will find the experience of working on Rust +is greatly aided with use of e.g. rust-analyzer.
    • +
  • Install bcvk. For running TMT +integration tests, also install tmt and libvirt +(e.g. dnf install bcvk tmt libvirt).
    • +
+

Ensure you're familiar with a bootc system

+

Worth stating: before you start diving into the code you should understand using +the system as a user and how it works. See the user documentation for that.

+

The Justfile

+

The Justfile is the primary interface for building and testing bootc.

+
just --list           # Show all targets organized by group
+just list-variants    # Show available build variants and current config

Building from source

+

Edit the source code; a simple thing to do is add e.g. +eprintln!("hello world"); into run_from_opt in crates/lib/src/cli.rs. +You can run make or cargo build to build that locally. However, a key +next step is to get that binary into a bootc container image.

+

Running just defaults to just build which will build a container +from the current source code; the result will be named localhost/bootc.

+

Running an interactive shell in an environment from the container

+

You can of course podman run --rm -ti localhost/bootc bash to get a shell, +and try running bootc.

+

Running container-oriented integration tests

+
just test-container

Running (TMT) integration tests

+

A common cycle here is you'll edit e.g. deploy.rs and want to run the +tests that perform an upgrade:

+
just test-tmt local-upgrade-reboot
+

To run a specific test:

+
just test-tmt readonly

Faster iteration cycles

+

The test cycle currently builds a disk image and creates a new ephemeral +VM for each test run.

+

You can shortcut some iteration cycles by having a more persistent +environment where you run bootc.

+

Upgrading from the container image

+

One good approach is to create a persistent target virtual machine via e.g. +bcvk libvirt run (or a cloud VM), and then after doing a just build and getting +a container image, you can directly upgrade to that image.

+

For the local case, check out cstor-dist. +Another alternative is mounting via virtiofs (see e.g. this PR to bcvk). +If you're using libvirt, see this document.

+

Using sysext for fast iteration

+

For the fastest development cycle when working on the bootc client +(e.g. bootc upgrade, bootc switch), you can use the sysext-based +workflow. This builds the bootc binary via a container, shares it into +a persistent VM via virtiofs, and overlays it onto /usr using +systemd-sysext (~30s rebuild cycle):

+
# Build sysext and launch a persistent dev VM
+just bcvk up
+
+# After editing code, rebuild and refresh the overlay (~30s)
+just bcvk sync
+
+# SSH into the VM — bootc is your dev build
+just bcvk ssh bootc status
+
+# When done
+just bcvk down
+

The sysext overlay means bootc on the VM's PATH is your dev build. +Run just bcvk to list all available commands.

+

Running bootc against a live environment

+

If your development environment host is also a bootc system (e.g. a +workstation or a virtual server) one way to shortcut some cycles is just +to directly run the output of the built binary against your host.

+

Say for example your host is a Fedora 42 workstation (based on bootc), +then you can cargo b --release directly in a Fedora 42 container +or even on your host system, and then directly run e.g. ./target/release/bootc upgrade +etc.

+

Building and testing with the composefs backend

+

bootc has two storage backends: ostree (default, production) and composefs +(experimental). The composefs backend has several axes of configuration:

+ + + + + + +
VariableValuesNotes
variantostree, composefsStorage backend
bootloadergrub, systemdsystemd-boot required for UKI
boot_typebls, ukiUKI embeds the composefs digest
seal_stateunsealed, sealedSealed signs the UKI for Secure Boot
filesystemext4, btrfs, xfsxfs lacks fsverity, incompatible with sealed
+

These are controlled via BOOTC_-prefixed environment variables. +Using environment variables (rather than just command-line overrides) +is recommended because they persist across commands in the same shell +session — so just build followed by just test-tmt will use the +same configuration:

+
# Set up a composefs development session
+export BOOTC_variant=composefs
+export BOOTC_bootloader=systemd
+# Now all just targets use these settings:
+just build
+just test-tmt readonly
+just test-container
+

The constraints are:

+
    +
  • sealed requires boot_type=uki (the digest lives in the UKI cmdline)
    • +
  • sealed requires filesystem with fsverity support (ext4 or btrfs)
    • +
  • uki requires bootloader=systemd
    • +
+

Common workflows:

+
# Simplest composefs build (unsealed, grub, BLS, ext4)
+export BOOTC_variant=composefs
+just build
+
+# Composefs with systemd-boot
+export BOOTC_variant=composefs BOOTC_bootloader=systemd
+just build
+
+# Fully sealed image (systemd-boot + signed UKI + Secure Boot)
+# This is the most common composefs dev workflow:
+just build-sealed
+
+# Run composefs integration tests (all four params are required)
+just test-composefs systemd ext4 bls unsealed
+
+# Run sealed UKI tests
+just test-composefs systemd ext4 uki sealed
+
+# Validate composefs digests match between build and install views
+# (useful for debugging mtime/metadata issues)
+just validate-composefs-digest
+

The build-sealed target generates test Secure Boot keys in +target/test-secureboot/ and builds a complete sealed image with all +the sealed composefs settings. See +experimental-composefs.md for +more information on sealed images.

+

Debugging via lldb

+

The hack/lldb directory contains an example of how to use lldb to debug bootc code. +hack/lldb/deploy.sh can be used to build and deploy a bootc VM in libvirt with an lldb-server +running as a systemd service. Depending on your editor, you can then connect to the lldb server +to use an interactive debugger, and set up the editor to build and push the new binary to the VM. +hack/lldb/dap-example-vim.lua is an example for neovim.

+

The VM can be connected to via ssh test@bootc-lldb if you have nss +enabled.

+

For some bootc install commands, it's simpler to run the lldb-server in a container, e.g.

+
sudo podman run --pid=host --network=host --privileged --security-opt label=type:unconfined_t -v /var/lib/containers:/var/lib/containers -v /dev:/dev -v .:/output localhost/bootc-lldb lldb-server platform --listen "*:1234" --server

Code linting

+

The make validate target runs checks locally that we gate on +in CI, currently around cargo fmt and cargo clippy.

+

Running the tests

+

First, you can run many unit tests with cargo test.

+

container tests

+

There's a small set of tests which are designed to run inside a bootc container +and are built into the default container image:

+
$ just test-container

Submitting a patch

+

The podman project has some generic useful guidance; +like that project, a "Developer Certificate of Origin" is required.

+

Sign your PRs

+

The sign-off is a line at the end of the explanation for the patch. Your +signature certifies that you wrote the patch or otherwise have the right to pass +it on as an open-source patch. The rules are simple: if you can certify +the below (from developercertificate.org):

+
Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
+

Then you just add a line to every git commit message:

+
Signed-off-by: Joe Smith <joe.smith@email.com>
+

Use your real name (sorry, no pseudonyms or anonymous contributions.)

+

If you set your user.name and user.email git configs, you can sign your +commit automatically with git commit -s.

+

Git commit style

+

Please look at git log and match the commit log style, which is very +similar to the +Linux kernel.

+

You may use Signed-off-by, but we're not requiring it.

+

General Commit Message Guidelines:

+
    +
  1. Title +
      +
    • Specify the context or category of the changes e.g. lib for library changes, docs for document changes, bin/<command-name> for command changes, etc.
      • +
    • Begin the title with the first letter of the first word capitalized.
      • +
    • Aim for less than 50 characters, otherwise 72 characters max.
      • +
    • Do not end the title with a period.
      • +
    • Use an imperative tone.
      • +
    +
    2. +
  2. Body +
      +
    • Separate the body with a blank line after the title.
      • +
    • Begin a paragraph with the first letter of the first word capitalized.
      • +
    • Each paragraph should be formatted within 72 characters.
      • +
    • Content should be about what was changed and why this change was made.
      • +
    • If your commit fixes an issue, the commit message should end with Closes: #<number>.
      • +
    +
    3. +
+

Commit Message example:

+
<context>: Less than 50 characters for subject title
+
+A paragraph of the body should be within 72 characters.
+
+This paragraph is also less than 72 characters.
+

For more information see How to Write a Git Commit Message

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/governance/index.html b/about/governance/index.html new file mode 100644 index 0000000..120d6f4 --- /dev/null +++ b/about/governance/index.html @@ -0,0 +1,336 @@ + + + + + + Governance | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + + + + + + + + + + + +
+
+ Bootc Project Governance +
+ + - Values + +
+ + - Maintainers + +
+ + - Meetings + +
+ + - CNCF Resources + +
+ + - Code of Conduct + +
+ + - Security Response Team + +
+ + - Voting + +
+ + - Modifying this Charter + +
+
+ + +
+ + +
Project governance
+

Bootc Project Governance

+

The Bootc project is dedicated to providing transactional, in-place operating system updates using OCI/Docker container images. +This governance explains how the project is run.

+ +

Values

+

The Bootc and its leadership embrace the following values:

+
    +
  • +

    Openness: Communication and decision-making happens in the open and is discoverable for future +reference. As much as possible, all discussions and work take place in public +forums and open repositories.

    +
    • +
  • +

    Fairness: All stakeholders have the opportunity to provide feedback and submit +contributions, which will be considered on their merits.

    +
    • +
  • +

    Community over Product or Company: Sustaining and growing our community takes +priority over shipping code or sponsors' organizational goals. Each +contributor participates in the project as an individual.

    +
    • +
  • +

    Inclusivity: We innovate through different perspectives and skill sets, which +can only be accomplished in a welcoming and respectful environment.

    +
    • +
  • +

    Participation: Responsibilities within the project are earned through +participation, and there is a clear path up the contributor ladder into leadership +positions.

    +
    • +
+

Maintainers

+

Bootc Maintainers have "gated" write access to the project GitHub repository. +The current maintainers can be found in MAINTAINERS.md.

+

Direct pushes to the code is never allowed. All pull requests require review by a maintainer +other than the one submitting it. "Large" changes are encouraged to have a tracking +issue filed beforehand and gather consensus from multiple maintainers and interested community.

+

Maintainers collectively manage the project's resources and contributors.

+

This privilege is granted with some expectation of responsibility: maintainers +are people who care about the Bootc project and want to help it grow and +improve. A maintainer is not just someone who can make changes, but someone who +has demonstrated their ability to collaborate with the team, get the most +knowledgeable people to review code and docs, contribute high-quality code, and +follow through to fix issues (in code or tests).

+

A maintainer is a contributor to the project's success and a citizen helping +the project succeed.

+

The collective team of all Maintainers is known as the Maintainer Council, which +is the governing body for the project.

+

Becoming a Maintainer

+

To become a Maintainer you need to demonstrate the following:

+
    +
  • commitment to the project: +
      +
    • participate in discussions, contributions, code and documentation reviews for 6 months or more,
      • +
    • perform reviews for 20 non-trivial pull requests,
      • +
    • contribute 10 non-trivial pull requests and have them merged,
      • +
    +
    • +
  • ability to write quality code and/or documentation,
    • +
  • ability to collaborate with the team,
    • +
  • understanding of how the team works (policies, processes for testing and code review, etc),
    • +
  • understanding of the project's code base and coding and documentation style.
    • +
+

A new Maintainer must be proposed by an existing maintainer by opening a PR against the MAINTAINERS.md, which will prompt a gitvote. A simple majority vote of existing Maintainers +approves the application. Maintainers nominations will be evaluated without prejudice +to employer or demographics.

+

Maintainers who are selected will be granted the necessary GitHub rights.

+

Removing a Maintainer

+

Maintainers may resign at any time if they feel that they will not be able to +continue fulfilling their project duties.

+

Maintainers may also be removed after being inactive, failure to fulfill their +Maintainer responsibilities, violating the Code of Conduct, or other reasons. +Inactivity is defined as a period of very low or no activity in the project +for a year or more, with no definite schedule to return to full Maintainer +activity.

+

A Maintainer may be removed at any time by a 2/3 vote of the remaining maintainers.

+

Depending on the reason for removal, a Maintainer may be converted to Emeritus +status. Emeritus Maintainers will still be consulted on some project matters, +and can be rapidly returned to Maintainer status if their availability changes. +This requires two votes from active maintainers.

+

Meetings

+

Time zones permitting, Maintainers are expected to participate in the public +developer meeting, which occurs at 15:30 UTC on Fridays via Zoom.

+

Maintainers will also have closed meetings in order to discuss security reports +or Code of Conduct violations. Such meetings should be scheduled by any +Maintainer on receipt of a security issue or CoC report. All current Maintainers +must be invited to such closed meetings, except for any Maintainer who is +accused of a CoC violation.

+

CNCF Resources

+

Any Maintainer may suggest a request for CNCF resources, either in the +bootc discussions, or during a +meeting. A simple majority of Maintainers approves the request. The Maintainers +may also choose to delegate working with the CNCF to non-Maintainer community +members, who will then be added to the CNCF's Maintainer List +for that purpose.

+

Code of Conduct

+

Code of Conduct +violations by community members will be discussed and resolved +by the maintainers privately. If a Maintainer is directly involved +in the report, the Maintainers will instead designate two Maintainers to work +with the CNCF Code of Conduct Committee in resolving it.

+

Security Response Team

+

The Maintainers will appoint a Security Response Team to handle security reports. +This committee may simply consist of the Maintainer Council themselves. If this +responsibility is delegated, the Maintainers will appoint a team of at least two +contributors to handle it. The Maintainers will review who is assigned to this +at least once a year.

+

The Security Response Team is responsible for handling all reports of security +holes and breaches according to the security policy.

+

Voting

+

While most business in Bootc is conducted by "lazy consensus", +periodically the Maintainers may need to vote on specific actions or changes. +A vote can be taken using gitvote or +privately for security or conduct matters. Any Maintainer may demand a vote be taken.

+

Most votes require a simple majority of all Maintainers to succeed, except where +otherwise noted. Two-thirds majority votes mean at least two-thirds of all +existing maintainers.

+

Modifying this Charter

+

Changes to this Governance and its supporting documents may be approved by +a 2/3 vote of the Maintainers.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/index.html b/about/index.html new file mode 100644 index 0000000..2691bf4 --- /dev/null +++ b/about/index.html @@ -0,0 +1,230 @@ + + + + + + Project information | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+ +
+
Project information
+ +
+ +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/maintainers/index.html b/about/maintainers/index.html new file mode 100644 index 0000000..f599c6f --- /dev/null +++ b/about/maintainers/index.html @@ -0,0 +1,185 @@ + + + + + + Maintainers | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + + +
+
+ Maintainers +
+ Community Managers +
+
+ + +
+ + +
Project maintainers
+

Maintainers

+

The current Maintainers Group for the bootc Project consists of:

+ + + + + + + +
NameGitHub IDEmployerResponsibilities
Chris KyrouacckyrouacRed HatApprover
Colin WalterscgwaltersRed HatApprover
John EckersbergjeckersbRed HatApprover
Xiaofeng WanghenrywangRed HatApprover
Gursewak Mangatgursewak1997Red HatApprover
Joseph MarrerojmarreroRed HatApprover
+

Community Managers

+

This group can represent the project for administrative and program manager duties. Examples: CNCF Service Desk tickets, coordinating with CNCF Project and Events teams, and LFX Administration. No code or code review rights.

+ + + + + +
NameGitHub IDEmployerResponsibilities
Laura SantamarianimbinatusRed HatRepresentative
Mohan Shashmohan-shashRed HatRepresentative
Preethi ThomaspreethitRed HatRepresentative
Mark RussellmarruslRed HatRepresentative
+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/about/security/index.html b/about/security/index.html new file mode 100644 index 0000000..4bbc213 --- /dev/null +++ b/about/security/index.html @@ -0,0 +1,186 @@ + + + + + + Security | bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + + + + +
+
+ Security Policy +
+ + - Reporting a Vulnerability + +
+
+ + +
+ + +
Security
+

Security Policy

+

Reporting a Vulnerability

+

If you find a potential security vulnerability in bootc, please report it by following these steps:

+

1. Use the GitHub Security Tab

+

This repository is set up to allow vulnerability reports through GitHub's Security Advisories feature. To report a vulnerability:

+
    +
  1. Navigate to the repository's main page.
    2. +
  2. Select the Security tab.
    3. +
  3. Select Advisories from the left-hand sidebar.
    4. +
  4. Click on Report a vulnerability.
    5. +
  5. Fill in the required details and submit the report.
    6. +
+

Following this process will create a private advisory for our maintainers to review.

+

2. Do Not Open Public Pull Requests, Issues, or Discussions

+

Please do not discuss the issue, create PRs, or start discussions about the vulnerability. This ensures the vulnerability is not widely exploited before a fix is provided.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/index.html b/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/index.html new file mode 100644 index 0000000..1d88f52 --- /dev/null +++ b/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/index.html @@ -0,0 +1,596 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Containers: pitfalls of incomplete tar archives +
+ + +
+ - A refresher on tar +
+ +
+ - OCI image spec +
+ +
+ - Rechunking in bootc / rpm-ostree +
+ +
+ - Why isn't this a more widespread problem? +
+ +
+ - Overlayfs +
+ +
+ - Where do we go from here? +
+ +
+ - Conclusion +
+ + + +
+
+ + + +
+ +
+
+ December 15, 2025 + + by + + + + + +
+

Containers: pitfalls of incomplete tar archives

+

As Colin Walters likes to say, containers +are just tarballs wrapped in JSON. We'll mostly ignore the JSON part +here, but there's a lot to unpack (pun and foreshadowing intended) +with regards to tar and how it interacts with the various pieces that +work in conjunction to make containers a reality.

+

A refresher on tar

+

Let's explore a key quirk of tar from which everything else we'll +discuss follows.

+

First, let's create a basic tar archive, which contains a directory +with a file inside of the directory:

+
⬢ [jeckersb@toolbx tmp]$ mkdir foo
+⬢ [jeckersb@toolbx tmp]$ touch foo/bar
+⬢ [jeckersb@toolbx tmp]$ tar cf foo.tar foo/
+

Now let's list the contents of the tar archive:

+
⬢ [jeckersb@toolbx tmp]$ tar tvf foo.tar
+drwxr-xr-x jeckersb/jeckersb 0 2025-12-10 11:09 foo/
+-rw-r--r-- jeckersb/jeckersb 0 2025-12-10 11:09 foo/bar
+

Ok, that makes sense. We see the directory and the file we added to +the archive.

+

But here's the key bit: What happens if you add only the file to the archive?

+
⬢ [jeckersb@toolbx tmp]$ tar cf incomplete.tar foo/bar
+⬢ [jeckersb@toolbx tmp]$ tar tvf incomplete.tar
+-rw-r--r-- jeckersb/jeckersb 0 2025-12-10 11:09 foo/bar
+

Now the archive has metadata only for the file. You can deduce from +the path foo/bar that there is a directory foo involved, but you +can't definitively know how foo is supposed to look. What are the +permissions, owner, group, mtime? We don't know. So what happens if +you extract this tar archive?

+
⬢ [jeckersb@toolbx tmp]$ mkdir incomplete-unpacked && tar xf incomplete.tar -C incomplete-unpacked
+⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked/
+total 0
+drwxr-xr-x. 2 jeckersb jeckersb 60 Dec 10 11:19 foo
+⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked/foo/
+total 0
+-rw-r--r--. 1 jeckersb jeckersb 0 Dec 10 11:09 bar
+

It implicitly creates the directory foo in order to put bar at the +correct path. This makes sense. But notice foo gets created with +metadata that is dependent on the environment in which the unpacking +of the archive happened. In the above example, you can see that the +timestamp on the directory is 10 minutes later than the timestamp of +the bar file inside. This is because it took me 10 minutes of +writing and editing this post before I did the unpack operation. I +can set my umask to something else and extract it a second time, and +now we'll see a different timestamp and different permissions:

+
⬢ [jeckersb@toolbx tmp]$ umask 0077
+⬢ [jeckersb@toolbx tmp]$ mkdir incomplete-unpacked-with-umask && tar xf incomplete.tar -C incomplete-unpacked-with-umask
+⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked-with-umask/
+total 0
+drwx------. 2 jeckersb jeckersb 60 Dec 10 11:25 foo
+⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked-with-umask/foo/
+total 0
+-rw-------. 1 jeckersb jeckersb 0 Dec 10 11:09 bar

OCI image spec

+

OCI container images are serialized as a series of +tarballs +that are applied on top of each other to create the complete +filesystem. We'll get back to the specifics of that operation a bit +later.

+

The entire layer specification is worth reading, but we'll focus on +two parts. First, how to determine changes:

+
When two directories are compared, the relative root is the top-level directory.
+The directories are compared, looking for files that have been [added, modified, or removed](#change-types).
+
+For this example, `rootfs-c9d-v1/` and `rootfs-c9d-v1.s1/` are recursively compared, each as relative root path.
+
+The following changeset is found:
+
+Added:      /etc/my-app.d/
+Added:      /etc/my-app.d/default.cfg
+Modified:   /bin/my-app-tools
+Deleted:    /etc/my-app-config
+
+This reflects the removal of `/etc/my-app-config` and creation of a file and directory at `/etc/my-app.d/default.cfg`.
+`/bin/my-app-tools` has also been replaced with an updated version.
+

And then the following section on representing changes:

+
A [tar archive][tar-archive] is then created which contains _only_ this changeset:
+
+- Added and modified files and directories in their entirety
+- Deleted files or directories marked with a [whiteout file](#whiteouts)
+
+The resulting tar archive for `rootfs-c9d-v1.s1` has the following entries:
+
+./etc/my-app.d/
+./etc/my-app.d/default.cfg
+./bin/my-app-tools
+./etc/.wh.my-app-config
+
+To signify that the resource `./etc/my-app-config` MUST be removed when the changeset is applied, the basename of the entry is prefixed with `.wh.`.
+

But note that the changeset says nothing about the directories higher +in the filesystem. So in the above example, it would be perfectly +valid (and more correct) to generate changeset tar archives which are +incomplete in the same manner we described above. Most notably, these +changesets would not contain tar entries for the directories /etc +and /bin.

+

This oversight in the specification is not new or surprising. There +is an open issue from +2017 which +describes exactly this problem. There is a linked pull +request which +has been open since late 2022 with intermittent discussion, but no +consensus or resolution has been reached yet.

+

This has led to some projects implementing their own workarounds to +deal with this behavior. The containerd project as an example +noted this +issue in 2017 +and worked around +it by creating +explicit archive directory entries for parents.

+

Rechunking in bootc / rpm-ostree

+

Base images used via bootc are typically post-processed and +finalized via the rpm-ostree +rechunker. +The general idea (oversimplifying a bit for brevity) is that the tool +can inspect the RPM database and map each file in the container to its +associated RPM. It then "rechunks" the container by creating a new +layer for each RPM, where the layer contains the files for that RPM +and only that RPM. This ensures that when a new version of an RPM is +released in the future, when it is integrated into a new base image, +only the layer associated with that RPM will need to be re-downloaded +by the end user.

+

However, consider a directory like /usr. This is owned by the +filesystem package which contains all of the shared base directories +in the system. This directory will be included in the layer +associated with the filesystem package with all of its related +metadata.

+

Now, almost every other package in the system is going to have some +amount of content that is shipped under the /usr hierarchy. +Originally, the rpm-ostree rechunker would omit the archive entry +for /usr in each package layer.

+

This however would cause the behavior of indeterminate tar archives +discussed above to be manifest in the final container. For example, +it was noted in this composefs-rs +issue.

+

We worked around this issue by creating a new +format-version for +the rpm-ostree rechunker, which creates all of the parent +directories in each tar layer. This is similar to the fix implemented +as noted above by the containerd project. This works, but it's not +ideal. It means that all of the parent directories and their +respective metadata have to be duplicated across every layer in the +image. This is an unnecessary waste of disk space and bandwidth.

+

Why isn't this a more widespread problem?

+

When I first realized what was going on here, I thought I could +trigger this behavior with a Containerfile like this:

+
FROM quay.io/fedora/fedora:43
+
+RUN <<EORUN
+
+# Create two levels of directories, because adding a file to a
+# directory alters the directory mtime.  This means adding a file
+# under /foo/bar in the next layer will cause the mtime for /foo/bar
+# to change, but /foo will remain unchanged.
+mkdir -p /foo/bar
+
+# zero the mtime on foo
+touch -d @0 /foo
+EORUN
+
+# Add a file in a derived layer
+#
+# In theory, this layer would not contain an entry for /foo, since it
+# is unchanged.
+#
+# In practice... not so much.
+RUN touch /foo/bar/baz
+

But alas:

+
⬢ [jeckersb@toolbx example]$ podman build -f Containerfile -t localhost/example
+STEP 1/3: FROM quay.io/fedora/fedora:43
+STEP 2/3: RUN <<EORUN (# Create two levels of directories, because adding a file to a...)
+--> d3f72d4d7b90
+STEP 3/3: RUN touch /foo/bar/baz
+COMMIT localhost/example
+--> b730a7409a5a
+Successfully tagged localhost/example:latest
+b730a7409a5a5b5450f4f1d142415043aeac48f6ac0d1ac2a632d75071668a60
+⬢ [jeckersb@toolbx example]$ podman run --rm -it localhost/example stat /foo
+  File: /foo
+  Size: 6               Blocks: 0          IO Block: 4096   directory
+Device: 0,93    Inode: 64851509    Links: 1
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Access: 2025-12-10 21:31:11.973931592 +0000
+Modify: 1970-01-01 00:00:00.000000000 +0000
+Change: 2025-12-10 21:31:11.973678196 +0000
+ Birth: 2025-12-10 21:31:11.973031361 +0000
+

But wait... the directory mtime is (correctly) still zeroed from the +first layer. So... everything up until now is a lie?

+

No! If we pull apart the last tar layer, we'll see that it actually +does contain a directory entry for /foo, even though it's not +modified in any way during the last RUN invocation. I'll skip the +part where I re-exported the image to an oci-dir just to make it +easier to look through the layers. Just trust me when I say this is +the tarball that gets generated for the last layer:

+
⬢ [jeckersb@toolbx sha256]$ tar tvf 9402e1d4a1daea10ff057116f7fc6858be340fd82204eb17db566bfec547a911.tar
+drwxr-xr-x 0/0               0 1969-12-31 19:00 foo/
+drwxr-xr-x 0/0               0 2025-12-10 16:31 foo/bar/
+-rw-r--r-- 0/0               0 2025-12-10 16:31 foo/bar/baz
+

Ok, so /foo is there. But... why? We didn't modify it. Deeper +down the rabbit hole we go.

+

Overlayfs

+

Spoiler: the answer is +overlayfs.

+

The OCI spec defines the image format, but notably it does not +specify any particular implementation details on how to store, manage, +and stitch together the final container image from its individual +layers.

+

In reality, container runtimes such as podman (via +containers-libs, +formerly containers-storage) use the kernel filesystem overlayfs to +stitch together the layers into the final realized view of the world.

+

A RUN invocation in a Containerfile is in a nutshell this series +of steps:

+
    +
  1. Mount the previous layer (and recursively, layers prior to that) +as a lowerdir in an overlayfs filesystem.
    2. +
  2. Perform the RUN invocation in the mounted filesystem.
    3. +
  3. Collect the contents of the resulting upperdir directory. This +becomes the tarball for that layer.
    4. +
+

This process is how we end up with our /foo directory duplicated +into the final layer, even though we did not modify it. We can mock +this out just using an overlay mount and basic commands.

+

First, mock our lower layer, and set the mtime:

+
[root@burd tmp]# mkdir lower upper work merged
+[root@burd tmp]# mkdir -p lower/foo/bar
+[root@burd tmp]# touch -d @0 lower/foo
+[root@burd tmp]# stat lower/foo
+  File: lower/foo
+  Size: 60        	Blocks: 0          IO Block: 4096   directory
+Device: 0,45	Inode: 46858       Links: 3
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Context: unconfined_u:object_r:user_tmp_t:s0
+Access: 1969-12-31 19:00:00.000000000 -0500
+Modify: 1969-12-31 19:00:00.000000000 -0500
+Change: 2025-12-10 16:53:27.174443520 -0500
+ Birth: 2025-12-10 16:53:20.544455919 -0500
+

Next, mount it via overlayfs:

+
[root@burd tmp]# mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work merged
+[root@burd tmp]# cd merged
+[root@burd merged]# stat foo
+  File: foo
+  Size: 60        	Blocks: 0          IO Block: 4096   directory
+Device: 0,90	Inode: 46858       Links: 3
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Context: unconfined_u:object_r:user_tmp_t:s0
+Access: 1969-12-31 19:00:00.000000000 -0500
+Modify: 1969-12-31 19:00:00.000000000 -0500
+Change: 2025-12-10 16:53:27.174443520 -0500
+ Birth: 2025-12-10 16:53:20.544455919 -0500
+

Now we simulate creating the new layer:

+
[root@burd merged]# touch foo/bar/baz
+

Finally we can unmount the overlayfs mount and observe the contents of +the upper dir:

+
[root@burd merged]# cd ..
+[root@burd tmp]# umount merged
+[root@burd tmp]# find upper/
+upper/
+upper/foo
+upper/foo/bar
+upper/foo/bar/baz
+[root@burd tmp]# stat upper/foo
+  File: upper/foo
+  Size: 60        	Blocks: 0          IO Block: 4096   directory
+Device: 0,45	Inode: 46870       Links: 3
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Context: unconfined_u:object_r:user_tmp_t:s0
+Access: 2025-12-10 16:57:20.828001765 -0500
+Modify: 1969-12-31 19:00:00.000000000 -0500
+Change: 2025-12-10 16:56:16.746593313 -0500
+ Birth: 2025-12-10 16:56:16.745126092 -0500
+

So that's where our /foo entry comes from. This behavior is +explained in the overlayfs +documentation:

+
Objects that are not directories (files, symlinks, device-special
+files etc.) are presented either from the upper or lower filesystem as
+appropriate. When a file in the lower filesystem is accessed in a way
+that requires write-access, such as opening for write access, changing
+some metadata etc., the file is first copied from the lower filesystem
+to the upper filesystem (copy_up). Note that creating a hard-link also
+requires copy_up, though of course creation of a symlink does not.
+
+The copy_up may turn out to be unnecessary, for example if the file is
+opened for read-write but the data is not modified.
+
+The copy_up process first makes sure that the containing directory
+exists in the upper filesystem - creating it and any parents as
+necessary. It then creates the object with the same metadata (owner,
+mode, mtime, symlink-target etc.) and then if the object is a file,
+the data is copied from the lower to the upper filesystem. Finally any
+extended attributes are copied up.
+

Since the content of the layer tarball is taken directly from the +upper, we end up getting a copy of /foo via this process.

+

Where do we go from here?

+

Hopefully I have explained the situation adequately and this all makes +sense. I have achieved some amount of inner peace that comes with +reaching understanding.

+

However... I still don't like it. I think we can do better.

+

Here's the thing for bootc: in our rechunked images, I don't want to +include the same directories over and over again in every single +layer. It shouldn't be necessary, and by strict reading of the OCI +spec we shouldn't do that if the directories are unchanged (which +they aren't).

+

But in the current state of the world, if we don't duplicate those +entries into every layer, we end up with non-deterministic directory +metadata when our OCI image is mounted and viewed through the lens of +overlayfs. This is fundamentally broken as we move bootc into a +future where +composefs and +fsverity are used +to harden and validate images. Ideally a container image should be +able to measure its own fsverity hash in a reproducible manner. Today +that is not possible.

+

So the following is what I've done as a proof-of-concept (a huge +motivation for writing this post in the first place was to +exhaustively explain my justification for why this is needed). I've +written and tested a patch (still needs refining before submitting) +for overlayfs which does the following:

+
    +
  • Adds a new feature passthrough (naming bikeshedable) which +functions similarly to the metacopy feature.
    • +
  • Uses the trusted.overlay.passthrough to flag directories as +"structural-only".
    • +
  • When encountering a directory with the xattr, searches through the +lowerdirs until it finds a directory which does not have the xattr +set. The metadata for this layer is used. (If no unflagged +lowerdir is found, it falls back to the current behavior of using +non-deterministic local metadata)
    • +
+

Here's an example. This is similar to our manual overlayfs example +above, except this uses two lower layers to show how unpacking a tar +layer with incomplete directory information might look.

+

First, create our base layer again:

+
[root@fedora ~]# mkdir upper merged work
+[root@fedora ~]# mkdir -p base_layer/foo/bar
+[root@fedora ~]# touch -d @0 base_layer/foo
+

Then, in our second layer we create the baz file. This time we set +the passthrough xattr on /foo, which is how I envision this all +working when a container storage engine unpacks a tar archive with +incomplete parent directory information. Ideally this layer should +include a tar entry for foo/bar/baz and (arguably) foo/bar since +the directory metadata for bar should be updated to reflect the +addition of bar. But it definitely should not include an entry +for foo/:

+
[root@fedora ~]# mkdir -p second_layer/foo/bar
+[root@fedora ~]# touch second_layer/foo/bar/baz
+[root@fedora ~]# setfattr -n trusted.overlay.passthrough second_layer/foo
+

Now let's mount it with the patched overlayfs. First, we'll specify +passthrough=off to show the existing behavior:

+
[root@fedora ~]# mount -t overlay overlay -o upperdir=upper,lowerdir=second_layer:base_layer,workdir=work,passthrough=off merged
+[root@fedora ~]# stat merged/foo
+  File: merged/foo
+  Size: 6               Blocks: 0          IO Block: 4096   directory
+Device: 0,59    Inode: 365132      Links: 1
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Context: unconfined_u:object_r:admin_home_t:s0
+Access: 2025-12-10 17:33:32.787147889 -0500
+Modify: 2025-12-10 17:33:32.787147889 -0500
+Change: 2025-12-10 17:34:01.701054010 -0500
+ Birth: 2025-12-10 17:33:32.787147889 -0500
+

Here the foo directory has whatever metadata we created for it when +we "unpacked" it with the command mkdir -p second_layer/foo/bar +above. This is what we're trying to avoid.

+

Now let's unmount and remount with passthrough=on:

+
[root@fedora ~]# umount merged
+[root@fedora ~]# mount -t overlay overlay -o upperdir=upper,lowerdir=second_layer:base_layer,workdir=work,passthrough=on merged
+[root@fedora ~]# stat merged/foo
+  File: merged/foo
+  Size: 6               Blocks: 0          IO Block: 4096   directory
+Device: 0,59    Inode: 365129      Links: 1
+Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
+Context: unconfined_u:object_r:admin_home_t:s0
+Access: 1969-12-31 19:00:00.000000000 -0500
+Modify: 1969-12-31 19:00:00.000000000 -0500
+Change: 2025-12-10 17:28:12.268740241 -0500
+ Birth: 2025-12-10 17:27:39.158847877 -0500
+

Now we have the metadata for foo being passed through the second +layer and retrieved from the base layer, which is the behavior we +want.

+

Conclusion

+

Ensuring that OCI image layers are able to only ship content that +they've modified will aid reproducibility and help unlock +optimizations by avoiding having derived layers always need to inherit +metadata from their parent. At the current time, however, tooling +creating OCI images should include their parent information in order +to maximize compatibility. We are looking forward to a future where +that's not necessary though!

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2025-july-11-community-meeting/index.html b/blog/2025-july-11-community-meeting/index.html new file mode 100644 index 0000000..0677bd1 --- /dev/null +++ b/blog/2025-july-11-community-meeting/index.html @@ -0,0 +1,242 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Attendees: +
+ + +
+ Agenda: +
+ + +
+ TODO: +
+ + +
+
+ + + +
+ +
+
+ July 11, 2025 + +
+

Attendees:

+
    +
  • Joseph Marrero Corchado (Red Hat, Inc.)
    • +
  • Colin Walters
    • +
  • Robert Sturla (Tesco Bank/Universal Blue)
    • +
  • Laura Santamaria (she/her)
    • +
  • Hristo Marinov
    • +
  • John Eckersberg (Red Hat, Inc.)
    • +
  • Dusty (he/him)
    • +
  • Antheas Kapenekakis (Bazzite)
    • +
  • Mohan
    • +
  • Chris Kyrouac
    • +
  • Gursewak Mangat
    • +
+

Agenda:

+
    +
  • New release status: bootc-dev/bootc#1390 +
      +
    • folks agreed on this
      • +
    +
    • +
  • [Laura] KubeCon NA 2025 Project Pavilion application +
      +
    • November 10-13 - Atlanta, Georgia
      • +
    • Who is going to KubeCon NA 2025 already? +
        +
      • Laura
        • +
      +
      • +
    • We'll get a project pavilion submission scheduled (probably from Joseph or Colin who already submitted a talk)
      • +
    +
    • +
  • Ublue - Collaboration +
      +
    • Folks are joining :)
      • +
    • Robert, Antheas from the Ublue community
      • +
    • Colin would like to do 1:1s +
        +
      • dustymabe: an office hours like set time could help facilitate this (+1 - Laura)
        • +
      +
      • +
    +
    • +
  • rechunker alignment
    • +
  • progress-fd
    • +
  • systemd-sysext frontend +
      +
    • Motivated by combinatorial explosion of gnome|kde * nvidia|amd * surface|framework|lenovo
      • +
    • discussion of downsides of systemd-sysext as defined today, vs
      • +
    +
    • +
+

TODO:

+
    +
  • +Put project pavilion application
    • +
  • +Keep smaller, more focused meetings
    • +
+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2025-july-18-community-meeting/index.html b/blog/2025-july-18-community-meeting/index.html new file mode 100644 index 0000000..62ced9a --- /dev/null +++ b/blog/2025-july-18-community-meeting/index.html @@ -0,0 +1,253 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Attendees: +
+ + +
+ Agenda: +
+ + +
+ TODO: +
+ + +
+
+ + + +
+ +
+
+ July 18, 2025 + +
+

Attendees:

+
    +
  • Laura Santamaria (she/her; Red Hat)
    • +
  • Hristo Marinov
    • +
  • Fernando Lozano
    • +
  • Colin Walters (he/him; Red Hat)
    • +
  • Joseph Marrero Corchado (Red Hat, Inc.)
    • +
  • Matteo Piccinini (n/a)
    • +
  • Robert Sturla (Tesco Bank)
    • +
  • Dusty Mabe
    • +
  • Chris Kyrouac
    • +
  • Gursewak Mangat
    • +
  • John Eckersberg (Red Hat, Inc.)
    • +
+

Agenda:

+
    +
  • Release 1.5.1 +
      +
    • Thanks @robert!
      • +
    +
    • +
  • [Laura] project pavilion update? +
      +
    • Request form due Monday, shouldn't block on travel
      • +
    • Let's do it live
      • +
    • ✅
      • +
    +
    • +
  • [Laura] Static site generation for landing page + +
    • +
  • [Colin] QMU banned contributions from AI. Want to talk about it. Contribution policy? +
      +
    • Thoughts?
      • +
    • Require use of <Assisted-by> tag to identify model/tool
      • +
    • Errant AI comment contributed to recent bug
      • +
    • [John] +1 on attribution
      • +
    • [Dusty] do we want to limit, or allow? +
        +
      • [Colin] has a pretty big impact, so want to know what folks think
        • +
      +
      • +
    • [Joseph] note in readme or contributing section makes sense. Maybe have a bot that highlights that on PR? People probably won't say anything because part of workflow
      • +
    • [Dusty] Can't prevent, but policy. Any examples of wasted time on clearly generated by AI PR +
        +
      • [Colin] Can tell 90% of the time. Most modern foundational models love bulleted lists, so it's obvious. Kinda wacky to put md doc in top level of repo for PR
        • +
      • [Laura] gave overview from OSPO and the other container group discussion
        • +
      +
      • +
    • [Colin] Will open a discussion
      • +
    +
    • +
+

TODO:

+
    +
  • +Laura to explore adding logos to PR.
    • +
  • +Laura to add GitHub Actions for publication
    • +
  • +Look for info on domain handling for static site
    • +
  • +Colin to open a discussion about the AI assisted PRs
    • +
  • +Laura to find and share the public Containers Cabal recording
    • +
+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-jul-07-conference-talks-devconf-flock-2026/index.html b/blog/2026-jul-07-conference-talks-devconf-flock-2026/index.html new file mode 100644 index 0000000..bef0e94 --- /dev/null +++ b/blog/2026-jul-07-conference-talks-devconf-flock-2026/index.html @@ -0,0 +1,254 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ bootc ecosystem at DevConf.CZ and Flock to Fedora 2026 +
+ + +
+ - DevConf.CZ 2026 +
+ +
+ - Flock to Fedora 2026 +
+ + + +
+
+ + + +
+ +
+
+ July 07, 2026 + + by + + + + + +
+

bootc ecosystem at DevConf.CZ and Flock to Fedora 2026

+

June was a busy month for the bootc community, with back-to-back +conferences in the Czech Republic: Flock to +Fedora (June 14-16, Prague) +and DevConf.CZ (June 18-19, Brno). +Both featured a strong presence of talks covering bootc, image-mode +systems, and the broader ecosystem. Here's a roundup of the +recordings and resources.

+

DevConf.CZ 2026

+

The full DevConf.CZ 2026 schedule +(including slides) is available on pretalx. Individual talk recordings +are on the DevConf YouTube channel.

+

Hardening OS Distribution: Verifiable and sealed OS with bootc and composefs +(Colin Walters, 35 min) — Covers the shift toward OCI-native OS +delivery using bootc and composefs, including a demo of deploying a +sealed UKI composefs-backed system on RHEL 10.2. Related to the +sealed images blog series +here on bootc.dev.

+

These bootc are made for mailin' +(Michael Scherer, 36 min) — A practical walkthrough of combining bootc +and Fedora Image Mode with the Stalwart mail server for a low-maintenance, +self-hosted email stack running on the cheapest possible VM.

+

Local package layering on bootc systems with DNF5 +(Evan Goode, 26 min) — Explores the challenge of making dnf install +work on immutable bootc systems, introducing dnf rebuild, a new DNF5 +plugin that reconciles imperative package management with declarative +container workflows.

+

Foreman, Katello and bootable containers +(Adam Růžička, 35 min) — How Foreman and Katello enable fleet +management across both traditional package-mode and the new image-mode +approach, from image building through operational management.

+

Applying CI/CD Patterns to Image Mode for RHEL +(Alessandro Rossi, 27 min) — Practical examples of applying CI/CD +practices to Image Mode for RHEL using Tekton, GitHub Actions, GitLab +CI, Jenkins, and Ansible Automation Platform.

+

Flock to Fedora 2026

+

Flock sessions were recorded as room-level livestreams on the +Fedora Project YouTube channel. +Individual talk pages on the +Flock schedule +link to slides and other resources.

+

The Future of Fedora Atomic: Unifying on Bootc and Shared Infrastructure +(Hristo Marinov, BoF, 1h40) — A collaborative session discussing the +roadmap for migrating Fedora Atomic deliverables (Silverblue, CoreOS, +etc.) to a bootc-based workflow, covering architectural shifts and +build infrastructure changes.

+

Fedora bootc: Building and Operating Image-Based Systems +(Gursewak Mangat, 25 min; +slides) +— A practical introduction to bootc for Fedora contributors, +demonstrating how bootc's container-native approach makes it easy to +test OS images in CI using standard container tooling (BCVK) before +deploying to production.

+

From Compliance to Containers: Managing Fedora Fleets in the Atomic Era +(Adam Baali and Jonathan Billings, 55 min) — Bridging compliance +requirements with immutable image-based systems like Silverblue, +Kinoite, and bootc, demonstrating transparent tooling for NIST +controls.

+

What's new in Fedora CoreOS in 2026? +(Jean-Baptiste Trystram and Joel Capitao, 25 min) — Highlights from +the past year of Fedora CoreOS development, including OCI distribution +migration, bootc integration progress, and the move to +bootc-image-builder.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-jun-05-transient-root-etc-var/index.html b/blog/2026-jun-05-transient-root-etc-var/index.html new file mode 100644 index 0000000..203c1cb --- /dev/null +++ b/blog/2026-jun-05-transient-root-etc-var/index.html @@ -0,0 +1,203 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Video: sealed bootc with transient /etc and /var +
+ + +
+
+ + + +
+ +
+
+ June 05, 2026 + + by + + + + + +
+

Video: sealed bootc with transient /etc and /var

+

I recorded a short demo of the new composefs mount configuration +support that landed in bootc#2201.

+

Video: sealed bootc with transient /etc and /var

+

The PR adds a /usr/lib/bootc/setup-root-conf.toml file that image +authors can ship in their container image to control how the +composefs-backed root filesystem is mounted at boot:

+
    +
  • [root] transient = true wraps the composefs lower in a tmpfs +overlay, so all writes to / are discarded on reboot.
    • +
  • [etc] mount = "transient"|"overlay"|"bind"|"none" controls how +/etc is mounted from the deployment state directory.
    • +
  • [var] mount = "none"|"bind" controls whether /var is +bind-mounted from persistent state. When set to none, /var is left as an +empty composefs directory, and systemd.volatile=state on the +kernel command line causes bootc to automatically skip the bind-mount +so systemd can place a fresh tmpfs there.
    • +
+

This builds directly on the +sealed images series: +with a transient root and /etc, each boot starts from a clean, +verified image with no persistent mutation to the OS layer.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-may-04-sealed-images-security-chain/index.html b/blog/2026-may-04-sealed-images-security-chain/index.html new file mode 100644 index 0000000..00db4c4 --- /dev/null +++ b/blog/2026-may-04-sealed-images-security-chain/index.html @@ -0,0 +1,335 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Sealed images: the security chain from firmware to filesystem +
+ + +
+ - The gap +
+ +
+ - Secure Boot +
+ +
+ - Unified Kernel Images +
+ +
+ - composefs: EROFS + overlayfs + fs-verity +
+ +
+ - Putting it all together +
+ +
+ - What sealed images cover +
+ +
+ - What's next +
+ + + +
+
+ + + +
+ +
+
+ May 04, 2026 + + by + + + + + +
+

Sealed images: the security chain from firmware to filesystem

+

This is the first in a series of posts about bootc sealed images. In +this post we'll take a tour through the full security chain that makes +sealed images work, from the moment your system powers on through +every file read at runtime. Future posts will cover key management, +building sealed images, and deploying them to various environments.

+

The gap

+

Typically a default Linux install comes "unlocked", allowing you to be +root and make persistent changes. While many distributions support +Secure Boot, it's typically only the kernel that's signed. The +cryptographic chain of trust from firmware doesn't cover the root +filesystem or applications - i.e. effectively everything you care +about.

+

Sealed images help close this gap by extending cryptographic +verification from the firmware all the way through every file in the +operating system. Not as a one-time check at boot, but continuously, +at every file read, for the entire lifetime of the system.

+

Let's walk through how each piece fits together.

+

Secure Boot

+

Secure Boot is the foundation of the chain. It's a UEFI firmware +feature that ensures only signed code runs during the boot process.

+

The firmware maintains a database of trusted keys. When the system +powers on, the firmware loads the bootloader and checks its signature +against those keys. If the signature is valid, the bootloader runs. +If not, the system refuses to boot.

+

This is well-established technology and not new to sealed images. +What matters for our purposes is that Secure Boot gives us a root of +trust: a guarantee that the first piece of software to execute after +the firmware is something we explicitly chose to trust.

+

Unified Kernel Images

+

Traditionally, the boot chain after Secure Boot looks something like +this: the signed bootloader loads a kernel, an initramfs, and a kernel +command line, often from separate files on a boot partition. The +bootloader may verify the kernel's signature, but the initramfs and +command line are typically not covered by any signature.

+

A Unified Kernel Image (UKI) +changes this by bundling the kernel, the initramfs, and the kernel +command line into a single EFI binary. The entire bundle is signed +as one unit. This means the firmware (or a signed bootloader like +systemd-boot) can verify the whole thing in one step.

+

This is important for sealed images because the kernel command line +is no longer an unverified input. Anything embedded in the command +line is covered by the same signature that covers the kernel itself. +As we'll see next, this is where the composefs digest lives.

+

composefs: EROFS + overlayfs + fs-verity

+

Here's where things get interesting. composefs brings together +three kernel technologies to provide cryptographic verification of +the entire filesystem.

+

When a sealed image is built, the operating system filesystem is +processed into an +EROFS metadata +image. This image describes every file, directory, symlink, and +permission in the tree, but it does not contain the actual file +contents. Instead, each file entry in the EROFS image records the +fs-verity +digest of that file's contents. The actual file data is stored +separately in a content-addressed object store, where each file has +fs-verity enabled by the kernel.

+

At mount time, the kernel stitches these pieces together using +overlayfs. +The EROFS image serves as a metadata layer, and the object store +provides the file data. The overlayfs verity=require mount option +tells the kernel to enforce that every file served through the mount +has an fs-verity digest matching what the EROFS metadata expects.

+

fs-verity itself is a kernel feature that provides per-file integrity +verification. When fs-verity is enabled on a file, the kernel +computes a cryptographic hash of the file's contents and stores a +hash tree alongside the file on disk. From that point on, every +read is verified at the block level -- the kernel checks only the +blocks being read, not the entire file, and caches the results so +repeated reads don't pay the cost again.

+

A key behavior to understand is what happens when verification +fails: the kernel returns an I/O error. The corrupted or tampered +data is never served to any process. The open() call on the file +succeeds (the file exists, after all), but read() on the corrupted +portion returns EIO. The data is simply unreadable.

+

The EROFS metadata image itself also has an fs-verity digest: a +single cryptographic hash that covers the complete filesystem +description. This is the composefs digest. It is embedded in the +UKI's kernel command line:

+
composefs=abc123def456...  (128-character SHA-512 hex digest)
+

Because the UKI is signed, this digest is now part of the verified +boot chain. The firmware verifies the UKI signature, and the UKI +carries within it a cryptographic commitment to the exact filesystem +that should be mounted as the operating system.

+

Putting it all together

+

The full chain looks like this. Each step must succeed before the +next can proceed:

+
    +
  1. The firmware verifies the signed bootloader.
    2. +
  2. The bootloader verifies the signed Unified Kernel Image (UKI).
    3. +
  3. The initramfs (inside the verified UKI) reads the composefs +digest from the kernel command line (also inside the verified UKI).
    4. +
  4. The initramfs mounts the composefs image and verifies the EROFS +image's fs-verity digest matches the digest from the command line.
    5. +
  5. Every subsequent file read from the operating system is +individually verified by the kernel against the fs-verity digest +recorded in the EROFS metadata.
    6. +
+

There is no point after firmware where unverified code executes or +unverified data is served. The chain is continuous.

+

What sealed images cover

+

It's worth being precise about scope. The seal covers every file in +the immutable operating system image: the base OS, any packages you +added, your monitoring agents, security tools, application binaries. +Everything that was part of the image when it was built is sealed.

+

By default, /etc and /var are mutable and persistent. It is +possible to make /etc transient today, and this is a good idea if +it matches your use case. More suggestions on this will be in the +documentation.

+

What's next

+

This post covered the architecture. In the next posts, we'll get +hands-on:

+
    +
  • Key management: generating Secure Boot keys, enrolling them, +and understanding the signing chain
    • +
  • Building sealed images: writing a Containerfile, producing a +signed UKI, and verifying the result
    • +
  • Deploying sealed images: installing to bare metal, virtual +machines, and cloud environments
    • +
+

The signing chain is fully under your control. You generate the keys, +you sign the images, you decide what your systems trust. The next +post will show you how.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-may-05-sealed-images-key-management/index.html b/blog/2026-may-05-sealed-images-key-management/index.html new file mode 100644 index 0000000..21dfc88 --- /dev/null +++ b/blog/2026-may-05-sealed-images-key-management/index.html @@ -0,0 +1,368 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Sealed images: key management for Secure Boot +
+ + +
+ - The UEFI Secure Boot key hierarchy +
+ +
+ - Generating keys +
+ +
+ - Signing boot artifacts +
+ +
+ - Enrolling keys into firmware +
+ +
+ - Key security considerations +
+ +
+ - What's next +
+ + + +
+
+ + + +
+ +
+
+ May 05, 2026 + + by + + + + + +
+

Sealed images: key management for Secure Boot

+

In the previous post, +we walked through the security chain that sealed images provide, from +firmware through runtime file verification. That chain depends on +cryptographic keys at every step. In this post, we'll cover the keys +involved, how to generate them, and how they get enrolled into your +system's firmware.

+

The UEFI Secure Boot key hierarchy

+

UEFI Secure Boot uses a hierarchy of three key types, each serving a +distinct role:

+

Platform Key (PK) -- The root of the Secure Boot trust hierarchy. +There is exactly one PK. The PK controls who can modify the Secure +Boot key databases. It is used to sign updates to the KEK database. +When the PK is enrolled, the firmware transitions from Setup Mode to +User Mode, enabling Secure Boot enforcement.

+

Key Exchange Key (KEK) -- One or more KEKs can be enrolled. A KEK +is authorized to sign updates to the signature database (db). The +KEK exists to allow delegation: the PK owner can authorize other +parties to manage the set of trusted signing keys without giving them +full control over the Secure Boot configuration.

+

Signature Database (db) -- The db contains the keys or hashes +that the firmware uses to verify boot binaries. When the firmware +loads a bootloader or UKI, it checks the binary's signature against +the keys in the db. If the signature matches a db entry, the binary +is allowed to execute.

+

In practice, many organizations will only need to generate a single +set of these keys. The db key is the one that does the day-to-day +work: it signs your UKIs and bootloader. The PK and KEK exist +primarily to control who can modify the db.

+

If you already have Secure Boot keys provisioned in your +infrastructure, you don't need to generate new ones. You only need +access to a db key (or the ability to add your signing key to the +existing db) in order to sign your UKIs. The rest of this post +assumes you're starting from scratch, but the signing steps apply +regardless of where your keys came from.

+

Generating keys

+

The following commands generate a complete set of Secure Boot keys. +These examples use openssl directly, but you should use whatever +key management practices are appropriate for your organization. +Hardware security modules (HSMs), vault systems, or other key +management infrastructure may be more appropriate for production +use.

+

First, generate a GUID to identify the key owner. This is embedded +in the key enrollment data and can be any unique identifier:

+
$ uuidgen --random > GUID.txt
+

Generate the Platform Key:

+
$ openssl req -newkey rsa:2048 -nodes -keyout PK.key \
+    -new -x509 -sha256 -days 3650 \
+    -subj '/CN=My Platform Key/' -out PK.crt
+$ openssl x509 -outform DER -in PK.crt -out PK.cer
+

Generate the Key Exchange Key:

+
$ openssl req -newkey rsa:2048 -nodes -keyout KEK.key \
+    -new -x509 -sha256 -days 3650 \
+    -subj '/CN=My Key Exchange Key/' -out KEK.crt
+$ openssl x509 -outform DER -in KEK.crt -out KEK.cer
+

Generate the Signature Database key:

+
$ openssl req -newkey rsa:2048 -nodes -keyout db.key \
+    -new -x509 -sha256 -days 3650 \
+    -subj '/CN=My Signature Database Key/' -out db.crt
+$ openssl x509 -outform DER -in db.crt -out db.cer
+

Each command produces three files: a private key (.key), a PEM +certificate (.crt), and a DER-encoded certificate (.cer). The +private keys are what you need to protect. The certificates are +public and are what gets enrolled into the firmware.

+

Signing boot artifacts

+

With a db key in hand, you can sign the two boot binaries that need +Secure Boot verification: the bootloader (systemd-boot) and the +Unified Kernel Image.

+

Signing systemd-boot:

+
$ sbsign --key db.key --cert db.crt \
+    --output systemd-bootx64.efi.signed \
+    /usr/lib/systemd/boot/efi/systemd-bootx64.efi
+

The UKI signing process is more involved because the UKI embeds the +composefs digest, which must be computed from the filesystem first. +We'll cover building sealed images (including UKI generation and +signing) in detail in the next post. For now, the important thing +to know is that ukify (the tool that assembles UKIs) accepts the +same --secureboot-private-key and --secureboot-certificate +options and uses sbsign under the hood to sign the final EFI +binary.

+

Enrolling keys into firmware

+

The keys need to be enrolled into the UEFI firmware's Secure Boot +database before the firmware will use them for verification. There +are several ways to do this depending on your environment.

+

Manual enrollment via firmware setup

+

Most UEFI firmware implementations provide a setup menu (accessed +during early boot, typically via a key like F2 or Del) where Secure +Boot keys can be managed. The DER-encoded certificates (.cer +files) can be enrolled from a USB drive or the EFI System Partition. +This is straightforward for individual systems but does not scale +well.

+

Programmatic enrollment for virtual machines

+

For virtual machines using OVMF (the open source UEFI firmware for +QEMU/KVM), keys can be enrolled directly into the firmware variable +store using the virt-fw-vars tool from the +virt-firmware project:

+
$ GUID=$(cat GUID.txt)
+$ virt-fw-vars \
+    --input /usr/share/edk2/ovmf/OVMF_VARS.fd \
+    --secure-boot \
+    --set-pk  $GUID PK.crt \
+    --add-kek $GUID KEK.crt \
+    --add-db  $GUID db.crt \
+    -o OVMF_VARS_ENROLLED.fd
+

This produces a firmware variable store with your keys pre-enrolled. +When QEMU starts with this variable store, Secure Boot is active and +will only accept binaries signed with your db key. This is +particularly useful for testing and for VM-based deployments where +you control the firmware image.

+

Auto-enrollment via systemd-boot

+

systemd-boot supports automatic key enrollment when the firmware is +in Setup Mode (no Platform Key enrolled). This works by placing +signed UEFI authenticated variable files (.auth files) on the EFI +System Partition.

+

Creating .auth files requires converting your certificates into +UEFI signature lists and signing them with the appropriate parent +key:

+
$ GUID=$(cat GUID.txt)
+$ attr=NON_VOLATILE,RUNTIME_ACCESS,BOOTSERVICE_ACCESS,TIME_BASED_AUTHENTICATED_WRITE_ACCESS
+
+# Create EFI signature lists
+$ sbsiglist --owner $GUID --type x509 --output PK.esl PK.cer
+$ sbsiglist --owner $GUID --type x509 --output KEK.esl KEK.cer
+$ sbsiglist --owner $GUID --type x509 --output db.esl db.cer
+
+# Sign the variables (PK and KEK signed by PK, db signed by KEK)
+$ sbvarsign --attr $attr --key PK.key --cert PK.crt --output PK.auth PK PK.esl
+$ sbvarsign --attr $attr --key PK.key --cert PK.crt --output KEK.auth KEK KEK.esl
+$ sbvarsign --attr $attr --key KEK.key --cert KEK.crt --output db.auth db db.esl
+

These .auth files can then be placed on the ESP where systemd-boot +expects them. bootc can automate this: if you place the .auth +files in your container image at +/usr/lib/bootc/install/secureboot-keys/<name>/, bootc will copy +them to the ESP during installation. On the next boot, systemd-boot +can enroll them into the firmware.

+

The enrollment behavior is controlled by the secure-boot-enroll +setting in loader.conf. See the +systemd-boot documentation +for details on the available modes.

+

Key security considerations

+

A few things worth keeping in mind:

+

Protect your private keys. The .key files are what allow +signing boot artifacts. Anyone with access to your db private key +can sign binaries that your firmware will trust. Store private keys +with appropriate access controls, and consider using an HSM or key +management system for production deployments.

+

Key rotation. The examples above use 10-year expiry (-days 3650), which is generous. Plan for key rotation before your +certificates expire. The UEFI key hierarchy makes this manageable: +you can use your KEK to authorize a new db key without needing to +re-enroll the PK.

+

Separation of concerns. In a CI/CD pipeline, the signing step +should ideally be isolated from the build step. The build process +produces an unsigned UKI, and a separate signing service (with access +to the private key) signs it. This limits the blast radius if the +build environment is compromised.

+

What's next

+

With keys generated and an understanding of how they fit into the +trust chain, the next post will walk through building a sealed image +end-to-end: writing a Containerfile, computing the composefs digest, +generating and signing the UKI, and producing a deployable container +image.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-may-06-sealed-images-building/index.html b/blog/2026-may-06-sealed-images-building/index.html new file mode 100644 index 0000000..39643bd --- /dev/null +++ b/blog/2026-may-06-sealed-images-building/index.html @@ -0,0 +1,343 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Sealed images: building a sealed image +
+ + +
+ - The chicken-and-egg problem +
+ +
+ - The Containerfile +
+ +
+ - Building the image +
+ +
+ - Secret handling in CI +
+ +
+ - What's next +
+ + + +
+
+ + + +
+ +
+
+ May 06, 2026 + + by + + + + + +
+

Sealed images: building a sealed image

+

In the first post +we covered the security chain behind sealed images, and in the +second post we +generated the Secure Boot keys needed to sign our boot artifacts. +Now it's time to put it all together and build a sealed image.

+

A complete working example is available in the +rhel-bootc-examples +repository under the +sealing +directory. This post walks through the key concepts behind that +example and explains why the build is structured the way it is.

+

The chicken-and-egg problem

+

Building a sealed image has a complication that isn't immediately +obvious. Recall from the first post that the composefs digest is +embedded in the UKI's kernel command line, and the UKI lives in the +image under /boot. So we have a dependency cycle: we need the +filesystem to compute the composefs digest, but we need the digest +to produce the UKI, and we need the UKI to finalize the filesystem.

+

The solution is a multi-stage container build. We build the base +filesystem first, without any UKI. Then in a separate stage, we +compute the composefs digest from that filesystem, generate and +sign the UKI, and finally layer the UKI back on top of the base. +The UKI lives under /boot, which is not part of the composefs- +managed root filesystem, so adding it doesn't change the digest.

+

The Containerfile

+

The +Containerfile +in the examples repository uses four stages. Let's walk through +each one.

+

Stage 1: rootfs-builder

+
FROM quay.io/centos-bootc/centos-bootc:stream10 AS rootfs-builder
+
+RUN dnf install -y \
+    epel-release \
+    systemd-boot-unsigned \
+    systemd-ukify \
+    sbsigntools
+
+RUN dnf remove -y bootupd
+

This starts from a CentOS Stream 10 bootc base image and installs +the tooling we need: systemd-ukify to build the UKI, +sbsigntools to sign it, and systemd-boot-unsigned to provide +the bootloader binary. We remove bootupd because this example +uses systemd-boot rather than bootupd + GRUB.

+

This stage also signs systemd-boot with our db key:

+
RUN --mount=type=secret,id=secureboot_key \
+    --mount=type=secret,id=secureboot_cert <<EOF
+sbsign --key /run/secrets/secureboot_key \
+    --cert /run/secrets/secureboot_cert \
+    --output /tmp/systemd-bootx64.efi \
+    /usr/lib/systemd/boot/efi/systemd-bootx64.efi
+install -m 0644 /tmp/systemd-bootx64.efi \
+    /usr/lib/systemd/boot/efi/systemd-bootx64.efi
+EOF
+

Note the use of --mount=type=secret. The private key is mounted +into the build step but is never copied into any image layer. This +is how we keep key material out of the final image.

+

Stage 2: flatten to a single layer

+
FROM scratch AS base
+COPY --from=rootfs-builder / /
+LABEL containers.bootc 1
+LABEL ostree.bootable 1
+

This stage copies the entire filesystem from stage 1 into a FROM scratch image, which flattens everything into a single layer. +This is important because the composefs digest is computed over +the complete filesystem tree. If the image had multiple layers, +the digest would depend on how those layers happened to be stacked, +which could vary depending on the container runtime and storage +driver. (For more on why multi-layer images can produce +non-deterministic results, see the earlier post on +pitfalls of incomplete tar archives.) +Flattening eliminates that variable.

+

Stage 3: generate and sign the UKI

+
FROM base AS kernel
+RUN --mount=type=bind,from=base,target=/target \
+    --mount=type=secret,id=secureboot_key \
+    --mount=type=secret,id=secureboot_cert <<EOF
+bootc container ukify --rootfs /target \
+    -- \
+    --signtool sbsign \
+    --secureboot-private-key /run/secrets/secureboot_key \
+    --secureboot-certificate /run/secrets/secureboot_cert \
+    --output /out/uki.efi
+EOF
+RUN kver=$(bootc container inspect --json | jq -r '.kernel.version') && \
+    mkdir -p /boot/EFI/Linux && \
+    mv /out/uki.efi "/boot/EFI/Linux/${kver}.efi"
+

This is where the magic happens. bootc container ukify does +several things in one step:

+
    +
  1. Reads the filesystem at /target (the flattened base from +stage 2, mounted via --mount=type=bind).
    2. +
  2. Computes the composefs digest (a SHA-512 hash of the EROFS +image that describes the complete filesystem).
    3. +
  3. Discovers the kernel and initramfs from the filesystem.
    4. +
  4. Assembles a UKI containing the kernel, initramfs, and a +command line that includes composefs=<digest>.
    5. +
  5. Signs the UKI with the db key via sbsign.
    6. +
+

The result is a single .efi file that embeds a cryptographic +commitment to the exact filesystem it was built from, signed by +a key we control.

+

A second RUN step then discovers the kernel version and places +the UKI at the expected path under /boot/EFI/Linux/.

+

Stage 4: the final image

+
FROM base
+COPY --from=kernel /boot /boot
+

The final image takes the flattened base and overlays the /boot +directory from the kernel stage. This gives us a complete image: +the sealed root filesystem plus the signed UKI that references it.

+

Building the image

+

With the Containerfile and keys in place, building the image is a +single podman build command:

+
$ podman build \
+    --secret id=secureboot_key,src=target/keys/sb-db.key \
+    --secret id=secureboot_cert,src=target/keys/sb-db.crt \
+    -t localhost/sealed-host:latest \
+    .
+

The two --secret flags make the db private key and certificate +available to the build stages that need them, without ever +persisting them in the image.

+

If you're using the examples repository, the +Justfile +wraps this for convenience:

+
$ just keygen   # generate keys (one-time)
+$ just build    # build the sealed image

Secret handling in CI

+

The examples repository includes a GitHub Actions workflow +that demonstrates how to handle key material in CI. The db private +key is stored as a GitHub Actions secret and written to a temporary +file during the build.

+

For pull request builds, where the secret is not available, the +workflow generates an ephemeral key pair on the fly. This allows +PRs to validate that the build works without requiring access to +production key material.

+

What's next

+

At this point we have a sealed, signed container image. The UKI +inside is signed with our Secure Boot key and embeds a composefs +digest that covers every file in the operating system. In the +next post, we'll deploy this image to a system and verify the +seal is active.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/2026-may-07-sealed-images-deploying/index.html b/blog/2026-may-07-sealed-images-deploying/index.html new file mode 100644 index 0000000..324cd08 --- /dev/null +++ b/blog/2026-may-07-sealed-images-deploying/index.html @@ -0,0 +1,314 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+
+ +
+ Sealed images: deploying and verifying a sealed image +
+ + +
+ - bcvk: a tool for running bootc VMs +
+ +
+ - Deploying the image +
+ +
+ - Verifying the seal +
+ +
+ - What happens if something is tampered with? +
+ +
+ - Conclusion +
+ + + +
+
+ + + +
+ +
+
+ May 07, 2026 + + by + + + + + +
+

Sealed images: deploying and verifying a sealed image

+

In the previous post +we built a sealed, signed container image. Now it's time to deploy +it to a virtual machine and verify that the full security chain is +active.

+

bcvk: a tool for running bootc VMs

+

bcvk (bootc virtualization kit) +is a tool that makes it easy to run bootc container images as virtual +machines. Under the hood, it calls bootc install to-disk to create +a bootable disk image, then manages the VM lifecycle via libvirt. +For sealed images, bcvk also handles Secure Boot key enrollment into +the VM's UEFI firmware automatically using +virt-firmware.

+

bcvk is available as a package on Fedora and EPEL:

+
$ dnf install bcvk

Deploying the image

+

With the sealed image built from the previous post and keys generated +from the key management post, deploying is a single command:

+
$ bcvk libvirt run \
+    --ssh-wait \
+    --name sealed-demo \
+    --filesystem=ext4 \
+    --secure-boot-keys target/keys \
+    localhost/sealed-host:latest
+

Let's break down what's happening here:

+
    +
  • --filesystem=ext4 tells bootc install to use ext4 for the root +filesystem. The default root filesystem may be XFS, which does not +support fs-verity, so we explicitly select ext4 here. (fs-verity +is supported on ext4 and btrfs.)
    • +
  • --secure-boot-keys target/keys points bcvk to the directory +containing our PK, KEK, and db certificates. bcvk uses +virt-fw-vars to enroll these keys into a copy of the OVMF +firmware variable store, so the VM boots with Secure Boot enabled +and configured to trust our signing key.
    • +
  • --ssh-wait tells bcvk to wait until SSH is available before +returning, so we know the system has fully booted.
    • +
+

If you're using the +examples repository, +this is wrapped up in a convenient just recipe:

+
$ just bcvk-ssh
+

This builds the image, boots the VM, waits for it to reach +multi-user.target, and opens an interactive SSH session.

+

Verifying the seal

+

Once the system is booted and we have an SSH session, we can verify +that the full security chain is active.

+

Check the kernel command line

+
$ cat /proc/cmdline
+composefs=3a7f... (128-character SHA-512 hex digest) rw
+

The presence of composefs=<digest> in the kernel command line +confirms that the initramfs received the composefs digest from the +signed UKI. This is the digest that was computed during the build +and embedded in the UKI's command line section.

+

Check the root mount

+
$ findmnt -t overlay /
+TARGET SOURCE                    FSTYPE  OPTIONS
+/      overlay[/sysroot/state..] overlay ro,relatime,...,verity=require,...
+

The key thing to look for is verity=require in the mount options. +This confirms that the kernel is enforcing fs-verity verification +on every file access through the composefs mount. Any file in the +operating system whose content doesn't match its expected fs-verity +digest will produce an I/O error when read.

+

Check Secure Boot status

+
$ mokutil --sb-state
+SecureBoot enabled
+

This confirms that the firmware verified the bootloader and UKI +signatures before allowing them to execute.

+

What this tells us

+

These three checks together confirm the full chain from the +first post:

+
    +
  1. Secure Boot verified the bootloader and UKI (mokutil --sb-state)
    2. +
  2. The UKI delivered the composefs digest to the initramfs +(/proc/cmdline)
    3. +
  3. The kernel is enforcing per-file verification against that digest +(verity=require)
    4. +
+

What happens if something is tampered with?

+

It's worth understanding why tampering with a sealed system is +difficult in practice.

+

The operating system files are stored in a content-addressed object +store on disk. Each object has fs-verity enabled, which means the +kernel has recorded a cryptographic hash of its contents. The files +are immutable: you cannot write to an fs-verity protected file. Any +attempt to open a verity-protected file for writing will fail.

+

Even if an attacker were to bypass the filesystem and corrupt data +directly on the underlying block device, the kernel would detect +the corruption. When a process attempts to read the tampered file, +the kernel verifies the data against the stored hash before +returning it. If the data doesn't match, the read fails with +EIO. The corrupted data is never served to any process.

+

This is a meaningful distinction from a system where tampered files +are silently served. On a sealed system, corruption doesn't go +unnoticed -- it causes an immediate, visible failure.

+

Conclusion

+

Over the course of this series, we've walked through the complete +lifecycle of a sealed image:

+
    +
  1. The security chain +from firmware to filesystem that makes sealed images possible
    2. +
  2. Key management +for generating and enrolling Secure Boot keys
    3. +
  3. Building a sealed image +with a multi-stage container build
    4. +
  4. Deploying and verifying the seal (this post)
    5. +
+

The complete working example is available in the +rhel-bootc-examples +repository under the +sealing +directory.

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/blog/index.html b/blog/index.html new file mode 100644 index 0000000..353f00d --- /dev/null +++ b/blog/index.html @@ -0,0 +1,179 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ + +
+ + + + + +
+ +

+ Blog +

+ + +
+ + +
+
+ +
+ + + + + + + + diff --git a/elasticlunr.min.js b/elasticlunr.min.js new file mode 100644 index 0000000..79dad65 --- /dev/null +++ b/elasticlunr.min.js @@ -0,0 +1,10 @@ +/** + * elasticlunr - http://weixsong.github.io + * Lightweight full-text search engine in Javascript for browser search and offline search. - 0.9.6 + * + * Copyright (C) 2017 Oliver Nightingale + * Copyright (C) 2017 Wei Song + * MIT Licensed + * @license + */ +!function(){function e(e){if(null===e||"object"!=typeof e)return e;var t=e.constructor();for(var n in e)e.hasOwnProperty(n)&&(t[n]=e[n]);return t}var t=function(e){var n=new t.Index;return n.pipeline.add(t.trimmer,t.stopWordFilter,t.stemmer),e&&e.call(n,n),n};t.version="0.9.5",lunr=t,t.utils={},t.utils.warn=function(e){return function(t){e.console&&console.warn&&console.warn(t)}}(this),t.utils.toString=function(e){return void 0===e||null===e?"":e.toString()},t.EventEmitter=function(){this.events={}},t.EventEmitter.prototype.addListener=function(){var e=Array.prototype.slice.call(arguments),t=e.pop(),n=e;if("function"!=typeof t)throw new TypeError("last argument must be a function");n.forEach(function(e){this.hasHandler(e)||(this.events[e]=[]),this.events[e].push(t)},this)},t.EventEmitter.prototype.removeListener=function(e,t){if(this.hasHandler(e)){var n=this.events[e].indexOf(t);-1!==n&&(this.events[e].splice(n,1),0==this.events[e].length&&delete this.events[e])}},t.EventEmitter.prototype.emit=function(e){if(this.hasHandler(e)){var t=Array.prototype.slice.call(arguments,1);this.events[e].forEach(function(e){e.apply(void 0,t)},this)}},t.EventEmitter.prototype.hasHandler=function(e){return e in this.events},t.tokenizer=function(e){if(!arguments.length||null===e||void 0===e)return[];if(Array.isArray(e)){var n=e.filter(function(e){return null===e||void 0===e?!1:!0});n=n.map(function(e){return t.utils.toString(e).toLowerCase()});var i=[];return n.forEach(function(e){var n=e.split(t.tokenizer.seperator);i=i.concat(n)},this),i}return e.toString().trim().toLowerCase().split(t.tokenizer.seperator)},t.tokenizer.defaultSeperator=/[\s\-]+/,t.tokenizer.seperator=t.tokenizer.defaultSeperator,t.tokenizer.setSeperator=function(e){null!==e&&void 0!==e&&"object"==typeof e&&(t.tokenizer.seperator=e)},t.tokenizer.resetSeperator=function(){t.tokenizer.seperator=t.tokenizer.defaultSeperator},t.tokenizer.getSeperator=function(){return t.tokenizer.seperator},t.Pipeline=function(){this._queue=[]},t.Pipeline.registeredFunctions={},t.Pipeline.registerFunction=function(e,n){n in t.Pipeline.registeredFunctions&&t.utils.warn("Overwriting existing registered function: "+n),e.label=n,t.Pipeline.registeredFunctions[n]=e},t.Pipeline.getRegisteredFunction=function(e){return e in t.Pipeline.registeredFunctions!=!0?null:t.Pipeline.registeredFunctions[e]},t.Pipeline.warnIfFunctionNotRegistered=function(e){var n=e.label&&e.label in this.registeredFunctions;n||t.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},t.Pipeline.load=function(e){var n=new t.Pipeline;return e.forEach(function(e){var i=t.Pipeline.getRegisteredFunction(e);if(!i)throw new Error("Cannot load un-registered function: "+e);n.add(i)}),n},t.Pipeline.prototype.add=function(){var e=Array.prototype.slice.call(arguments);e.forEach(function(e){t.Pipeline.warnIfFunctionNotRegistered(e),this._queue.push(e)},this)},t.Pipeline.prototype.after=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._queue.indexOf(e);if(-1===i)throw new Error("Cannot find existingFn");this._queue.splice(i+1,0,n)},t.Pipeline.prototype.before=function(e,n){t.Pipeline.warnIfFunctionNotRegistered(n);var i=this._queue.indexOf(e);if(-1===i)throw new Error("Cannot find existingFn");this._queue.splice(i,0,n)},t.Pipeline.prototype.remove=function(e){var t=this._queue.indexOf(e);-1!==t&&this._queue.splice(t,1)},t.Pipeline.prototype.run=function(e){for(var t=[],n=e.length,i=this._queue.length,o=0;n>o;o++){for(var r=e[o],s=0;i>s&&(r=this._queue[s](r,o,e),void 0!==r&&null!==r);s++);void 0!==r&&null!==r&&t.push(r)}return t},t.Pipeline.prototype.reset=function(){this._queue=[]},t.Pipeline.prototype.get=function(){return this._queue},t.Pipeline.prototype.toJSON=function(){return this._queue.map(function(e){return t.Pipeline.warnIfFunctionNotRegistered(e),e.label})},t.Index=function(){this._fields=[],this._ref="id",this.pipeline=new t.Pipeline,this.documentStore=new t.DocumentStore,this.index={},this.eventEmitter=new t.EventEmitter,this._idfCache={},this.on("add","remove","update",function(){this._idfCache={}}.bind(this))},t.Index.prototype.on=function(){var e=Array.prototype.slice.call(arguments);return this.eventEmitter.addListener.apply(this.eventEmitter,e)},t.Index.prototype.off=function(e,t){return this.eventEmitter.removeListener(e,t)},t.Index.load=function(e){e.version!==t.version&&t.utils.warn("version mismatch: current "+t.version+" importing "+e.version);var n=new this;n._fields=e.fields,n._ref=e.ref,n.documentStore=t.DocumentStore.load(e.documentStore),n.pipeline=t.Pipeline.load(e.pipeline),n.index={};for(var i in e.index)n.index[i]=t.InvertedIndex.load(e.index[i]);return n},t.Index.prototype.addField=function(e){return this._fields.push(e),this.index[e]=new t.InvertedIndex,this},t.Index.prototype.setRef=function(e){return this._ref=e,this},t.Index.prototype.saveDocument=function(e){return this.documentStore=new t.DocumentStore(e),this},t.Index.prototype.addDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.addDoc(i,e),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));this.documentStore.addFieldLength(i,n,o.length);var r={};o.forEach(function(e){e in r?r[e]+=1:r[e]=1},this);for(var s in r){var u=r[s];u=Math.sqrt(u),this.index[n].addToken(s,{ref:i,tf:u})}},this),n&&this.eventEmitter.emit("add",e,this)}},t.Index.prototype.removeDocByRef=function(e){if(e&&this.documentStore.isDocStored()!==!1&&this.documentStore.hasDoc(e)){var t=this.documentStore.getDoc(e);this.removeDoc(t,!1)}},t.Index.prototype.removeDoc=function(e,n){if(e){var n=void 0===n?!0:n,i=e[this._ref];this.documentStore.hasDoc(i)&&(this.documentStore.removeDoc(i),this._fields.forEach(function(n){var o=this.pipeline.run(t.tokenizer(e[n]));o.forEach(function(e){this.index[n].removeToken(e,i)},this)},this),n&&this.eventEmitter.emit("remove",e,this))}},t.Index.prototype.updateDoc=function(e,t){var t=void 0===t?!0:t;this.removeDocByRef(e[this._ref],!1),this.addDoc(e,!1),t&&this.eventEmitter.emit("update",e,this)},t.Index.prototype.idf=function(e,t){var n="@"+t+"/"+e;if(Object.prototype.hasOwnProperty.call(this._idfCache,n))return this._idfCache[n];var i=this.index[t].getDocFreq(e),o=1+Math.log(this.documentStore.length/(i+1));return this._idfCache[n]=o,o},t.Index.prototype.getFields=function(){return this._fields.slice()},t.Index.prototype.search=function(e,n){if(!e)return[];e="string"==typeof e?{any:e}:JSON.parse(JSON.stringify(e));var i=null;null!=n&&(i=JSON.stringify(n));for(var o=new t.Configuration(i,this.getFields()).get(),r={},s=Object.keys(e),u=0;u0&&t.push(e);for(var i in n)"docs"!==i&&"df"!==i&&this.expandToken(e+i,t,n[i]);return t},t.InvertedIndex.prototype.toJSON=function(){return{root:this.root}},t.Configuration=function(e,n){var e=e||"";if(void 0==n||null==n)throw new Error("fields should not be null");this.config={};var i;try{i=JSON.parse(e),this.buildUserConfig(i,n)}catch(o){t.utils.warn("user configuration parse failed, will use default configuration"),this.buildDefaultConfig(n)}},t.Configuration.prototype.buildDefaultConfig=function(e){this.reset(),e.forEach(function(e){this.config[e]={boost:1,bool:"OR",expand:!1}},this)},t.Configuration.prototype.buildUserConfig=function(e,n){var i="OR",o=!1;if(this.reset(),"bool"in e&&(i=e.bool||i),"expand"in e&&(o=e.expand||o),"fields"in e)for(var r in e.fields)if(n.indexOf(r)>-1){var s=e.fields[r],u=o;void 0!=s.expand&&(u=s.expand),this.config[r]={boost:s.boost||0===s.boost?s.boost:1,bool:s.bool||i,expand:u}}else t.utils.warn("field name in user configuration not found in index instance fields");else this.addAllFields2UserConfig(i,o,n)},t.Configuration.prototype.addAllFields2UserConfig=function(e,t,n){n.forEach(function(n){this.config[n]={boost:1,bool:e,expand:t}},this)},t.Configuration.prototype.get=function(){return this.config},t.Configuration.prototype.reset=function(){this.config={}},lunr.SortedSet=function(){this.length=0,this.elements=[]},lunr.SortedSet.load=function(e){var t=new this;return t.elements=e,t.length=e.length,t},lunr.SortedSet.prototype.add=function(){var e,t;for(e=0;e1;){if(r===e)return o;e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o]}return r===e?o:-1},lunr.SortedSet.prototype.locationFor=function(e){for(var t=0,n=this.elements.length,i=n-t,o=t+Math.floor(i/2),r=this.elements[o];i>1;)e>r&&(t=o),r>e&&(n=o),i=n-t,o=t+Math.floor(i/2),r=this.elements[o];return r>e?o:e>r?o+1:void 0},lunr.SortedSet.prototype.intersect=function(e){for(var t=new lunr.SortedSet,n=0,i=0,o=this.length,r=e.length,s=this.elements,u=e.elements;;){if(n>o-1||i>r-1)break;s[n]!==u[i]?s[n]u[i]&&i++:(t.add(s[n]),n++,i++)}return t},lunr.SortedSet.prototype.clone=function(){var e=new lunr.SortedSet;return e.elements=this.toArray(),e.length=e.elements.length,e},lunr.SortedSet.prototype.union=function(e){var t,n,i;this.length>=e.length?(t=this,n=e):(t=e,n=this),i=t.clone();for(var o=0,r=n.toArray();oD1BD*48&=MJZ$iJOls$fGi^|t_lDEbN~H5z(Qh*{jE?Tf6!K<3Zei& zeH`Me2@K?!#7tUM0RZr&0sw-)007UBsNh2Yz=H(>K1aswi50MP#l0{{?7kP9jw_`g&0LH{!qn41svzr+7BK0Lxv z0stU38+C1WZ3THgGbaZo6LTk13np&|=YJUh0^WR(po4|G35mCZy`vkSw;-A<59TS1vb%*oY)go}xViG@rEfrNxaz}4K6PgPvsCT6H_M-cR@0;e--_&>%ZD*;cfH3YjSk^AFl;@LFRuc%&bf-%>Q4-+-)rXFU9_) z{8zF6yw`tKC-6@gpR$d&g}sirje~`w8>DGM9IPAy|EcExNcrCl{ck0;|F0$gTgv~t zq?nVvldGDuiJ65E>;I_izeWAG-2d9mr{rp50qN3z9rrK${}J~;@(VEk>(&3(%l|cm z|A~c+p%8)q^Z(KZAq1z=BP;+w1Rx_Ws_qRu4S@647)p6pxgfj?1O!>p#hl#m>j)!AG z&dsFUVqRzWgO-f;gKmB+MZ!0<+498;@i!PQhrXe>D0|InmfwA$&cndT9P**k_XmF5Y^Dh)0L=PQ#SRriC; z_*xmP07Fo7!L(HJ;w!|5GS;6hFu|tA1@LmpHL#kXk^IWwi2g5y5xF$^xJpX%GY1?n z95Aq1Aaf3Lx|N)@Z_Adz5%aIf)--!aoXUR++{Gi@VYLAiW~Ld^mL6o3jq zC$-=m#JgMmnC@X;D8zk1ft>KKqD#d1qX}3A2PhWh@mfSZvhFH zTbg;t`32@@SIH(6CT3@6LwBlYHz(boU}eRdMOMGY0*s)$QHtNb-WTFm5`N2_q#WmfEwsv+U1qDE)av5Dc zy%PAf6HZRo>cY>XW3{q6D;oM@hO^8hNd;n1XCh9(AjDUIG+c!5R(V)p&!vhK=^OZ; zfZD9Opy{`}d&F#Gm3I(~Rq`Wq1adrVYH zTbuWQ^|OW#Ds~bsCl}Xfv)$6Jtxm@3;^G3GrTRBB?C(s&-*$%fc$@*wA09fP*I|pr z#W^?1Au1v{QMHI#Ny}o5ffJRw2-JcaaUTS}Aj!zcG&paQWpMhn$fvW2l97>7FmT9| z6_JI@e|=G}_%uv_#F7?cmb;ASfU8GI7y{JL)RfiGXr5nM8Y_{bbiLdHu5|geVi>ed z=UE;Rwn9C^USe*QJIgwE3JO%i{u^$E5d3_=5Snj}AaETt4pi-0BzIlOo+=-ld zTc)S;va=a%Y-|#flE|aL*83A#a49;;uFxM4kT8V#07zyeZpC4r{rvDL3gjBhhEP^| zoNDzuwaEqsBm`N>zB}!z&Tj}J7PJ5I*!t=w?)a`jf>=xn}a-Yel=a^lOIkpOi((GzZCBUReW+vEylyGBj6y<&E4Gs4eZU+B zV`=Zby*=d~%&{7SpSwfC?+Nq0DL>(iMd)y+{{nCkIev(;=bF4dyB~1=>v;ldDqs)N zI+D3&h$9#$;|d+@Oynz`%4AR}Fnvgn-zx|+{PieVSyPiP=yiv9uSB?~e7$7@x^}Uk zGyq%+)e8Kn|6IqOEyA9=ecR%01d*8s8o!peyx}BqD~ACwiahME^SYVujcPQQ^ufwV z;}kW(wp}sTtyg&wU^p*_WESV=D+fNT9qfWbpj_Wyd9CWIzA3tM>$k9Mx)fG z?}>uXQHd};DlfJM=gx9o@LyPStS=^ePo=o1o9X}2c0?HKpDQ1VZ5>GK)_6qI4&jLW zrBnAAQ)t!7D%Ckw1EFMnKH&UR*Vku=L?KKzdb`GU-Tjb+-}WVp=b0Id9bC;+d)XW2 zxIr9HSKA@?&rEEVi6CV@f-bATHeg42YSi)lu_=EE&1zjn9kU@_kbp}UEUI#_e0E6F z&QM%h2D?>-zx#Of76?bI8AIA^mDCu0`aqPOC@)B&BPqE*CSO3Oln zkv|9K+jQA~}Hj5kkq0^{wNnJC;0*yh^sHC8f!rSgP&xQ&U4s(CY z@BSeJB^y+%@|C{$nL<0zTxdmXgZ4iY4`irk9sqv{mnU+QQd60X-j0Qbsib+2j&MEi zVq2e!PtL+Y$s%QnSyZ&Nv^kaBzFK<5pnFS@5-5t%%HLdyoru`yQwKhz7v+Jg?m|ef z)W%%XAo_qD6sXcGdc_)HMvj-jeOJi_Z2)6w} zgufPhE@==<2NXn(B2bnu5BM$^Z>Xa9p?5T=)v;Ye=xIc0BpR3f(}z(x&POtsbXqb- zP6bQwNp)SFvW#$PpsQ)Gm)rvWf@4~+5LD*X<9O9H;S2^21_F!Z!JNq8p|-$M+xr9* zssIh~^R!g*Qf7jhy|Ql!KJG`DS16GAcseT`wV{qpg{esC_hJ9pkfx_oD9^c(?dAAj zO98RZo*U(*;CRSb9l&p~iy+RKIORqp-&~T%(X9a=IFV2hoI^k2<5#f-FD)#LjU?$S zO@hqoxl!5>579RrGq1Ea<2E6!smIuAo%}KT_rvZgFP5>$p@G*1<2YHh$)if}I5icO zX0?ZUz*|SQP{8Q>M|79qiva4n#X#4(2hJT_`|l_B954|Ppob!zQcW3lZYBIlt?uiG zx)XbqgzJ5`4uMV@V`-rzD#b)Z2?^T`;x%-ZK5ryvxVjZjM`bUF1a;SwL5PGepp%*7 zhv4}K{*c)TwLEX#^NttCZ{JNXe;$M!z2P28o3Dtp^oJyt_qt(_2o@#STJ4W#xL)_e zxBEXew7bSWmx;_ExP}y87y%c0D7dGPJ9QureJ$z3yU+i6jUw#^AGV5lxvk_BGKaZ^!|=p z30Da$r@s#-fq}Icn;LMe%Wtn%!YW}#N_RmAKYu5AoGjXnlu?s;Q$|ck`u4gt>Jn1SIJ!t+cM3i(S1hFWCz{O!6JU8oZDyMP5_KDy<-b*dus@|PiEA>bSj!~U3Y zD>w{=Odpafj&0_kqqWUNrtM*K5#800p~NILbq3AAz;3}Vl!cmCU?-5k-7hW{rLl*x ztCp7Kl~$znNC}vMGQ>u<;q@2FbMn`q6i09v@l6+{ z$y=_rw?T7L%P{6LAzf9a`R2M0T3Od2l4|>UYI5@Mno|#DiB?VdozHh>EIIc1bZDlm z`0!JhjEs!YQud(tP)FQ8nU{$yrvy_T{MYBD9yCQ1d1wC7q2Ryvd|WgV5T81HyyKHX zh-eX@Bx@}=4<->vO9HhuJMW&cFS4iTV5a{&k5NM~Tw42S|vJg><#8ZJ`OyC^1|&>bfQ0`CXv}*Y4e-JH&86riD^4 z8powDn8HnLu2ey55*m?(#|N*Hqzj@@J*0m3r=FStzXKk|Ak#HG1x}ZajF$YxFJK}L z8d_muZ0rD;YmK`2q^!H>Oe7jbMg)I;+15XAl4joK<^Ce+8!vjw7n@Q>O5z$kzr$(L zipmBSR$ot+?gNLd{DBAS!JTu5JTkW;aF&OI1BvLX%W^~| zf=w%FBCUj^BrWD@r_W6|3Xyv2r$?dmo|uqg(NeEZp?qz*N}{46`t7FhObTF!l$iE>NxaRDq|XI&~A}-tHlqkVpNpxQgK8{zhC#4 zj%Co%lhm=GW%==7<3RqXGcz-`0l8Hc7T+saaw|JJbg9S!6g4$d8`(QOk<=Z5@4(T! zu7ZMIACz!humQMnKWvjm@Aai?Cb&iovJ?bYVSJT1GlJ8V^h4o66r^HWuAZRZLbS}Su-B>zX$U`OQr8^&&~R?)>%jh}f~LHG!U-q5 zJ4MtDN=m^bD#pmGK6utHRN8IM3G0DFgoaZglGqy%Ln3DAbLa7NBgZ^OKKz13oR@!! z8g~2Ifr}0^telvbNXbqv*Z$*Xelq9c*IM1CdrHx;oej3`PtWQ%f*?610QItxx9jig zusidC4yJ!@NUdtH+QJl&eZ0EZly-N@|K813Ll%W;6MAsJxYTnZ{pj9KZNt0K$DkDv zA^sg+J0ZC$akeYRGnb2punjb*ra~yE<(;%En?<_N5(oO*yAY7eQ<{S)ASz)HSqk1# z4Q4VUhH|yEbs;wEMA5LH-$CV4UMMm-q@DiWB%bgop~3bJk20Jscl7cr`$OzS)KFhA zzt=fO9>On_M!ZhcrsJb=tql8S@?eTa>|mrv8*ah}X_Yl^fzOf#-yraW z3JDscAWV~YJ)>@uc8f8l%AlY1G)8`Ab8V%jB}W@N@2kBCDmT%16XC;fjimq)X;F>1 znz1qs_#!2w&?{4KCpskqzO5}&(<_6vXe^*WL|eOUJeyUmU2Cnz%2c>x*hk-~3O6oh z)>lgn97!v(u*wd0E{fxzs?}}Q<+5KtyftT=JgP1gF`^L}u_iOEOJ&rvoZ=Bx8{Yw! zchAq|*>UU~p*G((XM)6}fPq!|$Hv+1h&scvbx)~!Dc`GWD=}~0I)2cKAWSc^+j-WE z!dMjz%bqgB`p&zFvlHQ`+|`r@$EgO}#=Qh%F>?*hFz6pXm7w@1!*=Ky76Pal-6hk3 zO+MnP$4}7lxsF6o6W#)nvIYsI!AmqEON*$$xp78_@+vs?9w+j74$5O15YfO4JEtFI zx`=RTN4&MSm~l5%;Z7kZDE0+*8$VM+*V1`2nQK~OAMIwiLF@viw3PB zc+`^Ik$ZHgjiqR-{N%X@8wBq>5XYe+jBY4HTka^tqbKh*`~Kj!6@w*UTY4`EC*_o* zzBZXFD7Qa;RH|cUTdI&-7;Pz#TUcBpr3Svi*cvrL1rhq3^Pl{NE@j7M<=0o4UFuDc z7*fi#)7|rx=~6c+Pq2gGRMk+Y_ppeWU0go@DmXh{{!#_4P%ha_#&pA0jkDx-5pZi( z4=||I0_-qK!L^yq;G)){{0H_5_M!p9Y!b0)O*Cs_kzwP{t-dt9aKH}5wxG0YYLo9B zRF&+TcFpHFCAM^M+1MS&2RjGB-RxEqseAM|y4!2YP)Gag_hYViVRSY;zZuRLaY!B5 z?=t87BTigtOFxrQeUY^^Of+XwOwPZY;b&;(Y93iI(@=FS*SBTnly;q+vB9r*N3Wkx9p41oq}?>BrzEk^Eai1U`llrw3W^FXgH9}<6H z+P#RpIh)lDv&ckUl9@O{RQ0S=wS*u8ztBGyn7Xd>;k~!CdP;k^RA>8lOV{N5NVvz_ z)rDd_o7RU%QJ<$+x;fdKjYW_#z+pyr8jJrhOAmH~-jQu+WEm;Ak(HB+YR5mRyP@Bb zxaoaQ4KR{f|4lu+WQP!qguue7NHqNv!}NJ@J1*#z)=w8b&qud%k%_n_{*^c{slzS( zp zkwn#zSR!lpgDCBW%FJ3Q21#Fku)xQmUg6wqv$r%g$30!;hP9vN`Ehcx7Sk{-sfRiBIgx4%u#6Hm&}_+YlDJOw zAm~;lpUZ7XhE8y_ze;kIOhBJR?v$N~-qS`x2qaYX=+umT-_PC^$|YB+FsZZfxi4{6 zcCfS4h$>!~*H3$X=4<|_tFgza;Rp?7>tv@E^BgksB|Jg~da?CeOiU7vbk_FvCp4%d zc0N8y)nB~*FRbVv#v4EO*K}OMO01h9CGyT4x)j*Xwm`rfb00xYb7z6 zMuMl`pp5%r?UKM7)P`?qlk_i!TkIBAR){;kEe>l4zPyJac#nS;p-=&EKOEeJCC%r?+Nuvh&Wqgt$*+|ipy)WhSR9YW`CK&1OeF{NMS6jL|7<)%YAK5 z(nDsb!Y|r^rMi=y%4Cd~#(cZj_HeWEdVWzD+}TOrQ`tz7v(~aG=ZRGnl)q3!LfrIa z?c0XNyk(Bmrr{A`47m@*{j5o*{CRydFCp(GNuu{{E{UnBD4CcURqg2ff8pn&hak3l z5d&usgQQOf&iyNN4(c@+3e_}XLR*y>8Ywl+Gfi&b9glv_rYeQIwv*;Us|yBmd&pvP zofoUrEHH6-o+hK)H?*>>rChXPLw1uUExG+Fk%RI)0#=m`T9%Vqi70KZOi>yp9r*!S zQZ!<&(XOL6o1Q5N=SIyZ+`3&k4fdxtEcn^k|yE`h?WjaCg{{7Qt*|}ZNimm z7%fwj+mME$9szb1|;1kW|l28~}( zb=aFH!>N6fPC`#E<)?@9F1R>%a8Qz#u7l*Fr&VlpY;2s4yr>Fl{TC|;%FV$c=2v1O z+0#~7n6|EQN^zNmG)r-KZt$$)QG#s6vX_C3cZdm)ZRht&>Ha$h8>oSRe<1_xmpqJ>q;v#Z6d0vdY%z+Vv-mb~v>oT?p7s)I~QpZ?;z zb8X$IG>nbnRjGeZM&J+e59=+4vJ_D4D^V%hv_-H+K*EK=$$sD#LEQ2A^Nl*3J{lHI zPhLoDQAVy0=c0zFI`z+)#pv>cn>sM3W+d&*qE^OCs;lGmChxC+I+u-Xjz#RXzip~J22vsp3ak|TBG4eKgH29}(9im)L+&&>t&TYYmtd&t zYNr6X4YOCDs#l4T4^yeMGmTeNm*~I#u0|m{k90HHM0HqXa5bc&ZMW*sNVO9^sB}$6yMao@7?{?bP?Lfp@irZaV0~y*w`QBWm;F$aGO*VI8c(Z*`w!Un~agVgfV> zdJ#Fav?klY#!lR#rtYq2dtz(;biKf4Gn?$lRqQJL4HN{D<)^(tqaeeg>LMbFOI*G^ zn!{}TQ8U;@wXAhjBOjf8p6u&g$V;HYtlAP6tVLd`X444UdOp za3}ED#PM?)Cj@x!Q~>g!YtQabP?s4`XZ~3C?Amw~IVl@0FG(P`)Z|t}&X)*<|1$e_G?7BW}oRS?WL94J~oj7Dol|byGI|28@+dMqRaZy{=T*KF@xVL#DAaNC|)6pi(W65-w!uTnpUN*r~hQBcFh5Q zvQkG%z@E2ty+K0gu40O0Hb{~CTkJVxN&6O&O)qeATWAKOuw+92i+qM^PPw%8ZAej?@mYwVGxj+3q8M-`Lry&tzC^ZWhkv{9f83IVO4;Xk%lY1a_upWW>I6i453lbhEKn zB#;-mvg50pcmJUT0S}+WsRAI2IxSjo`d0~&gF5sY*zv5+)pBaOGUSL&>%j4!5vMS( zX&)0Qu0+47uB%R0!=s!Mza2^~xZpjU-6I6?U{XM5QO)2Ki|wrY-MA>5e>|))xS%uZ zX&05Hc=-J{pFzB`K-rwQ4vG+FGw5%?N~;sGet~d&nxXGV;J41ZMZMAdyo3Z&xiqE$ zUCu^IW@gkY#+wxO&?i`5FfT>rKh!c1xpb8>XS&aED%YUFa>5rnUs6t4`(QeX+t9CF z6s61c^P)d=ZWL*agM!smZi?5Yj})t|TNXpuom_lRjAVTAt6;i7@+6kr<+>xzl%`*v z@7hvy88^bw&A&}6aDX-0;QBa-AwWbUYYGZS%-*(GAHF)d#rG6Y2xVp=&yx+r1BExb zco|#qbuw{M7?_6Qru_lP!X+G?qerN6dj9EW^$RBNJOJ%(M-oHL>725?SD+B-GWWbT z_+LdCeK}aeEaE*_jF(2TNlF~N2>R<6ezQN3=ImkwofYTtp~O5strdx`-gCe| z`lVgaZ@<{wDlQF|-O@w{N&r0_iV{6YI(jJ3!*Db-YIhRODeQ$yE7KEj@zeb%@%zqG zAMv{}L5qFgYab=i_$HEj2}*36i_K7Z(iErDCg}7%&gH9~XY#QL*ZhD*{T#k_#p2q+ zbLT(Tr;HYS^hQS#)2!I`cF*6jf|yMmP%Z**HNJ}j|CJ87bJRdP{@sA4tnzx#)Xt>G z_a}u3@^wOnBg8! zPFa&=M;teCPGc371XZ9avXrI7%X|nF+%C276TE(XSve1}+fRnMHy_r{PmqOPSpRLr z4Ts=43ej>Ahz-3|a!jXu1xH%ey2>euyQfiabEDOu;@(nZV)XvubcMXO^ZI*YXEx>v z!j-5Q1-pHABG&?KJRKeFc*SI+fl$5y+wzw$-dYcq+awx}Z>p^}gFD}opVJ`#luB@} z=*s@SwNiRc)|vyCL-(N7C=PcKJ2{1;YjJX_r%wZAWa(&P@xnD4?0u=H)JGeqfL#18 zbt;L8(}t`3^SaxQ-*P@4C0;dwbKMZGI5ad;QXffVG2~KrJ=DT+&*ltO_4R*ro_aGd zF)1$A7*wTySg;^4ABm=Mh;LV}?C`y-G*xx#yoxaWApEj2wM+c>ia3Vur^8W5i~kb> zrjoj{vu2J}P8zdOBH{s}#b|K`S|$#|-N5Ctn!th*Rm)WJLC{~dryk+=Jn;yr%KMQ^ z>mW9YGDqa?&GknKO%43mlHE|5a^IgDtocxnz7k_&=0(D;kQOn5%#lB^~{CGpW8N{=FBF!H+0>>8r$FXqvXq%^VqK` zTrU^U$#IYR0_Rzg0X+sb-^hkeNss}tX(+=L1q8m6BF+`OnXfcpLU2dhj#=H}-Fk;L zt^-jvUrQ5385tE-DmWcbtGMiE9UYyo79-7V?0Gycze>_FR9Mv}7<3xuO^pieu6x5? zK2faEnQ>E?2$JpC@>oEB86NFdK-0?mVQN`!TBMbuR~n|L)$fpq%X$Mg<7-Ds_mK9F zkIq=h=&P=J#;2=CO-3jS{j?SwJydznXs~75dXo0%_=iyGKYvC6AzES&F(mcE8HG)S z{d*vf==vkgNH?QSd=nU6J!2wfEa`f=syN`m~N-6QV$bkJM*Y5O*fl|!(VkMY=-y+&A7X;^xoc4X)C8uQ)_z!5iBujJhOa5`p$xt9xnp)WuJccFx z4yfL&oX*fq%^mVGX*$^X6vnLG&waQR_BG11E~;Ye8oBkC;17GD4uP>-tRZaY`|95m zJtl&2TiuT5U09--aut}lB$wT~vU7vo1%uu@Z_ql_8ilkf9I~+sM6?_l#h?jMeEp={ zyK)8jvCncESt{nrlw=n(T@u}#I(CEb59*jcg;azNO3Ekmv!U-ncCUD~+vRFn3xaMx zgO?|7MtYUaVs*&XisF?qn%rdh%gH<~i;E}vF5oWu=D?jUto2yLI7Q#=G14&?j^`Y* zJ?aUMq9dn{s9l3>mwiwrSC!9X}H zMEQWAq^e-5jYOI?XymmnWNRYp-;El^d{Ro)Bdr#)atc-IgaZvwIT3C_ERi3|r-zNv zOkN7aKvqEnEN{pt7RL(4^1X<5+dKPnlWZB!3fvnM zzh5>V=2<(`ZkB(ABQjQU?Z9>;uIkcI=J2`=@-S3sRyUMCWmDV3+#fYB8P-Ejrs^{c zHhM@Ok3&~0mlVgV%K-bRpc;nw!%LyZ zis9;zJPQYu1{SkIF7Rxn2FYeLEkLnl1XfalJKM?B_`^oqSX-{fWYbrEQU%ys%)!z7 z0+$Y3^df9Uruj1TQG$?8fhqz}3vp*Sm5fH(;;v$x(rS(`J-KGkwd%wv#wXQc$UONi z#2!9Pj&S3~1k^PNAX43#n1!Vj_m$MYDIkvO)buIZ9AR3OTJI1z&^3wO!rt$?1fIO^RK@Zvdub4aH^8y@{tWU66yRu%K24~N3+Gx!DK0p1Jw5V__PvBSD3ln%_N z&*WEDBA_6fQCN9&G?_e|MAd3Y^EVe~d>|a2%iv$Xj(vKi6Awtowe= z!!r)GiI|OA{6!tM*u7X(%{U)p%PC4SP6>)X5*O#Y)(`RL6g@^40w@P#nhQiRu+{6M zHT=kj#C>1!1tam}ASB&U%GIZ)SP0sSi0O?}sp8ci(Fhwx?7 zbllnjTqq&870%VH<%eu_e#=)hghz=BE0H)eH+Qz$Y)2=XSI;58=k|PSQ$W2Ij))y? zxqI<`eu1%L`e(8m@S?4)oxcdfW-l`?&+2)~lj0h=0`sS_Xh0Z?zBrXbR?ebIPiAVC z2nWT1ub!REVpL2gkrmbbBt%E=oDhuivWbM+^I9aece=tff~s*<{SLdlx410#MlQ3! z1v~W&ztsmO$UmcwC5M7zJG2mC%UcWn3tx;;TtfU&RIG;=kN8o*kn**~Ihc2WhGfd3HpgK_Tt7|KFG2TJuG8G4=f8s^E0O znh-NUQdr;~y^)GdP-5cq&hTCt1<`>2ijN2!j)9n9^W*xb=1#B4OeC4~kBkHSwWE8j zH8O~%e#um`PxLPOiUvrHx{)Q}(u=7S0JA|9 zH`{-3sDz3B&8>$ypyX^PHlx(s+)`67o+^U#XemMLZdzHM8Jlgi@H@+L(4SSlv$~h* zc%op7T%TOJYVZ~y@<3M@c5)FbFweRl+I;g3*rH(h_pUa`z~|T7NzZ$gD+F&qxoO4) zXSW5rq3a@ImHqXn&NBf{Z72O@r&4|h*^;&HO|im;j9Li3sT)Hp zWoy~lN|g+vdfetL`#|89w|9zZp%pRucHyA+uWxII_KV$hQ_x$ zjtLas(zo$!_%bYs|kd5U(lVhv8ZNWF1*xSqL*5yV7E|E*jRwzqR$gpXF3}Iw_aR zpwe4txj5SKs zHTeXVn~=u#!){KK*|Jz+KhBM1+puc$7NJFN}xOuRm~cX zq9Ny*pWLVK^!Lu_Z;4|2sJ+8_UmzaucC^{LD#D+e^xi9ZXPzNJd3QW~e7LDrahVV+ zeKLD`{c$EHCQ;8<1J8|S-N(tXDX+JCF35m_l&0bxr?IGs<{c(h#ksa0Z z0Qw8FTpoKUoC!Lot-~r~;5FZ$%%RT6&=DH&E>}fB>NlOksV7K;J!O9+>O_7uq^~=d zA1N_SF>gdOwABBVIbK?yuH+5;CjsN&OL4Y|p3id070hGoqsgc{V#tRAeK9G<%61mGJ6x zMNL*hx-=<0Ir@r5Y|xUw^UwHQ=Gy);CKl|siW|X}?Ke(NPWsLSuaSe&u^wc!C+!w9 zN3TfwodWCu?BL1w8#w17La))t+}Aqu-q=2DKXUmYdDcaAsHwEQv9z(Y?$>Dl8~nfa zLK8yksQ$pmkf$$9b_i|x0NgmrW%Itl7~90%KdYj`;wehz;@)MtWmP^X>d4N_HC1+( zJW!?^=5*oOB{$cQ1hzm?5I9`S}=4_sWViA834$Vb&$N#=Q-N*`Fe80+;QdMSCWOvrN;Xm(GV#Q&T zleJZd(SE~_^Gupad}7o5cJkO1Ogh6FhV=c&^Q*oo>9q*Q=>o2Ebb6Tm>Jdsuuu!pz zIYl-AOz^f1HnEg1P~J#rUz`svFy;T4Pu~%BKoHg;+0@?`>Gwf8rx3l|@aN9tPYV1& z2w5I}@<%HK$dSst=AM|4ADr~vlF2_Ys(7+BAgabl{{okXQ0&)@etn%_1x#3R?lB=;@d@C>an9WAfF6sN;-&YQ`?8(W^%|4nj{z7`DyNyYnbg<}*be zWONCei<6S}#?Kd)R6g?^9|_-li|9v>=CcQ9JCJ8yvEU?EGL~seK@qs=PlS_)w31R& zOKFM{2VHK7c0MAwxy2bDaD&J8!yr5b<3cb&a-+fv4uzKJ9-2c&O6C-*=1Q-7;XG1% z85ixRfdNT53yo&B>j(GhpKgqd6SnbI-3_QH#LBbC86mySrrQ>&*~#D26EKhpztMRS zYRH?5cgBX~B$E^tn$8OfNNySXA5M$v)EO5vh^DWViDnyyC4WaD_t@%7{?OT zLp&31dT~xsV$T-vQFZ)z#^rN6Bemz^-Cgo|V=}P&<^1P0WcNd#F>B(aJt7YAF6sNF z6_yxvBGGu z>LY|BvK&`;V>O8cCvhi3pAbL#bB!hH62?sDWCi$r;&FGRw$=|*f)IB4^+`0)6t#ak z62dA++#wM{n|%Bp49scV?gqeB(@0CEq%0^}&ZNC~BV$YPdtA2>O#B6mpJdu5h2i#8 z{rF+OY+2SDkx&e4BK4eABgDxuZ^k)^X2HCj$)(PVDjBnJg$tk(5=@{}{41<8`<0IbC@pf_*Ql!{(&1 z>?1j^P_r67=EVOf!mq`a;KYdH*uOswx0w~RTX#BioD-=cWzuU?(JP-9R!_*YthUD) z_zEqz$rX#NuNIkWf|O)zOQ0n(a=2oZr?Kgj?E083Pj-y5XtHi{9|mE{SK3W16r<`W{n^mxiCMPQ&ejWN)ZL$ki*Qat0jL@r z9a+gmJ?#nZ4TI{g5}o%cz(#y^JbYUrF6}$N>{cH4#XrXPJ0-MwC@D$X>w4HsC`3G9 zrQxb-DX%Pew(bobkS($7FRx>p4VA`65L~!FUnx1>0?QlcvZHj~B1C`yhD#N)7&qr|( zua|w-uQyYO3y$t%RMpx`kR6a+_%9CAZ>vH_7N#>=hEGw6m+EC#k#`oBmSTI{Mit9# zzoDB=T&{e)t8*fbf8a!y8&)7iMNL*6@cH~{8_yJ!YOAC>Gq`^cXBQ)DP*LN{6bhg! zE`w6W->>rZW?X0!6a{RO|1Kd7zjLp4iGAA_WXk{fyFDt(+q#XFsFHTLo7RBG1Pvs7 z#=Pk>D;It=SGLnP(!x%J7D#w$WoWCZ#VZD4edKK8Mo2$j zi4JzR4g1IxY+de{$!5{vDtgfT)2k;AaB-F@`UC+PH05*-_81$N4TsGi&jJtle}{ap zP#jpA7EI4|EDjH`kF#LIsocQPAMMRJW{l-*a*H?lSx9KmY7}tC9REY8F54==9fQZ) znK(U<9FYt8Zm!U3go7nUc3Cf$m_Kx{0nr4CUJV6xZ_lD3U@hy?l%G;Aty;AQyTuNU z$n3{du?#w9(khgtAU;ymrla8B?#K5ddz0GwgEv5%^-loo!UKE+{*KI$nhsIy3M?oL z_Ae{XNg;RQ1dfcx8f?C$K)~};OlH($*4~$Xc!I;WbCj5ow+sh9`b%Y?S%C%kT&a0q zbTyEe&?#|AT^m(?AG2Yxf(uNR8gHVTxn!@d5Y;`v-++^2b`NUmyr$bxC#otIkcu?$3dl_X0NOawxXW|QA1^Ti}1X> z=moR5Ymp(nK2cf-1nH{^a)`H8pAc-BiaAjNZ`=6lf?9orT38)c8Kik{QXa6+_-bJL z8yZwC;6{aArB`URIgwY~4w#Z%cBo12sdQKg?h`7TQH6Ml?S-1cFa0Rob`}AZ$AN!e z4w4U6MpNh^gyNm-vQ~d0S-PeG0)QFoLzqMT#mGp7Hs>8QMF#9%MyuZvzcM9OsLD7T zdoIFVL0{-c!Wa!XlZ#QjtZMZbcbt53m<3n8-|tlzeI90Nh4kb^N>T<#=-7 z^Dku|;#w!CgQ!#f%eRii4&^Wl`}2yyUgCPcV}*-@a`NAxV!7r}N*|w(;n+W2FW8x` zMpOICh86OHj@=YQ3hr3qSp^{r86LD6I3dUQ(4L&mlCj-;{&Q!P;=%TUWmvQP!br8C z5Z*Z)_2bY78hlv6UpO8;-dAioo#wdqpR}0=`*EW0d8~~Fzo)LXyleQF<05^jZ1XsA zig>n0u*YOo9EnCc&hcuY)3WbCOUk`Pf}A{Pah>C;de`39<0(#FqQ6?vJ8jVaaV_DJ3m0 zpIWc8@?AykOj6fC>~wN(jPg=ET0ODo%?GDUEb|uj#|fWl!}#s-8PU$`qJy5v4WG%W z>l*BZkWfrW81ivsSe)I%xxs$v6O0kSk&}3SPel$G zXcmO%PSsH2>oBp}EJ&3?AaCm;v)7HHDcQqg&6*oQtE~^T>c^FaN=Cr%8`o(cWglBG z9u|!|GKY`>C^3tE`L=fg7nC93rUtz`-o0M#PBVlm&$s?{sv;!oOg^H^YHmW$e0H~j zuHI5*#;45SYru||tYr#>j9&dLa})+80B5fi;Cd%;Z}uapvO6@iQTgZ%cFfcXYL33u z2sTAKbiHE_g#uSW?VdrFY=?T+SXiTm)HnqfA4giQ)D?G}m6leb0wyM~J`Tb$ljTD} zjS|7v(ttoIiz;uDx&zeiyxdJ>eLx4N;wTlVRz(k@d~Uq}v8hSY^YguiPt@C~jv%(& z-ylT!p>?cC{2h}ohm!ef#YIy1OQSdlgMFxEAMQ(pf9(uFbMUA@`{FL!^3_BYC4r)y z9=Y@9y1sgbN)ZLBxBq$u$sC4`X%oGtz95+6a5j6`DtmdM3NExYH3mpJ>em*3f>!Ci zW=qTKuCcr^8>ASy#QyHR3Ypc4D+FVnP6%2OKy* z_(s0DufJ2)CT7SQ(X+$&qR}Nv+gUsNwYe`iAsV*v#;oDxE}d^1*IOI(Ja=<_ApBQG z#!kQrb}=O(ffAo<^GABDC=^kdO)wHI92#M!q)}xuy$AAf7c{Eis(*UH>LF@t^tQ<> z%8^dY)<$NgEz1&?z?2TATHooj`#MQH={1p1(o9XelX)hxF^_+c|9uFUOIm<>%f$*L z_J`MwZ@*>v!6#gxqsg{yzW!LI1w%sB)yVU<}xNMrI7)U`~gLvuDpL zb()cF+PJQ(5i+qr*tBNK0x(bZ(-n|0M1i?1U$I)blfSofyHZP%sczf)CM4nwku#?q z002M$Nklf*}b#(0=msNMV=jnMJl2m#G?4Wt|jk$o`?eXqXu ziurbW-)Y8UrpV|mQ#EWE&1dJ%9uf(?r&mCGO?7n*2DJ!_oxy&OA?frt=+Imb2TP`l zp_?#Mz7WQbpC~I5=T?T5jpu7CqAV}vL*FhjzA zI5`+nfN?#q;kZHj4;diKVNhjJ4a#K@$iQ$2_cb|}V_;r0G6Ev+w*vz~=@^g)&$FDI zNs5v6Ha3yT(e@Js>FuwO=B`0qNBhl=?Qg@rb(4~oNCPv_t8XP}#TcFs4)0gYWbfWx zY9c_V1E$;|kij$q>4D2C_&lV2Z+$Yi<*p3JbNeYC=yuS4k+I*Mdd3;w+)hBZxMZ+1 zyYJ*FQ&esyvr%p^yUrg)1!h9;?c8Z@mT&$&;6d|2T^@B5pnC1^f%I~8!skB!x5_Qo zKA<=+7@`6PB@WQcMqmuE>>~#%o})cLWi=i^VoBqXSQphvlyoX9uPG*zo}PuwBO8_H zmz^eLOxrOC7Z+bpRZyk0VdE``;c=e|#%PQ74;t*VvnOC(pW04!o@L&u+IKu_0G_c; zspqK1szNeOs=(;pZDgk=v*ES&K60NPX|oZVvu^z+CAm?J*H>Vjbe>2}&47efsM@3I zvAp~$q`&c&I3%M^G94xaZG|*Ok2gwY%x2A@pY|g|?Z)dJ@6QpGYutaM+pXK)hQwu2 zwUMyD1D@$i-NQ}dVLAqjGL_j{`B4lNaE8R?v~56!J_*S9jXK*oy*qj+un3Q82^!^q z$q)eh;N>eMp}mI;rU9xLIvvnZZ63H-z7b$HdZ?nX!Pm&0GTmNnM{Y9}R*-6Ftjl z%V9t)r8TPA1_I26LWXhk<~x+li%gFUno{AWn{QRpjlEtbrAx?osBUutjf6M)F*qw5K!F1Yy-qlw zF!QYmD4kI<(~QSNlu=fseTOkTPFTNwgR&tw5BO+--&7mXgOfVCSHB56jhdO`xf3A0 ztcN;@US@V+`}AC6ZZ~aqQ33+dd_q^z?M(ty>S~{F*bE_TYhi zDsIOWQzKngff>`*%?#D^k%EZJboZA=z4gs{9={8lGezh55zTlk{+o1@bhZAvl~CT@ zi$RdvxN+m{jAuMrCF6not6>yUfNHi}phf4h9QnP5N-aE;?|`n?yLaydGbvQvV9FT| zm{f(i0;<>!!G6IlRa}#hwR+a9IZD;#>iWJOqemH?7>JFCzoD9(ZBPQDT8(bXwCm88 z)eh;8Dzp$7=$Sf)wiCz7qg;ME-Z_ErYs^p_aAgZftJ#mbTm~PuHV8k+>t9V$8<2h5Dd-BD*AZD+J5|AV?0}_u7 z48~(StanEV1*YOTbIi}mK>kthUaKro;By1{ht2p8{-8TN_sjSP#r+k9$l2#KCdD2T~X4Y6M*@>8Rw0A zJ-Ma*hFKo2Ah~J*93QG6l^r^?PpwPjZV3%aV)S@3p3Rf}aa9*-WCO~DeP%q}-@2_f zAKRrbCDm;fpoh(15!})+cGzx00>tj*Zt4O`JN#7-HyYa?QST3o0@H9?w)xg|>()y+ zX3nDx_>FLlnVFDSm_KaR?0IlEo}mVGSF~UTXnJWGux!~%7~i|rrZJ9tV#~f6NL3o0 z0w~!qMu>wv)##K^$pDS(xb-HmezwcJZ0rje_ZcJ!rT3i++lsR*-tL#PArxFN9-bbt zjE8UhBA=U2X#j02gGqFwU1Q51EC&>d<2K-|*WyZRJFj;~CIvX@V0tHunr%K75M;`h z(Fn>Aj=<2(FrLp}u*j`DIqfV5vF=Vi)LvAf(=NlAyer9Qq|=dE3>GfTQ_oJi?B4aR zvPb#Cb8{^w7trSwKWOA26LcZ* z(6!hRl+}lx4CE`IF@ubS3}q~E43NJhBAE*7B+{jrq8C{sJ<-Sw>ET7>s!f%^YrqO1 z4e*Q(WPlmfx%_adNE@5*s=LQakf z8s&hhp*sbXv;z-SuDr=WPO7e%Ow)z>y8F!|_z0yQE^j?^<{Y)Q5wmgA(STlVfvy*0 z^Ex$Z5sXVm3>#G2_IupzZBS$cK2v^t4mcUekI7Ru3rYgig%izFL5ggAD!NS*>BUCI zbEp%^h%BnMit-AG=vS2wJkAX|a4@0od{lQ8LJ~Sd22IIM!|0$uC?0dI`BAwFB%M#_ z88wuWxw%iiR^~TUj5U0ieVLGgz*4FwHHdO}po)?X23#EPBD5;ZK}YxL!Jf!)f>4jV zer^~~pJ!F>7!PGzzV)vH9|n@y43@l0yA#!DPE{JpboQSEBvazUS^8ZAKm3CS4h$LN zL4TC)J{&HMd@-gU1D_=aSioyEj0y^HqLF8Q(kx`Qm^5j!`FCMHt;?VQGd?rMhXWeb zON?cqXPN0+8r5{7+cy~v-K)8DII|`U6);1$3&ulj)eSKoN+SGl{u#Io*ek=KpL<4T zhBB}RBNciOGQ0-D|DCC~Ti_Sp0C#5^#<}^cm*ElPy{s_ z=|vafoQaxIn<>Pg(3vxHWg?P~GC3-joER#m%nTF^vb8}K_WL}>StJMCNT#y^$n`^J z09^tNrHd9XfiM0v<;g`|qY-H3@9&2nk0X&Db+uepmFfjmMkFwo*`+T!7eTs$l{>kN z>$!74I9vM;kh63P(8zb+efP`eTW(Rgi5OJH^byosbC%K{AkiqQF%vGg9H^NS zia$W+aXMF6h&3-x%W*_6pFejFzU#G$S@FC(f?t6&#ViI(mMn35O@I10kZV(rB#>$X zdVQE+=-f|CozTTWp+Gk^8$BHtVrg~_?kPY6Iwit~A9+&cXXA{%zhjE~+DFbAcVpjR zKVc2VV8C%XBpf4(*IfHR2ttNMv;&Rw zGiJ<`&0s_h2F2xN3)TAGXHK7ny6&=EEx(Ece^((Pm4k6P{0vG;N)(eK;~6SQK}r-d z9utrwlksrd=h=Yieq9`16j*`oT3j2Mv6vE%2KN*olVQdHB9}cNBhuib6u`UU#G2l9 zHX!5a^B89^9vbg|2%KoHjM2uo-nvB|diY_P2(OC40RHIAKRl+`$j!}_*|TS>=E-T# zoH-+8LZxuOEGsKRPNxDnb^4T)T`f~tW_iz00GXzZ@vs||k4fid?r0d%6j+C+GdsmV zCB4X!<7-4ey$2r7oDa1e`F98{8ZPA(CbI-lA&Q9oprhtbiKvPClRh3j>S#BH9mAYRxYz~T+ zkL8g^9+Rn4r|P%^8)f^tORpRoP~y>y$3~P9wwr_JnQVS0E)K{=-*o(rnJT(G+$lh5 zhsgkJP>TJ2GahFhvu4efC3$&jr90s?D3B5aFC_tuT@d#bJ zW-U^_Fx8<3O@Wa^0XlD0RaV*`h!T$_U5ot!`#vQe1vG%pojX@%z`o?mR zG|cLruAHva<9oPGpBmm2pqh<&1T9=t@ua196K=@dGk`h=h^GkcTlLVPV5zxF85tRpn3U)$rptVp zE^7)5I|?w{3|9iM!N3_$N@|MC&gH~S!;MfNBqSK?h;)lor>oo48>v^{>ys2<+#7YP zbftCzRo1lcXwVcGNfe+5F?xw+_Z zuwYm}nC`qQ3Q&zoX~*fHLwEihEc%wIza>}n(#M7|1-KkSMFqokEI=+q#?vjL)N++= zhaZlDD6D-k)G;tdUxxFRSrhV>E|ce;`;GZAm?nQNkOPz@gQ)o;T^@E6V9@o==3XZy zC95pLdeJvCRfeWa)i=kq0Bl)yWX?zSd}h!`msAKk{xB9D`JR<+yQ4FkK9d$30qH~2 zd*5r79&HzkFWNgs$AW$@bm?R~A)z|Z%}&vQ>~p}$$VitMWH6|%vbY^iLw$5II69De z^*ugG0R~<(aMTHzSeI(%teIMK;H1dl6=?kC_ZN)yz=DDT!Ege)n2lPh1v$YOjN%5U zN;0sW-u(Bk4^`-743bPMdUUu55RG9IQv(BK&g zL}Ll;b!*qlAOHBgxkB1_=yIzWkC`gNySxtFr&pT-ew-;OsYsKPtr?F&6fbT`Zz35@ zC??Ka3yYGCalF4xo9|-`gaL{fVTX)}_KhYmASTH)GUN07XaFw$cJBN+`=ip+px=zg z=}yg52-=O>PSb(yGl-P#v^Jo-?Q)=VbxPZLy*s=pz;EX^pmPe%RUx^ghgMm8_eGMq zP_l`PjF2%2@e+?UkHVqiX0Wcocs$tyG9-UsK!Cqua#3hE0qrJ^Nl<-YU)b(QhgK{> zQ*_~i{V^%=bPMdUUu55RQj2P#D_5@cD2m!|*88q0z%`4KQ<5b+JKKK2W*q1iVQRlf z?+*(Kj72XwyKpj|sHjNELjbl0?@)jYoeU;6CK?PUPRIbb`teWzUpm`nAJ`Z6DI(m# z{Dz`G-fokUUY&J;OQT6L9_DK67dRPDNy$aovuC$vJpCe{>x(IRbN!+P3l`chn1lmd zscvY#7JF~>{*6#zBW`x8*;vt(snaAQGxJ93)c3le02xkXWVpn}MoUaglv1lv3h@4tu{J3#(w)FIG{Z_>{J#mXs*s<6^Llln|`$>q`vB z)l<^W6cG_Fah(ikq^Mn+!FW!bJYj!iN;*aMgMHa|ekHW;y#4lDvUkrO<-yUHoAovB zDZme8{`>`M5k1>gjQf~jJEnJs7X_xEyOV(y$u)0jo&>*wStHys^`tt&{QarizLR`QG=w zEBp8FlQ!+;)*m`{yOvT9vwSm{(DtLFwDS?5h4$Sl&Wdl z=1X+B7Ygt@p@&**ObjH3808Xe`*wP%!M9Gc@3aGTJx|cE{e95u`Pk8J4!QJZ>!yF} z%Uj^!XSwk_+~vOcjc>@_eS4MP_HcgjeIbB1uOaQ$tzWNZKc;p_^P7RR_h=Y?6rl2c zK9D)uoWS=?!?%WkQGf$9z0~NTMtjLf0t^G{nW!?P0|F(w;RMu%UAc1E-euZ#=t|A3 z1^ou<1%3kj63}TVJ$34&{OuRMARm9~DVaBKzD$`iMY#)(7Jv1AQ_;;0WIW9Hotv90 z`}XZKUlorXuKfCC9=u2X5HMYiThul@?rFf<+kv$Lmpd;)urzhxLHs+yB{aCB#j9Uf zs|5K;M{AH@N1N9zxg8w=0e&6rAs5vw9)==1FpZ*&FEvh#_cW{&kumqS>Fp}3J?X%$@9um*-x8q7z7zq&yKPi(`(BjkYx9<(!_kPN?^k1YvYzb@8~6XzoVUd*YhSNZ3Xz-{RSIB5-^PvssI#SRyHF5m*ZRmi+^TCl1?44xCyKy7? zMeg>=c$jDB^T0UZdZ3f}pe*m~*a6+%F?r*S*Ja7#C35SQEoymZCc_*l9vgg4ZvlT` zb0GC_Mtu78X`>mx(vG6|n)a&r*Z_ydhH~r3f|2(`tw_LI)`2O44Hhq6EXm0T&(ciC zMj7|Job|^Wult62 zrw%u~4rCVP2|&w2@eK|2Qc_ZaS^Hl3>tElHl8cul3~R~LgNI@m84w3pa&w{vD+TXKrxUGr9 zI!zA0TN;p=!GzzlwdlJ@QMh=EV#zc*TgF(65+V3-8hdx>E=f1B4X~7Tq(4m9MbI|DT z)sBmj?KfE>{Gy;|8^vFsK@cC_GJA1#$2Hm4zRl9h6;MNOy7^|rYeid*50@Ppj_J*M z?p&c9J9boFf9+McF()Xsx~HFk-vDhKjLl*C84ZrHjPXe*skLr=ktW->Z$qff+h*oS zUbz+cyMgwXsx~v!VCR2Pn_o%w=y<68`+t$0%KyL5~C>z zao}Yd8UFAnVjI$tabr7@@3pqJs2QVCHqP0%ygw`~9L7lIOG;3>buub~uR1@lUzu1E z`<7d`$hV&T59cHC?G>~ilX$-*$UL1IPV%2Y;6bXH!J2NW*@pA6y;kt%;~+`CTxhbY z8~B^f#_v5XEzM_tdp!}GNiJ#2ef_o9u#CsAotcOET}{AZhI~Fx0aZ(k==Wrup6c6B z*Tac5Gc(XySyNMs-_lU`$lCt#6DNcTLQTLP?lSH7yJ%-TtbmoC0e%noGVo5|<3KVX zj__`WMaKUS4In`|6O4+A5*pbJCKQMtp>u|h+L-l~E8BH+a1D$OX>M_EaO3QNb&>JJ zz@QrgpZ^%NF?HH>nKNe&USOn88Y)SH>C>mnG~n@L#|#q5@%H_ao3=>CgvEE!#CdjP z6!0?`_R!qkEG4$gylH9aGJV=K^?UQxNspcI>?hNo)YjEXeO*1iyJiUs4|OsfUjNox zZ^=ANB4^I@%<>L&k7nipG9L}DDZsHZB0OA;zSqHgd<7byUSl>JO2#JO&O4_4eiwWC zB{ZV8lfZum{tQS4^aL;q$PCLCI}rA}0e|Gx)zu2So%GNFzOYc(n>q8h97Jkh!)e0omB);Jr>AGg>NRU*+g2(%L`@#weP@T#Tqtinb+rF~ z_-)djL-m?YCDc3pNUw0j`LtsKURT%Pd_TS4>76UspEGcXx?09Opcc4@y#mXTe(v;T zq$77D3#KUZ3*c^G1&|B)5LrjBObFL_4LFFC!Cks^Np|nvC9l2uic-Om8BqfA6`-1s zA3J^GX%91?zNJC3BC;ha2rjuAe2xN~92~6JCB=<}=$k_i!jJOin>WkypmUN?Lh@ND=;<1trA z4~Fx=w}3AJ-v=H5QZk}b!gV082?O>dP2sfnfGg$E@qr&*_PB8p7Z*3=vj^j8xis=g z=u8=;YXH5af;xgED>4V`eo&jK!FMR&CzZ`tCBNbTB%X3-xA;+h@rz$llD0QLerJPy zE>M-$j2UwsJk+Yy1c%>)O;ysZHma?uQYkDfbbc#L9K0AI6#bpNaqSvrA&82K0Mqi` zz}W2}M#usFwt^6@!u)8QJh%dmZ3P7d$}xoR#~a!m{$}2N=N+MQf$jJ6L-dJ)2!)aX z!HqD7O0>AM6Uo5F02vEJk2p@zvq)j6r&M$dfj9=V%IAp_s1TQ%J z3-%9@pfK#);sQBSYie(h`qnzBX|0y>mdl)|xrIOc{`V@H{ISO#S86!>Owa9&UOYkL z>b>{fr@R7 z86WGH_yW}zWH<%{M`LxtcnD2hhm2EdYY?`rqfM%s;R;%JTF%#;k+SA1NZ3;EytcKi zRsQh%-^ny2>s+^fgHL$W@P$sAG+AzihZ{d?14>&jN=fZ`NeRn9A{ZUlW6))&w+(Ie zapJ)WxR#jcMFq0N6y?r!4A5I`|s)`uoziQQL z<>l*eSvLZ6-3*|8Yaa2M7v=czE=Q=&+w!r!0=%Kwaeq~9eeANjj2$CGq8^Z3vau5x zFI4|2`B+;}(3t-hD1oaX?ZB+=_(wZPRD6UI9RvIVVQ}w`f&RD)7~~%;kwMXt89q*? z#LSYI;8^7ySJg%nlmnXak`BYBvJx*QJ|3Q982E=8_~S@SOp-tS@p(&E8d@79H9Qlx z9tw>bhMEGL43#xrlKt0qN?ki64IGd#W{iCDlYiq#lVcnlq%D8Xlx!H(?XcZcNCQ-9 zWID!#Y@l5sf^983pc4)DzKg>P)2H1M_i0x?!ltJ4gx zUjxcu?Em|(enqZbbBuFgu%#_qz6{H-%tst0JQizfq@j_+tRp)%-^W1S$?+4%<(I$s zh0(0BhB%x7#k00RRK%xeK5haDD zNn&WSR5esWAK%4%sPCqCPHyfTWw`6HV}o##A1QUR96%V1Yd~H5bx96Rmoaz-?crun zW$3n)s7s&%J$U^+ODCRu;z?P!a3LgU%TL#GjVE{b`>w341T(lO2M!#N-~H~l!f5g_ zV1S&&coJyXW=_ThjF2v@{Lsy?|Ju7!)6$ia#e7be2bTi%t+jHxrfXtg zw9Xip$jB&T*XvsjKFlic(T{vsKKq$Z%m4l14|3$l5xb|6NBTiVHeo`J+;!L8&idNh z+vJas&gqS5)AuVz!{A3|m)77N3hFK5;T}4XBl#EJC zuLzw*s^M_bQ=Fu6XH`|Do$2sYF^~x-yBnQ&wjVGgjK?pe?NNM83(-$Y`=Rk6-5d(~ z@hs|6ss$!QPLb?zEWn0;2JnM<<&~FxhVhW$(AIPBefJw(RNHHYOB$9&Y&)DRF*Ja`7X!E&B%KJn0bJf;0VKMO zH{Il{o*q<`wCI*?02v|~j#jT36!G4cv5J+~t|_M^s@e>o%lm=_3yfX2TiX8Ucv4Xg zCUoVBl$Dh#iHJe_cHr-gYTRAB=(KEsv)C)N92ww_W#AuR9sRoP!@*yk<=4^i0B*8O z8H1ycDl^nN`|nr9ri()YLS;hC6bbXU2vl-l|9-CqvzoflYmqOP9w^MVkdl&WxqcsQ z3N04DdCPgd<9!OWw71ByszcoxTD)ip(jR3G>I8nJN)Y=g~J+i z4>~&E+*$tsWFLrTQc=(SfGPDP2B(;tQ3liZ5fJ4o9}4?HTfzJV^DTXN@s(d=qb+jS-5(&4DNx)2kdfcsmudA4yh*vX?~U=$kl3-I$eEC zs#^H2H4HWd7)N!i>Hwn0>6GaJ>e=bpHDiWn@|PL)_Gg=sk!ksz96frpo6V&^_4Rfw znabLA>tyM&WzI`!to|9?tuI|F>1LmFUZe{ir2tiHfBMs(Bp)u+1}tB(0xGtJDrco} z>_)bfc$oc#4Cn%E;bo;|mITbG`zmnwF&=0o!~OjIJ_T2ZOf!K3Lj5Hq0!!X{P}*Vr zwD06ZO|!%TQO|i9q9p^Pd`0RZ^I?nx*K;w$wYIBrswy8t;0-yCn5)#~K2o5jr3!Yo z6PBx~7F~!ud*MvvI7BdY+Em19bWKob>>p^{PG28^Nq%p;?RH5VljyvK10daOnWD;9 zz9VPnMp%Jru~%PxRetp7Q>Thk>%>5=Cg9Sz8F!sT`C{T1$xKh6sScirsA6O z(%iv#=PuZ|anq1WJM0PVD&xkD>*^Fr$DnTW_HUW(PDS>Q2OoOK+4dE9Mm_uNv&yZz zb8vE=(*@5^fGW1{fB*X`ZH-am3@lY~>#et1>~6+6Pi*;H;uvWIdO8g+#&eI{6A&2E z`US)rb-BmjDJboP$A$_W3%mui^JGR?KU5O-%9YD%iC=HEJCJ(0zR)9&JYu<(>CsPB z=gYMws#i65p8_3_GSABS#xs_tvZ2~ovv%!}8`3F#%z?q*3@4Cq*4vDS?J@3*UT#!3 z8bB9o&c=(2iwC6-M!Tb7OIzBHe)J(a=JFYXqo8DJtdE3?1-W#AB-ZTh;paDh7jwsH^jI=9_ zW`FFQ{i*%4`(t#@&i>IJoui{a8c8!lQM){nC=wtkke~<;G=Ofj_olkbS7lXtZ}z({ zJG1hot9&otOH&n5Co5k*6LI5Q92%6z&O0<5C4n;g_@ z+0cvgz5KGWIcg{Ar&)yNz*}Gb^2Xi?ruAO@2Be-@?CVMMPmy#)Ae0Ky!|*-$W#b9n zM*4TZ{X4~7;TvaLf5iQjRV<~JWDA%?@%{|G6EioKws^B5#~~`DA0v9{|A!5&>>WfT zZ4lsv{+}Z@(i?BQA;a~ze(SgB2n<~G9Jj9DxPc&nvbN+!r0?RR>0*+uj0fh^gE?dF z4?(nSTdm1vgogsC*z^;2iao$=w9pRw?&5DgxOnk`s*w@}yDUVDw6eeOBk`{BKNcO~C{g>vz| zgb%+Inhrj?F&;Lb&RH`rgSUJQM9XZY?OrRHEV5I$MW19d+G*UrvGI;eVf{4k`fi1a zLP@Py>N#}q5WV)=*JY0_re^8f+6R=*3aLj1jD|mAnFw78oCgDvzhA!%X@`TM={d_( zQVo`Np2T`!A@L6LJGWbBEW>+x*n2~%%8l1}{_3y(3j2FL=op*|_;lMh@6-8PSPcH~ zhwO(lpANuB-U~0Dk-SeA>>Z7Lu$9DzlV)17&IM!%H{DvuH<%>|E}TL9{Haro{!X z(hf^Yq#bS?3u60tZE{r`pPzj=D{YqI<4#G;2&bXW;C(%8zFV3;_kRSxVVA|G(o#?~ zI%a8SHNH$&LZ8WUJPn_0hYlZZyHP+MU>sw z>L0w3wbXSE4-#zs#9<8d9GFV$$>s3Gh^^dsD*z`pvF62a-g6?>drHx2{Fv9C|Kv~p zr1$_!x6fk|%BtSdb-m&Z8XvHc2yYxMNj%uFQGsMrU2?wZLtPlpf+ceV@5BElqYfN^ zr5&ps(oTz$)nuaq^RTQ`Ze*TebXwwpgk$ymCY*R7K27B6H8u4jvS?L zeDj;KVtKuXRc_3PL~0BHX5=$7GtycahaWE_Hs;`{u)K-46^TP{uy>b|^cIeF=~$XG zonskeORu`lwEJ<4`x2c zjvc4}^q=Isn`yccxj+}zKBh=I)J_t&MA^)|*?jukn%olzdjftM>nOZ;rA+P65%uPf z3_J@iq@~3r$X)@qnt9XSnU`LoKmL#ZOT{Cf`ro5l2%V71cAmsmL2L(~SV=6> z`PGjRG;qV!Ka+d-$Pp=A1<&d`F|iajwR6K@hCL3?!pGM7`dUlL<#&g@SbynDuhQ<_ zyNhKP)+u-|ib(YlV8e{}-g}R}``z!#Jm>%6AN>&>IB>8f>Qk1uRuQY`KCJ0V(gKd} zl>FB8P*cY9`_BIZu2K#E0Tjv%3d{};@CNhgHYGE{XWJ|egzz=VD7XzX)JzK(Wo3mo z@PkcffBBbxg}(Y#HVoWI>`v#c1_EW$j@4y>S}RAH6r8_Qe6l!KGz?%cNzu41HOmim9LDcMj3S&_r99 zVi5=QyR1&{XR!dmgM;)XFmN_gFSKd#qK*f=7mUNj6cVC1 zCyqLwSovR1{)yuc-v6d9i^)whp8xa6_bkq2_)kU$2Y)5yP46ub-)Y~y(EjbCgBvqk zjM3&*6J7kyz5MJ}1A>|Hus_d|;a`JX^L)S(>Zf1v`~hWmRStyM83l<>JL@ZnH{f5b zdTh=+Ho0Sy%bS6=>Em^7;5|FXJWtS3&xV>xDi4+Q#69%jN9#0a3P^R&K}zS3?x_yF zwaPYv`>x-PQ$MUVeW|=9)Va?-g;B&)ZDBk-N#u>T-}uHi=q8*@vPT6@9I@28>ZWI= zzW|?E+V#;|xYRrkjI*g0wP*clokZg8=w0u(_Js#By=JG9 zFU{h)4m=D>andWsLx1Pe-X)X;mm)Ox>0*~qOB75e$dUGd-aO-Bwbt+d!5_4Z{(P{! zWAyEB|6BT-zy7b1cMvA#dq4eqT5}|5+`JPJAm!_pH1!!q$I{tcev?+=f`;EsGaiW+41#H_ z-6SJWTWtcmhO~>U1OnR{0XOwhkD-qYImGpSB%j{AaZ_6VDP8DqB}jQw^rzs)=QeiX zza@oNj^u*$i`eV*Rr9wbdRs|PrpV8vCri@1mf80@(Z_U@+}yTCNPRj1On|rz-@rpjG@0+IESLX1`DNDT16EL zFFD}Z`{Soh(XamMuNBYofXmEhJ;!cYwiokBAfoN1%*W)*ZLA@32vjfqUL@iacrW{sx~Q5F*5!hbuz9KMdnu9CKMgN?8F63rtA^U*(tWXh_ZRpk&tv2@c zbT&m-l4t2|?n<$Wyie!FGiPYmu3g1*tv+C8cdkUu#^sM1rqHAG2TL=?V?dbE^28PB z>-S;@u6*NW`F&gCcPpApTco6cY12(H&6lZvH*TKBZqC7)G}4DNZx*ZY;K7WvnY2~T zC5r`@9dQ2|8XBT+!jb5I`7e3vQEUmPb;}aDM(s3g8-qfpa@;7(Mw6fIdONv(H$s=_ z=KRJ2K3C`qUwD~bc;SV%PRd!$#(kwUO&WLSe}XCLX@960<0&P+^w?^*kq1rwa zv^W+B2m~}jz--?^Q;t3Gu$`BBct`xjix;JVtsN?y(rR&di9LJwBGku=^zJ+FNSCfA z&e0jeS0tA(?P3U}H0pKCbz6+j(#PxnO5xnbb_ZrSED5qd#&#v16kNG-nbzQ8qL79S z6R>FO=`M*U2b0cP$pofjH0sGeYn3d{3k0@40@yxGkM})SWIXI4n$4M?#fHRoSW1;5 z&Wvw#bX4-F@WK1#Whky7- zl1rR+PY415KZ3q3Aq>KXh25lKH`Hsb5fC(CJbIhnZPC6dswEK61OZm*IL&T4>e_Gv z#1hZL2M;vKUyDp8ckG~%(T%`{SEJ`Col9$xbw}pmPp%XxPG!J$bil zb8i7Co{Zc>2!zrw<^6_X$%%5SRG%6#o3nb_z#uzseFov|2L|-toVi&I zxji_`1hb zf>?atiV}}MwI-8xSlVN0r=3=81WE-6W64&pI^fIy%F5Xe!#4RLQ=@Bm%1G4u1!&r5DmI)FejLFy?rcE~{`wbcxd zn33KIUz0I=-XuCP(dKwWk2*jmlcu#bAF)MSAx+ROIB)gJCINc4i(otj^u@P8pvw{9 z8S9vHf<{am&N+Yd#_Ju!csNF4>As>?neMi-S-F1q!?$Ebo;Y!mj3ttu>|%?5ghFAN zQ&5iO)d#1bt#Ff5T2)OLkKWv|lwffz5D*AdM}TMByWIO}+_3{UR%Zv}7t>}SQIy);aH z@NnMhqzU6eCkLO`O&!>3OhkDCfv!csZgSBc??JK{ti?LK`7b{qb{^W!#F9Wf7MC#| zUX$8t9!=tz7$s60mV|6rz?N*KD#muT15ZBg-Mvd3aWtRc(hSnhfN?~oW@`m~+Atm= z^0cC@L>U5s1`x>6G4E;WGY=N;y?*^V7L(7*)Lg}jtvJAf_By;Nur*at)rNVh!@Tt* zo&XFBlDQ4WGd4cf3WOUfgBi~|@4Q{S*Gy&_Hjm@~#w4Y9QRf3~7>^KkbZ#b*y+ELG z1l;BxIz8}Q@d5T^@cw%U!d9H=7B98rfQN?%4 zTaTx=BcvU!w$JC2t?xJxX>_M~Kdw|t4*4N{!vaxj*tB6hT2m$R69@brpZhRbjjh|TsDCYMl+YoQa&Gtc-hEd# z`IvN0%l3WMsDUo01>?~LR*|Vdpq&U9$YbfDFAjgBNW|*uDxE)fj+Wq`tCi~wT-FNq zjoi9*Q?_AoxBK9hbP&o+ztmtN8Q)O56&s@s2cb}iKF5aQ(sZg1PGs8@H9#<)(w69e zWA3ztzYZX$ArcDocH4JDmDAy-R^Y^*432sqr)fK@Qu68Tx8J6pzx9^1)>1g9_c!m3 zzkcHe{q(0lEf#gqd4l?E1DdPaSh#2fwl&KDll547Vc20Q)|K5BwL{7*62O>%F5WP@ z0B;3_G-jKkX&1avw~6s+5)cABzD`htLRHm&vx#CF;(8LERC$3chvN*6bG$KNizN<} z#X4esiA-h-x$SPUS?$tqJ*vtGrmzN(U_7z8EDMo5i{mW2uWvAAbB*8IV3yk7hKe$- zsGXFz$z&#%!$nRT7P#?Z>XJ}qBAdZXKS6267X3C0taCWmij>V5=%D!|-KU$y;$DCK zhv-)(`uf*@i8w;2-pS`%rGJ4{T_G{nhrK6h$lhcSIP9xW0?QaA3ihzf*yhk@vl6!L z8y7g*C`c)$_4PGLz10e=i-ndQu(Wga%2jL}T`OLBcHm{QnH(5bLdA2fJkW&kWZ0To zhs1+mJe`2E!zGwvM)AU;5S)`r zTuLmJq?MIribldROr;rGfe1ykckazaRJmS&kWpO4rarsNMk9m6U_dU-7!Vf`he_?S z57>qy(ts%SS%#;@{dOQbMu!Zi=z0!TZD6`=S@w_r@DCILUEliFx5%j@^Wi-sKls59 z=)&h4DxUrJW3;#Dup|`}+k|mZkm6u8ODl`$w~w$bOh5sAyQK@RlPxD-yJ9Z^9Dhf* z2~HjCxXc@nI4@ngBr#{c)eeTU4`DQ{Mr(1bsgs2+mo#BKdQg@@XIc*JsEe}u(UN%h;e;NVQ z9!kN=yl!vPg9Bq51h(_D^OP=e!l<^bntjem9y(w?L7{YjW^;KrDH22Y;SZ#}JX% z7q>0bDQ~t^EJd^PvlLH8%P%SWjj4VxhJkUrGMy@Dr4wms(LD@YnoUvc&YyoU+YwBs zP?sUYI6ZE9o~8^N>pkgIihlg#AJKpP>;Fo3?%dJLvjNYrd9&)rAAdxD|K0D(B#_6w z&(Pxo&lJc~{LND2!tx>|!kx)Xuh?`DEu>@q^WmckbM#fBL6?C>Gam z9)`4Ym|PYQM%ntz-(cKkPC^q<0kO?_1_Odf8we!hDOy=umA%XxR~tJ@V2x~Lbs1}9 z+fdS}15pat`usjhL5-s}WuQh|gbIk)Av-ON7$@ko`9<1m*zjJ>G`{_dU(kR5Z+{Ev zKu`tINT9j&jg7qjb!2jmw=z9KX6E?#WlAcM7=)pZ}m1DJU6 z=-#o(KwiTD4I3tl6fP{x!<7B~;_p@+F#bRP`Oo32Z)380!uupmICnl0`I(ZM%tu$0 zJ5JTcTsWGHQ#{z|9jsN|r=%S85mvcH6H#*6RV)mnD}|#$ig)mgv81*wKa2z;lmR|)w2QzE-Zg3Zp&x>cy&;i7aQMw+% zvuh4M_r~k5)4T7!BOMnobQyZ-In!6kmGu-(DgI8wlXYO#PX?o|~5*!m^8w^gTu#G;lM6pyHZjwF+u* zuHzU_7Hc~!sxt#(_1@i&002M$NklCK@qL(s*_k&FAg_+(0A0NhDvmaDmQ!_L;Pn=yW=D ztp-c3fA@Fap`X6_X0aSInBmd>$7qlHkTkXyFSO~P;}{Q%e#t~i>3iQM_*!2q&zABg zqsq&cp4EFQqnxY`dLjo^TM}|WRvr|qAqou`a1qM6*y7 zn@s=HKmLO>2`I(;bno+YX5_1y@10WHo|-To6K{{uFd0o9Y4f0A4V%nL;cUE68mlSt z*m85J%%qUnR{WM=QICt!h#hTM=jeRqgFRw!4Y}WR0-lLSVSzP4pJ(Atr{p!}0qmc@ z|9$B*H8n+t43-b$f@zO<_g%7rB>9Fw$+HX8gL$L5Fq-NA)y!WV^ zl2MX+CTL&o1l`DLJeLEGKaOF@L1&UK0TKT9ElhEejEdL`A+)$FJAAbYE#dJi5vfI04i ziu2V@^gxw&+IWUWjZ?(4{?cTzW9>|3*YouC=GVbhK3_^ltBzfU9y(||No(09TA_KV z*oW|0_nq&2hkg?VD5p-J)`S$6G|wW;`CIS~@iA1MrRmweSLn>>S83Qb4(K}vJe?Vj zGN!|TnXG0S=pUwq8#AT&iQ`8Im~2KeTTQarX`|qs)VjSGBrudtMil$beF}T&ESwsfQMmry!zq5Yf_yver^Vhw5R8|`DuDT{U*@N zucuwbI@))>^FPQR@Y9Pgo{?0Tn`Tty29~Usu;t_}SgyVI-n;a$WOBf3I!}7f&@1EL zpaI)(1=C>&^PlQqRzF*X2$iRFW<1KNGC+si+dD{ud&g<@E@laOBcPnbwmrepj?Ha( zq%KoI1_sBWi3##2{IqoK;g)ncqyiP`5teqWJ!awoQcdDPz&kudqfkpdynMSW)NQ5p zgup%IxQ9(?K*jcuDoX1^jF{X-jI7d(Ef~7ZjiIKJAIWa5_k-7X#wMpIbbOs=FW<>~+-M@d zdSz*SjitYXrpNH#OrL}Kgvl=z!Fv^XzZ0v;e)Bhf6Q~VBpXp{~;d7AEBzDldN z7bpj(fO$u%b$VN!OXUsJHNPRH7_E?WyjHUJSejq=LI>`HmD1tIpP+l5>$G%fhB7&r z5JQ@(4EYh zTH}qoq-x-wUe&SL9W(@7`v*s)&3V<4&C?Tx7wf>xVpm|xgUotr6(I>~dl9IKZS|(u zXp{zzELJN#5)Wg&a)7c2Fu4FzsfI64utG~K6hhxs5{jZhGIY6ZJ>#Q9X2T6j)j~Ay zw;SlObtdELfm7Fsox3E4y>V4eO(GN~->v()G4*_RQPyd4w380yj?#toPw4HXpU`S* z5o*khzRLTfcnzpt;(&8K#y;BbJxVA0pQL{45cRH75 z#Ei#cwvrifR&*Pw>k**z8r~FB4pL2<0x=cH<$=%KfQuM2W?|ieEf4X=EMwbz-z(tM z(06%pDBol@*VmNe9-iTHd?0MiY^a!a-^Be^-w0fd)zFBr7W}D~vX*3i`#~+vRPSLO zubE+(@zmfM+K=!ApRb>#yMgQUAbytuVCwZ!pJ`AsjUIH4(Ei>dGzg0|Bbbm$v1+Zn zv(_tB`)j%~9_`5$ISK>>0s?`pfdEfB+0^-!(O;tFzSA@txlb#xC0dBjP$(6o6pT4I zIZZHDxAu`6(M>(J9vXE_NY-lAW$4DR;dS&)g#sOyEd=9ftewPN0s(=5KtLA+n1Kx2 z#%RbkO2M?B77`B-U6m~e^Xq7AnBYM0wtU1;)*|KqbRnjgDGcXzR2c}yQv_NZ2m}NI z0)h4*P+%r(7~nSd5G=2&Ccdu~N$*nXFPyZZhN29CfIvVXAQ0GA2x!K5y1|66lUla9 zrM>2!R)qsAg}Wx{JzuK#GIRGo35IKG*QoPd$fxNPE8n3{hcOVghsb@G(oRGKp-FxP=P>xiiEMbO>-qp z7*Fkb3#L;W8*xP-AP^7;vg= z-DI;m@a>V95(`8HM%MDSY*&E=h}%`ZD7Rw}&_?1hJemq>RxNcsRNYgW5iK(67zFZ) zGA4&(hNa_>UXqWP446$8k_|H;Y3h(^GOdioFvwx7K45YDdtMG^>XAkb__+{meukF;Stom@jf+x9~M^Pn^&nP@PH za0F?}f$3yfqA8u3wBY@g)_PdO24=+G$U{r(6k1%PCDTI$oW zX($by(RWLgyMxXa^l7bt5R6AFBo*dUItD6yRNP(#0ajb_dQ3DPrFFzF2_t%~6lOpz z&?V31jRiLB1tj?%*JY}*Mqhg9*s`EAz8;l60Yrf{Al$ag=0NnxK5{u-SQ|nN8)2MK zrIp1gtq|buUDCz1%C_NrTElqSS;K~*5I1%s0zCL9(@Ba%BVah|6pd^WC#Iy5Y*0W5 zzRKOxjKSV9Vn;MmM0)K-FlR(0wKy$gvF8m0m=ACa6i!*_@3`D_CQYdXKG75~i-|webIEE2^6F9(O*oc55liCP@+75eZaCaZ|PkPDa zagoDfCp$t8+w3;7J8WP&U_Mq@t(mah4bK$jPlaMQABpiGDsCbMro*2^oMOp1MIdpl z%?8MKZ=KdI`zek;c7xB6PixW1`A4HMFwdC8fV};^to-S)J zK`x@VLYi0)`Y8|yPz-~#r1C0ogK7XV!+}A8v(G_0PK?pi(McMd7$6%Y3cDT5#tGAB zm_!$n#9|6u1}Ax6PiZQ-L>8M_`Z#+X;3peIWMGONKf;U%Mh0MzzNIyqxiCi$FU?cb z7p=>HIGb23MzOg#Ia~qi>FuFD7$jI42-sIjr#Kb}s6l}HacN&xlgDPyXvTOpUb)SR z)bDyH(4b%KHgeuB_1vg&{)kmvp>T*+*H$SWjpx^J%5N(9ZL}K6>b20=t`RzLY7b59 z9wVC#kyJS~inE}H zlywqjK>jtX7eNg-G&D>eNIz@=*XmT?%U7$Z5#?GUfnX=H2&>nTnNx^7`QrR~f# zJ6v|!vwxb#CP$zm+()1N>=Mm<_OSG};xS8tYs+geLWo24Hbfq{;t@$8&@BiE#?vh= zwN2<`1A<^ENQ+C0(u}`awb?C=XUav7zi^BWKE4m8&-S`|Wvb=T$T?;Ptlmn*leE6# z&oe>n{c(Z8^$qu7y~YaXpS;_liYV4d0oCq7R!*0Lrgl%#@b3)Kt;g=tr*D2v!G*A7 znOFJ<8#6>h5t>UTX?SRe`g;4drKPkmalCC1;C_Wa1KvdqJGLA?!Fc3&h+l0)K$^v` z!=((?b2z*}MZziDpp|w$Hc3ys@E8q^59l_~rc-HJ^ZDuK=eKC~&U~H;f)PmxjK*v+ zOIC6RPVS@rA(%Q_EfwT8bAmUWI^byZ*b|3neCH^A_WtK|_mdeIAiybU*>J!rxrO;f zN<#`70P|sw*di4WC~YG_VBetF^YaLM zIZ7Hdh{!?{1TcQ>qJOC{4_P}e9Hjnb)S9>Y3~_Lg*viPd4HqmLh^q2U2KKY59+ zy>YvO`LKdyb!ioGgwixJI3k%`>xEOR^W84v%XX=!MvSM`-B6UbRS-yFkX%?=prAik zRnp;2phv%OfS!8w6uEm`x>lP5zg@p_i|$;wUzL_xh4X-a_xz0H+UBumPe`WHweD@^ zJTE1U!tmgQueh43z&)uep>2Vs{F-ryAbkoURD)0{HUkG6npBs*+CM{$6_Vm!F~Oy;Cq( zZq1x5j{Pumw-@1Lt%<5*61lqMqi`rpo?iX;)$rQazGJ&3i@Fc2XKCTw3K`3c4mcb) zn|u#r&8Hn+4w^tyn@3yIeYByqLvqQl*fVftvl$KP+gglAbTSRQMrl?hdYsbJDvsIu zYR$g}LxS~6ri1*vJA3JizwrW1>>O_y)8T4x{G7m2uxaz`bUZ`r%YMnHT7~*h1zwFj zvUA@g%)3qWp7~>%|70oeZl~lyA2ymA;aX>SV7Te}m1Nr;huU@B?x=5XKXFjmLy-*P$tT=F3lzYZ#kZ%c_)w>z~!N6)7;C ztPK?YD9cvi)8cmh5NNz*a3oRk@*Bi&#RwcYzK5RqI-qbGjn1QA@j$r7ZZby&IuLsj-p z$!-)s1OoaYAQ+E+*ovHi0I%z;VQrz>y3XX$QF{7Ir^p6(Fy(3?0bX+mSZx+Ma`GS@ zcx?|Bo#c731j;Uo#Qq*RF5*`n0bcXO3u$1#>w00b#TbunIO&Cd_vG8S`nXsp9^m{T zgcFFAsn{?Ox+h)OtMjZbzRijRZ1V$;*G(s$I6{Mm`znkLc)f??9kt5jyV<5t(fyh& zQarCC0-ectwm~mzjzu>2w2u8rmUSc+k%E=UPNHqiRx>^G+9?`9OdCyO*~khKKNtbF zbUS(GC|Ua|y?KWa_b3nwbO%t|#oVhqTBB(ywP8GLAR&@KpacQQe0OzKa?@XO8o|tn z4t{wL?K!*)UZ(YP$x&M7c0T48^T5%4wCAy%6;e+oo!`uxOqDML)kjP}1x)>Nx5L#| zVcYJht2T^hJM;)qM@0zug8_UGx+}O7x7vjZfJW zk;6a)BSD-myU-faL@8P#ps)$~)oc}`E3c+tJmrXp-%TTs#-1JD`fA1cf!S?_r|CU3 zHZ{_886pE^2=w;%($n939KM0%&+$53!0)F-Dj~lher*#36mlz#P!WtrBOpaK8wjig z)`%CcWeL-(!To)77?xIIT}OsYOMVzlMw;HggLb_*1$C!)rLEW-)8clW+J^u7Da(kN#=Eh8`@L_5S z$6JY+mDj2K_vWoo{SGHWb02^H5ZU{o<}7UyMYW!S^==C!oogT-sqKGc|^Q$0kN;&kIv@^#`|LUbsO)B9@>q+OE&rkEU+0u{R!X>_|=5 zYbRzLUO6GfjZs4g53(HR z=EkL)v@++Ts6R%jSV|gvnIT!Qc<$9e!70?hE&JM zT2u;a%}kr?XttSAM<)$T^wYkBd!!K9Y6y0?9khGzPMVpVrO0B*{wln=>_oKJu&3uc*Y48i zA6}wZAikl(gOa!~GiS%6{>2mpmP537Z;4Jkca(PRo9-HOZD!Q>Z_d#9_b*a(JqpJC zsCR%F7)<%O97}r~FDSSYqNRJwbo80SwD-Vn#Nko;3g>8g-xQ4;xQq88~EjCVZtI%wmB5|k22=Kn05d43YhZiuBi4H!q z7jAKsn@@Aho*S2M(I@|U9s_c0gXz?uouvZ~UH$P-KBN10X4(>-pay9*PczeD#(MUx z&nWDRY%rY~PjDS0U{0UDd7f_HxLfIpsK#@pr>$^Nv~T}jGJEAri}Use{W4}$`dr~y zSY8*9=(O+rBt;2T!bzwSw8Xs~hd?@$qM$z{lWKCA98EkkN<%|~s-lT5%r4TEvsWdx znvx20P`6JoFt0#8*Xe0_VTCTCj){nTU2HSD+4tSKpIxBE`Q=R+MR{JV*4vHsw!U%1 z?I}wf0z4X%ORZ(Mh@S$1rV$WUZB0WcGT?zM5{*!*YzMqCXQZ7+ClCf28y6L(XgEr@ zuiT-?TFE*@qj_NBmxw0l;zyS#T^@9<(L7pkUmP^vxpt32%VAZer4lK+@WCbGZ>5PH zv+hUugz}V0L2`|T%1?{m+YkYhjta3Y#dw59um0P?_~?NV>x$XZj2FR6Q}2Ecjg5{f zUTa~M&&u*D&0e2x*qW}iT{7+0swZ-C+N<89@kv%qKD;*9R2|pm*XiEP z`-&;!w%U))yfzm+gO?OtPalm;4k=az#h~uF`T1>Pm02?>gXiaF<|`Otd7hHh7#8WZU_H!x+1z=v z#A{-{l{JcC^JX)NRc^Pg-k~U5-zZH^mxFels@zb@rqywntBWKM&)06 zSz_xjt5X@R)$(Ky0S;``+$^!Ro`2E5DO21mAHE)33eo-BGmYFTyN8{$?tOf^LJVdr zLE%D22Gy4PQLqSYSH(J%@w5w$R+rn{z}jkRtCt5$GF}rX8{2INX+5=P5|5N!sGdpj ztYpb{9-A9AQjxGU#(8d*EM^P!kM}jir0V5mbt0c(@22@=!3=pJUkfoSl}OXV!v%_! z$33b?D6SceMj9L&px((ISPX95%zQeAFy-kQ>b9-WYd31!Sx3!at5jRe%%_?1nn6x5 zo@US!&%&Spvtzi)DNnrvy)-b&19|zC`oDd!L|d6%)kG5Dl30yqEL(f3Mu7w7-jn;r zDx!5(ySL^!yv3tCM#+gynwuql;f==4RdSo3~ zX%U7LiE`(xg&S&oGtJ`%Mk**yBodU)2*y(bHgUR11U7#on=C*)zI72`LA~HJt+bW~ z>`R>5H&J@3q2ov>N=tLf_odXz+z19ZFf>r>a>e<<5xCqrxrcazrP5@wnCQgw$Eep^ zxi_X-Ud-rN&1FPndrcB}-NNl9$s$cje(VRX$J0ZuLHW8AuZyuNu#xpKCFO~Gy9NP6 z)~Hl@*LdAD>h)aU=Ci!U$x?e~C(xjl_U?O*2c<+hQ874K-8T45Yka`xnzMAWG=~{` zSlLF(dZ^hz$Bx|-74+45hE+`a4(+8wPwj_Mgr%Y9Se0mTSm?+zhiLb~>4v1MLVbI{ zr22O>zphlsZ+*d!;Csr#8?Y(7%ju%t>GB|Pm{dgJzNd8YrxtJ>e7<{>PaO=R4y0+w zcr>Dpdy42S8iA>AHpz4nCeQNCi@XPCWO6{U4>5jj8GCn9ae01fYrsr#_u*;k>1#{^ zDU@S|`!!*vulb{qn7XH6=|TeFSkY}qh+ zh3FV6;Opu~*svg7wjPtivcS+3T;%Y`r65H@5%MGCLA60%K{okY(G@xF&%R@O6)(1P z25efrXa6qAu_>$mX0AUZ-`pDU{uWNW>%V`jpQa8>()iRUd3rnzOFB{pkN$BvlRGEr z{`f;$n_Vxxr0STpcJp@@=-88o5%Hk$SDV*)JYKhCzRnU*Athln((MvYp)TUP5`m4D zuDquAnZ|pk-jr<1{M*^|%>&Mh&*g>%Ja7$9!4tKDJvgjp3kAcHBhcol!W0M+%7Ih+ z$ko7pnp)*C{ocM_iK*<`w-e4!voOofND_d>jLoJn4&aTVyhfrnu{6;);H8OOV-#2n zKvF3YIaFlII0jY&QuJ4w&DMAhm?OCDZn7XWc`~vgaWZ}EvD#`@CdoBku(-1vfmS)~ zMAPO|;k%p=oqxAR)uwFnt8nXFCs2?n$R&6Jb{8gx27pS%da7 zLj5%~F+?_nu6kMqT$O@YMK(D-p-4ShC7a?YKh$kX601jDy4vxfOFAC=w<^0_5z_a+03>I^K-W56RFh*H2o%Q zN-)PMGO(!IrlbwyX%q3?U#$KeOfQU>@yHAd9u;J9z|Nb7G38M&#} zx>$wh289`Kuh&AvoDI9iVPb+n@w3To>Yx+&CTZBisw0qTQy9Tmd$yvd9>0A zT&0!bqms2CN@*p;{aYFVjTjG4f0cIgEsg7zuN*TALzN(A$yiDqsEnHWp?)3R5Z#2cc!qv9!Z~BDDws{bH|`Re;;HeeK%(+g?^3*-w^( zge)Y3WUKsO##0_rn$K|{H+H9^B(Xt&)d_1f4f;wv6sLGp181X3Dxk%^sC#fNSY3aq zFnVEWjq~Tc|o3f1UO_fhi{fK z3%oV4AY!;EWIP;Rzya^fTI?5z_@fjJWAkK}4UTE7P5D;*nyA`LW+PnS$U|9g*3!I> zisLJlCoMd1m***d>x4iT@hic2bm{~8X50QzwIK1x`Z{`3)TcaLvKg*gIFx~miKzrI zvKFOq1P(`KgsIG|g^&3beUyf)8!eI(afpmc%*xT7qVRN(j#e5sm`znA9xaG$Q662^ z4O)as1I6U@)%k5H#NSxVo`Xz?vfP4n$+Ull47HbTGbmE8>n@u=J_xro>aIR9Dr_c_#gnG|EoTsJx ztD3wc>@9p`YLLwETA(DcsxP=6hBczRKUxvOT&UTUAldxAEnf!H;C)k5YyBCI8mh!I zU4eiFj7QobUqUSp`pXa3D3w%Zp~ayL28ISI@+-+&(IF3^7e2g#MRScdWhyGYv75u; z2;I4Mk9hBq7Ac1~Jd^t-l&zIv;0gJ|&3vIbVUpfA)TbyApJdS%i&Efzs6yIwA}T8H*Q!iv`;pq`Dk*6A4Em@@ z$`N4och0CEc-4B9aw^3WEki(hjhbN~s^5JsS^g4p=d{}p>KbuyN>dJN)DLdXm7d!4 zm}l7iBmLy*Q@B1+CufetdFRr7x_4`)&Rwm)#C2VsU!lt%T-D5yjn!QKERXl?c>oUxyvD z;xYpRR{6|6n1|0aWg7u_Z_w@o(-n-YnR>Ds>*^=hXlZU)vq8QYdiYu1XY}#UJ|W(7 zq*Y?;!ihcO;?p^7Ax5x z^^~XJT8LKXebv_p%5N_Dy<^V~Shp#2_fqnB)kELxI-URE0{NELG+D&2T1bN@*L>^r z;ZM&}a24JaG)&%!UK$)6P^`9#C*m}J5$Zn6hHStR8LQa@5cv|&63wSusW zmTmV#+8w+FYVC1VTB9X=Nt(GctGISHyOs7FnbvFC<=5(-K>{ZH%#s z=~MjxM2eNARXY2xpOJ4C3{biHJd$UhYv_9R_)uNvJ;GF z1CyF$c=DnF;!LDRdZlv%T(V!Xa{ z>$7_@ro;6$!@|&Rsgz>1z(V9vAAu77U;oA~zbY6{mp5Q1kk1=Qo$x#$OPJxW-d(5V zxfR9gHn-bF`%dlAe1K+2$G;e$Pk(-%E`53#Zgt|?mr()&tE>{qBwaaojo$syhmdsE zakYFkrQ`t>hb--kPmfC83b;HaDH@5=y$cUzYBqk}=CnyhBTDiT_X-4*Ah5+4kFpm} z2~gYp-g+}Jwt(vGtyJ>_Z-!}MX;GS4E5VQV2JP52L49Lht;cDJjCeRfpa0?#z5C<$ zp?X`Q1Qyt}PRT@4%KPmfzDwtSagh=s?aN@A?JgS~JicEsb7v-X4NXFV#d{IG4pUHx(u%YyN~arsRKKxudk0>h-1U`Q7S#~Gn~TM zu)4msP7m+SLYjC$%zz5l8l|hz`*Mi4ci{28(%zj$pDEmzfC}{H*1aGI1v*qbPZ`O5`(TwrvO68Vs=I*Z`FGTlvdtf=XVadkpD)S#M(b5YmxQ2D0 zvi&~wYHfnY>fQUNX?|uwG7PA9ui9(O5ZL7V=4W?k=GsFV-aSM^V}mp>&<{pgU_$kC zX9g7w$7p?Zoz~XYXk~ttmhbr}9*z^&Uq7akqtRW%wD<5H#bq!}cdp(i{{kYOmL`bs-))9JwBl2z>0S;g7fsuiKRqmNOW603;k8aV_^aMFzqT6tS zXy@{{=+KD+v<`3AiHKY!)Nnox+{o)B$#{xpugpuH1neFg0@K;a+2cf=;Jg&loE_G7 zEDf;4$&2!dc!DBWBMFDX6bVHr7C^{tsME4(h#@>(1k=$oSshk7`t)IPy35wq8Yna# zNzknucPSl^@3Uftw1_N^DP)H$!p#XD!%F>hZWMOsjdV=iE;(<^#ml&!XZgn^zxy`WTJx zA5#=+p&}y{CzziwBg&*Q2uq!&bo|i=$9#^jDP0RvL5A!RmP*F6mn202@%N`eu`nAb#kGKvQEv3no2UReftQo-P7js|M_}d^}i~W^>%q z#545S8w+&r+Kj3hx()96Pd;;;`X~BY&U{Mi(Fw;c>~A{u#8K+)Q*Hpj659Mjw8Psl zp)QM@z-v1mcaN&}=>%K^4c&#n)?z$GT}XE|f)Z*wowr)8R_gU&0AtluNy^5va9eYk z0zNEg%P*DORsE1>`F#UkI`Ql=a`$6n={8L);hcKuB#n#@tCF;$2nT-Y!)p`|RGN18 z!=OTMPX$fQ=GC@&sTx#m9^3M{9A49`!Z)>XpgNNAw55YKj+wY~69oEt`^k#+0$D<% zuHIgwtCwy-eyzC*M3=2caenGc%}A9?B!S)FB!O;wKF@sQbWrpLZ;oTm0DcZ*Y~VPHK-XMc2# za%Czu#?*^FQzFE50V(m_3IsG`JoWS^f+e-0DLbo--kx4^_rQ5*S>yYztkcyCH>ABU zYA9w0mWNIrq+`z>hU8;crE*eJZo8gg27COuBQPe|Lzc2If^BuYk zN1ePMMoltdBkJK32kF!oPD;*1dC`0;CT2R1zjT}q9^Fq?7+9!ESmU^H={DWF{IFsY zU^JVk-`fv{rrbJC6)obS4n&|mqmW=c9oQAN3Q118lLm(RE2@(=rRn20&clJ|s%nXa zy&&v@XM-oc_&D{BD7WycAgaSoI6V$}_N!0Q-h+^IRG3Y3b=W9l?!h8`{>~*zt)(hz z=!Jhhk4x;^sQ{*pC$`H*e8G6y*vYnf(Y$`p>+x3Xu4jw4@N9(MdE-Nh1fl*>nOO4K zv1^iE_}a5Hx@TCCOCFU)>i!sGGdwj!U--2brMj6Qm8ebr)c}3=HUi+?@K$%1eetxVg92ecB_t}II%mpQ1qmYPB>^Xkf0*^G%VLF2*lP*; z8X6s-yF2b9-pp-^!9`5@X4cK}Y1MURj1H{ju-~+c!nb<4`JWS4!V8$F5NzVhf>LOvB*w1Fk4Nu^Y9cMIKEHv z%D|qlwMe(G-J=g)|5WmnU7jDW>kJPJkrh7mL=p(J69H{{dpm0&%I+EjZ17$^Ha14H z4`-z~I0eGlZ&>h7nBMx{d-Rom`w~s;9&c)WgY#u|RX<|tJpSAX+I?u6uAaL=OAioj z6yX)v!Dl;?(QL%VR|}0!jnbjV4p9G)mrN#;CMqv>R{G%fEWQ8wSqeVb@D5(6CmSgY z4GxnF9tuPf2(%jk!Fbx;0^6v3R=KfjmSMQ_Us_y}ygL`G4@reB-TvjfZ_}&aK0}k! zU_J^0#})G_JCM96V4?nnFF!-UwII#heFzid1qv;P5UdUHbFx`Y2L7^QrJu|Uc*CpB z0|%UgZW@^wqFwu@rD&|Yz^_%}I?N$p-aG&J5&3Sxf~`!&z-0{#4q(qtpEgCZSSgY& z2q4&o>U_JYRRrTv-OStTL9IG94}yI?eUwV45v{axA5Ul|Oh5bHJ9Oro&mew}dKWR} zt;0;O7vZ;$&lWu^TT3MwsyN5GiD>o#0R z_9ERk)=LB9ebk3dnrx-!?sdtGE6Qn9^IMX1?mVQo{~k=|F5(B7{=48%HxD8q26d8IO9d-&nP~`L6EAhSf_$eS;XJv*cUx z$r}SNPT*#U-udB&lz1gc`;YCBB7e$nYVMcQ?VxGT6r`O=$#qXO5}|k^0ngb1@-3`W zXbn+C15qh_HOJg3zRZQ0eqjVfQ!tZZ*FCOY2YCiO)IaK_-oajS*c^yliVqxc@;%HT zB<9o{>9VJpwi}mk(TCsvjQlgfDolr{59&NN>|h#15(qSk0A52~S(s*whn;APBoJs6 z0ak$xW6goRCi~ac<&R;_$A3LU??yhNh(AInpFh^LiLtx@NG4zeECspXtBgOK#wW%o zbtnyngdlHViWx{iaqNdl#*>uBx=<#?*RnAC&WFLaSj|#6Z{Ent1G^D!f_T3Y*R3>Z z&2Ttx4%L16+*SJYCl?XaEm{$3o9ouo-wR`ckqUZBX%oi+focfwXl}?AW?I$mXzrZ+ z4N;vJYbLvYCa${r;z3miaQv4sY-Hq(EP?faTp|GTiO$FAqu0;V+H!!N|Jswp4lQ{= z)hqD=e7UE9p590O8efGzUaE%Elb&kzWF{64MiATRB3=CHHA;mlt@W5DkJm$EgRS2r zT8(CLuKN(sdow7v+P~hS5cdB( z`|4>L9v{+N^;WNrMaBYt*KR*rnKV?BSQq=?_0Q<;M>7>t4%dU}?dk8K@u6`c>C|gj zajmTgXu^2fS_4sd*CW8HsS&7zcvGVf-VIotRhoFg{=xfmwEi$aPrP=54jkPF6_>sA zmMwkE%!GZ~-Me$2KK}mss_QunfYD%ti8c%g28Iz$w9G}(mPSZauGU#% z%x9>782-bow79TX!F&uB1BK?o^xj{erG;0Q=*Y2yG_`MXi=wenEoQn4bIWw`5&e~qMS6sQewtZbAa1u*txKh+9n0w)q9;bWOO9s(WYu5m+nOX11f^ZO^!{H&w-7eK0l?aL@Uk4vb1z< zm40~XP1^ay1U>fZaT>x#O&9jg7);3BV-)!_}gw_gd$I|Ttv7*7tbNT*at(6Mz8U}u&i1EUfX^7(v{^ix%rfL?t6 zlUbVmY>{@qJVm>Y?xgYYQSuJ;N>*Na?4!{FWtLc2!tt*LX<>1Z?p~asyKlmYYA!`a zgb1&d9N3sTI5-H&5UMq?F|-y;;(P}qpb6utJul1Gy!I>9!N>^GIsyS6SUH{#djjwW z;o@c)swZslEKlqz23tJo=9_ov{s#|f__0Bn*fmN!ckZCEov@fI4@6gco+8&Mdma#v^=vBuRu&`$&X17w8}1~V>^1OiPV(55b=3FB$1 z;^JX}Km!QatTsulD=@*F+X#t5i^S@) zG@PKaRFj5u77m2z!L@n1fAs;aF04^14A(me=m`p=VvS;1!m&AQl2>Uj9IJMWnRJ0} zEx;0aXof(IZlqcMT4vOlj7N0rI&EBV+*0S3Eq;k-`~!Uh)a&jce>gyaV1Q!bSl;VF zwYLxbDI3p%Ng;f|>LSgaUyufU_mG>$4i3@aPJ|4Y>?1d#ftpPgi5XeIh$I&}F!APZ zmO2WIDGSEJ5)AutW9A|;7%&<(^-gC}k~HREDi9GSX3Zt}XkWJ7?wt&o~}tvADMD*&{O>d={tXVbTH8?}(AYE1;p77Go+%e4pQ z*O7RHf`I^}iwI?54OUZ)#$*2@l@>c7z4cz0ZoYe058_0w}Zan_6!_XY;Y1mOGugfG5*C*zWQ)D?tvAcm6-T(j&r%6OXRK*x22x~RC zPoe?Lrky<84m?2H zEH?6B{U#&oUD#>=tL^1P+N1^dW*LTg>nj9iLh=b*anqKmK52 zr^ILwRocWq6eJFN?RG=D>GP5uQCeC3SCern$XDDd5KxQ2qb{xX@lBu8gz-QT!Sl6R z??#WCwi^O$guv@E_FgO5 zd#s3~gY}(giqfzi%cgSDr(s5<7Q9DHgx7*NPLIWHC2KDN#`So}+dD`D!*Fra-!ECH zg%J!dfgp4_4mu~2K%j*PXgaAlUdh>3BC6sAQ&kjAVESPA_jqg^ct!}Fw#RGAQTam4nhbW3`L}eHc})CiWmfy zktV&5bP|eS2azx0yno?)j`qPi*!$#J_g-t?*ZNEJ^+hj3?3-13firJVUS!TI2(+(! zIUd2T<;^SXO^e86qG|9t4PJa`7&?Pc72S}J;Dg6dFtOseKy1W*MH99K)9_=UX z59yO#xDgYLB`IMHfknj85DFm+O`3_^Cn#dZu6a;s`RNGHo@c1`I zH_}y2lR-%F7JbebP;3IL3^D-sCTpK}+78#$?xpY*d`p=Y?yAZuZqDtHnll=&J+!a& zn=ev-4jwBYQb!NYAocxv%y^^j4z zUbZjiyr7dXx1ii8b06zBg1LDP6AJ$-&-5U+cqI4QlvgtP5f{#mOQtY7YLW&%FiqXG z?z1&5r`vMccmZ%_)f*Ouo9EuWOO$`u6!i(sMgo(#1iDXiQQREJPm!tHmO>l4LN*1I z4zVJzBSMMp-23e`bV^~N{oBM|D|$;ynC0b(cd?910PI6RTXcZvujmcZ_UZ1( z6H6l(^GrpCV7gIS`z&u%o1br`1p4uLyGeUH4dm>S-sAbQfPcfJUe;yOLqz^%ctYU2l`Wz5@F1C{+F_{{%Sc zpZ3@qdWp`^6<2GMEKwr~w3w6mFXE=mu*&KqP$^f)^ub}|XXYkEkXP6?V{37K-)%C{ zO~W?UXef;9(LB-{%Z5$xnzL2C1CD7Mf6W?syk@oPpK}hdj$~o0Z3HzKMoEdy);gfw z@z(oH;Hbe`SMk2~(T|Om*rQgWYU#n1whbk7EoI9mC1d_H(7c2k4x;{*&ilJRNHU-qHJBx~Q8%#%=4*R{F;yhwcUtn=M{d z-j*aJnLXI4Tc*3=eLL7MRF9?^(rC0g*4it|?m%d%K`!M3&YAeaC@b@fcM;6A(SE^e zeLIkET3fqlegZlfbzpP8nO=vD?Xl5mRMrL__cIcx0pg|p>_wPQk<_eNn@M|~u&-)qb=|+{yxrkfjo{b@o$C(i!8GX_GRPMrN~T=wN}4f4rUQrVg^}=wB<_lhb!RmyANZt zOze<%>pjhg0y#cm%7n&BxA$tF0!qbTWe-0{sl%Ja{Pc;0?xcq1(dV|48w}iu5}IQO z+xP?sZpIfkyfPSnGpq%Ym_zJ$3gDHHo=)9(7_LD`^QHp3nN~J7RG521$DW#9L&Y;l zMx|$L%Ou<4>)IEL(Yr(m)72p#H%p76mGWyx@?ItTUj4^Q;uTzigtT}($s{}5Ws$ck zslhU;Z@W+82EkGLB2u_9wPdvSXd*4Ow&RzAVFGbjhOsFz$uL~k$uT2)U%_|u;YvS9 zS>MFLd7-{3)Yn9>X3Z0+5W2+TF#2{M=j-T5vopA`(Nfsx5uqtB8;@`0%rGD~a^=tR zv@)BQj>+MyNQ$Jx(hnS@PH$K!aj?$OTTL1YpV*RDc1AZ$5GQHZGZ{4}UwB@+-pl2$ zhE|1#ulbE^TgZ~2_96UGxv`)a(xTh36}fUSx(BGT)^b1a<=;GEZfw>L^L~Xrp+5yk zT8x5f&r0hUWu&cI72y!nUNA1CeQx@i#O`CI$l>)gP!F0{)Iv$_`D6<7JcL9i-Y^wf zQdC^3j29r?^;NLsBZbY#(}Z&mw7g*AdyJES(&ju?&AfNAQdYH+jrv$ z?E-hk9_|S=6%%Yfr;3)0DcyJ#r)O$Z*BOVc{QB0XxZH2c1xeq)lSQv`YO|+?SENYH zi#20g*QKvNq<9-_wQ55sW1vF%53^{bX)Hla$_f>HLtN>?7bzT!*s-JK`ee9+;ATd% z$Qp!&9B(mJ2_bPd4B2e0PMXG9iT2nfTg|_}Oa4e030i)cxnxA%XWHUB-@;rC2uPZF zrSyG+s&(qH19Mp(*e7$Aa}dIW#=%ThIS;cbMVkH`%QpIFhTcu?>Qo9(z}j19@NB)@ zu(WY`&Ov3AO5?9pNSnTrpzLDFVYc1V`DV}c`Wr6@6FZa#PN*ums|=!xn+7NZ_+4`!$*Z`X`cL>Kl#=a8Q&(CJPUN(Or{M8y$QzfObw#o zGch@DGQN(BeoOX|znMHI8}C8;%e^9(1J1U+G(x?8O5Vzp=Co8=0J`thAB5?iv-*ZIWdVM~p82w7j?I_7@DnAn~+#X;XsCx2>k2LUv?bN=EU z^yN<%DtX|m3(xFzlL!8vT}eYBL-aYEpV6)n#!Wr(A)i94WH{d4nt)FAO)##U{+KN; zy-9E5OGXF&3JCmJqN3_7EkqG)cgh%kv?!_<_)^aZCf#(0RWuOrE`%GS1u9BRH)O{S zbag`*90CO9o@#m^MM106cKIPBZdave4qDHyUM(aii8_FpHB#QX<*PcFMMNOj{KXef zqrU;rw?0$y6?jJIFP9q{n9xF}F1bGTI)K2WeuV{R-&C16E1yS{yH6Vp5@#&U?K{$Y zLSSs~CQB+*{%GXEKUVyESFJ1C)WQvZaAWqK%EVr}5hLJygZd!>_rQ4CUzYj{xra#s z;KdQe(-+JF9kmxZ{iC|Nxl46sl{9)hBmwtgd)s2!R?JcQS#?=0voVB)srItl#D=|K z5K0FuTj-rLK3Fghx_!cDphJrl&UQ0~8|v`Za4Z92aBc`}XCoC;U&){1y|)r4do9tfCXr0YAHc+}-f> znl%Y~_i$>_u%ZgrZyp06wp&zB_fnrN3qQ6eC(Kp#fzrnm+dooifPL(Ak>5Q*XZ{9` zWvF!wAFg9UmrMABviuv=Fs$~wWeBNo5SII&=px+3AY2v`%KxaUvd-U?lg=44>vJao z9n!J+njEXE=iuu6CUnNa1_Se}`Y8auOoPKzGS6`#?{bCI039;&);$73{MTFM(;J?c zM)a#FIu-&$J8PYCruB>O1Xcs}TDJv9@ej^mb(az=wm|;AbYEfWEa3y%1*j)rthMNq zo}?qSgcV!HH~^)0JfZOdSgx}`d@_}_7m|Q{?U4AxQfZ;o8cb(o7$O8LP;uE(TwOr( z6Y2vyvvb;ARTUq|Lb>`0j^fd_0DrpoYy<%C2TtJwVT{{r6AiK<{$W*oW%nWX#gE^B zgNC&;j@pCN0J;Kz4{0R!L`{BnpTxT_-z-0IcxpdXgYAQPT_0*R3NWde7m<{JLTMyd z6kD-|Zr5lDbnSvN?tWDMSvHKCPx%g14`~GZ%dy9-+^?VP{q0{0Cd}o`D_UH^Xi9sqdUMBV$8$&7uCqGlbi}TH**vt zU6NXoj$cS=RRew#cncf-color-bg.svg \ No newline at end of file diff --git a/index.html b/index.html new file mode 100644 index 0000000..11b91f4 --- /dev/null +++ b/index.html @@ -0,0 +1,323 @@ + + + + + + bootc + + + + + + + + + + + + + + + + + + +
+ + + + + + + + +
+ +
+ +
+

+ Your OS, but Containers! +

+

+ bootc builds operating systems using containerization principles +

+
+
+ + + +
+
+ + + +   + + + +
+
+
+ Explore More ⇩ +
+
+
+ + +
+ + + +
+ + + + + +
+
+ +
+ Motivation +
+ + +
+ Status +
+ + +
+ Documentation +
+ + +
+ Versioning +
+ + +
+ Adopters (base and end-user images) +
+ + +
+ Community discussion +
+ + +
+ Developing bootc +
+ + +
+ Governance +
+ + +
+ Badges +
+ + +
+ - Code of Conduct +
+ + + +
+
+ + + +
+ +
Overview
+

Transactional, in-place operating system updates using OCI/Docker container images.

+

Motivation

+

The original Docker container model of using "layers" to model applications has been extremely successful. This project aims to apply the same technique for bootable host systems - using standard OCI/Docker containers as a transport and delivery format for base operating system updates.

+

The container image includes a Linux kernel (in e.g. /usr/lib/modules), which is used to boot. At runtime on a target system, the base userspace is not itself running in a "container" by default. For example, assuming systemd is in use, systemd acts as pid1 as usual---there's no "outer" process. More about this in the docs; see below.

+

Status

+

The CLI and API are considered stable. We will ensure that every existing system can be upgraded in place seamlessly across any future changes.

+

Documentation

+

The project documentation is hosted on a different site: Docs

+

Versioning

+

Although bootc is not released to crates.io as a library, version numbers are expected to follow semantic versioning standards. This practice began with the release of version 1.2.0; versions prior may not adhere strictly to semver standards.

+

Adopters (base and end-user images)

+

The bootc CLI is just a client system; it is not tied to any particular operating system or Linux distribution. You very likely want to actually start by looking at ADOPTERS.md.

+

Community discussion

+ +

This project is also currently tightly related to the previously mentioned Fedora/CentOS bootc project, and many developers monitor the relevant discussion forums there. In particular, there's a Matrix channel and a weekly chat meeting; learn more.

+

Developing bootc

+

Are you interested in working on bootc? Great! Reference our contribution guide. +There is also a list of Maintainers.

+

Governance

+

Reference Governance for project governance details.

+

Badges

+

OpenSSF Best Practices

+

Code of Conduct

+

The bootc project is a Cloud Native Computing Foundation (CNCF) Sandbox project and adheres to the CNCF Community Code of Conduct.

+
+

The Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.

+ + +
Latest from the Blog
+ +

See all posts »

+ +
+ + +
+
+ +
+ + +
+

We are a Cloud Native Computing Foundation sandbox project.

+

CNCF logo

+

+ bootc, originally created by Red Hat and donated to open source with ❤
+ Copyright © bootc, a Series of LF Projects, LLC
+ For website terms of use, trademark policy and other project policies please see lfprojects.org/policies/. +

+
+ + + + + \ No newline at end of file diff --git a/juice.css b/juice.css new file mode 100644 index 0000000..fb619aa --- /dev/null +++ b/juice.css @@ -0,0 +1 @@ +.text-center{text-align:center}.pos-absolute{right:0;left:0;position:absolute}.box-shadow{box-shadow:0 2px 10px 2px var(--shadow-color)}.heading-text{font-family:var(--header-font-family);font-size:32px;font-weight:600;padding:10px 0 25px 0;color:var(--primary-text-color)}h1,.title-text{font-family:var(--header-font-family);font-size:25px;font-weight:500;color:var(--primary-text-color);border-left:var(--primary-color) 8px solid;padding-left:10px}h2,.subtitle-text{font-family:var(--header-font-family);font-size:20px;font-weight:500;color:var(--primary-text-color)}.text{font-family:var(--text-font-family);font-size:18px;font-weight:400;line-height:26px;letter-spacing:.2px;color:var(--primary-text-color)}.subtext{font-family:var(--text-font-family);font-size:16px;font-weight:400;letter-spacing:.1px}.content{padding:0 40px;display:flex;flex-direction:column;overflow-x:auto}.content pre{overflow-x:auto;padding:1.25em 1.5em;white-space:pre;word-wrap:normal;background-color:var(--code-background-color);color:var(--code-color);font-size:.875em;font-family:monospace}.content code{background-color:var(--code-background-color);color:var(--code-color);font-size:.875em;font-weight:normal;padding:.25em .5em;font-family:monospace}.content pre code{padding:0}.content a{color:var(--primary-link-color)}.content a:hover{text-decoration:underline}.content blockquote{border-left:#e2dede 8px solid;margin:0;background-color:#f2f1f0;padding:0 20px}body{padding:0;margin:0;box-sizing:border-box;background-color:var(--secondary-color);display:flex;flex-direction:column;min-height:100vh}a{text-decoration:none}a.external{padding-right:1em;background-size:14px;background-image:url('data:image/svg+xml,');background-repeat:no-repeat;background-position:center right}ul{margin-top:.5rem}ul>li{padding:.3rem 0}p>img{width:100%;height:auto}header{background-color:var(--primary-color-50);color:var(--primary-text-color);padding:20px 50px;display:flex;align-items:center;justify-content:space-between}.logo{font-family:var(--header-font-family);font-size:32px;color:var(--primary-text-color);display:flex;align-items:center;margin:0 40px}.logo img{width:60px;margin:0 25px}.nav-item{margin:0 10px;text-decoration:none;font-size:18px;font-weight:bold}.nav-item.external{padding-right:1em;background-size:14px;background-image:url('data:image/svg+xml,');background-repeat:no-repeat;background-position:center right}.nav-item:hover{color:var(--primary-text-color-over);text-decoration:underline}.hero{display:flex;align-items:center;justify-content:space-evenly;height:100vh;background:var(--primary-color-40);overflow-x:hidden;padding:0 40px}.hero .explore-more-container{align-items:flex-end;align-self:flex-end;display:flex;justify-content:center}.hero .explore-more-container .explore-more{position:absolute;bottom:20px;cursor:pointer}main{display:flex;padding:50px 100px;flex-grow:1}main .toc{max-width:260px;min-width:240px}main .toc-item{padding:10px 20px;color:#424242}main .toc-item a,main .toc-item-child a{color:var(--secondary-text-color)}main .toc-item a:hover,main .toc-item-child a:hover{cursor:pointer;text-decoration:underline}main .toc-item a.active,main .toc-item-child a.active{color:var(--toc-highlight-text-color)}main .toc-item-child{padding:0 30px 5px;color:#424242}.toc-sticky{border-radius:3px;border-top:5px solid var(--primary-color);background-color:var(--toc-background-color);position:sticky;position:-webkit-sticky;position:-moz-sticky;position:-ms-sticky;position:-o-sticky;top:10px;padding:10px 0 20px;max-height:100vh;overflow:auto}.blog-meta{color:var(--secondary-text-color);font-size:.9rem;margin-bottom:1.5rem;padding-bottom:1rem;border-bottom:1px solid #e0e0e0}footer{padding:50px;display:flex;flex-direction:column;justify-content:center;align-items:center;background-color:#202020;color:#fcfcfc}footer a{color:#fcfcfc;text-decoration:underline}@media screen and (min-width: 1280px){.content{max-width:60%;min-width:800px}}@media screen and (max-width: 768px){header{padding:10px 30px;flex-direction:column;align-items:center;justify-content:center}.logo{font-size:28px;margin:10px}.logo img{width:45px;margin:0 10px 0 0}.nav-item{margin:0 5px;font-size:14px}.hero{padding:40px 30px}main{padding:30px}.content{padding:0}.explore-more,.toc{display:none}main{padding:30px;display:flex;flex-direction:column}.sidebar{position:relative;width:215px;margin:2rem auto 0}} \ No newline at end of file diff --git a/logo.png b/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..f212ba6c84c523eb975a632b9f9d9282665e0fa0 GIT binary patch literal 56323 zcmb?iWmjEIv&4eCySrO}gFC@BxI4k!U4y&393Z%cKyY^r?(Xh-56}A-?*7Qy>#%30 zyQjLU`lphD6cRi>JQx@llJqxm6)-UHZZI$iE?8*LUugR{=D@%Lz@)`R)I9W0bG~?} z4K5GTM7GIBwPBWGTGL_CmIPtC2epYo(R8n^L3G1WLLo7C>qTN&BmDFBzIa<+fAPD? z>$RK6Xn;#t8>i0rxOpWewQ-9Z>$u3s(7;ty`Tu%khMjg=ItO;X=JNh6_CKlnOWYat zp#0yjI{~_lN)Al7b~ktTFn2L`{tj9V9E}}K;tgl?W%OzdXpL(1YYl6SWQ=BvXY}Ju z9`#xcTXoS*()H1G4UZ3xG*0#(FwlKI0No>=C!P|(g_Gc(%Z}WB<^Ji8?!M3D6HEB% zm_N@Xj|C3_00W@MlgE1IA>&xj_SISK^AqZWH*ZHA1$S;umgQ_|4hRqE4p_|H)TF^< zAqSl^tr|wb6uf}|$uWhL)zC@rNak zz50jFzQZTEQy6?CPpFfWd-$nLI&APfyRJwzjsT_8mC$NS@LQ z9`E$#kSO0#PC10X|Lvv>RnV5yrOa0#pd(5yYp+}RH7wfTJG-n zU+H8fXMuW^w(4MPPFb5G%JG6d7!n?PvSbXtyvblpDP5olr}aHyW~U+9cn-HgfIp0U zj$~kGj=BX<#t4YFuu6nezejT!$~rkELsZ=SF3dU&=+)SWMcXeQmp^!aKX#WuIlnQ4>3qvIw5mzN2FHpi2Dy;heedLmvz=`60$sh-d%tK-I_ z?Hd>rV$tzT?$Ua*(ac!x*i8{b#!|sq2oPp~X|i=iZ4mq%ex6xo+^0fy1m{7#xl~J8#R^La{C!D56@v z$GtJN5(=L&ae!n<=K)y?sS5s82J{T8FJ6cV=CI6?1JEeR34AaXdwbDMa(G>>`i7Jn zO%9lOeJB%S^LQio;xo-MbBzrH~pzM%-_yBy7A zOaP$u9b=uL9h}(z+c;A)d*JvhwF9x!d%yA0!Oi7m@#_QBv*TI6mg_^u)@~wV!mv|u6?~q-QH|>9 z);j{r&93gbGDnk<1d7rl{G$L4@hK(T0}9|h;%E5l%7g;i0XXSP0R&y|`oHZ2Ii2Ti zmWf(5cmy?c=3TIPE3;5WyuKD*e=ua%YL5P~$+$gdyc`^!2zpe|;mF=# zHy0<@QIE8WzbPj;)!M!&@H$>My4owcA(o?!>XTO^1o=TD5{l!on{(=k!BK9R%;!Y? zuO57d^%990`znX98IRQ1H98t4lfo>qLnGHH=`?~YYy^b@qkO;;+1|^n*QPv?4KR_N z`=B|1osIOapy&KNRRtw;1?veSY_YWoL_Bt-GhSD58L{1I6PL4RdAm*3cl|tp>3gJ_ z$PDKwY^HL{X=65k80C7A<|8f;-u<&C0pucN#5YHsuw?-a+D+?4WMbjU;(dW?XuI2p ztik$?mT+IK=XJ-b_pIMDKX#y;={c}OeiauNn`#t{X{iF6Q0gSPYrfoybr$O@_Y)3qChYFGR8lT<&C>lt8!J`{Ez=ca@1; zzMAYj$nK_oNa)mWXhsYhFhqy$5t)^mt?Hk}PbQ%DcXGJZmt3>}Bi6>U)1cMnj<@Hi z-TM=6yNu}O9yZb{sBVr~i?QPCJ%+wUjR-Y(M!ljRasM3;|895rP-DFw@J$G+BOhup zv*|>9=C@5T)&w{TF+ni*&se1k>i zAW@l`Mb!iBdJi}DJvU_I%blUogU%O@490=>fQA}RzVYd3^$!9OkH?~^4OTS*vHE@3 zSy330P-0Ggs7dy<96%Jba5ZM0uH0;r^d+T8(FxjPMgpzSli(i$TQB5~jPKU7zP?Dy z>{$JzN}tCPBZ@C>G2v{^6<>IMaKv#SH}E~dCx8MGAugXfkNfM|#)8fEZolDw@7juD z($YuaA{K$Jm8X|DtbYckMZdoJMc|RShqxZkClQefw=3ULkCh?8eeVApnF|fKM4fkGyqY(tK#@E$D1tPxnJBVKSeDP%8$gwL6eB4qQ8h}Wg~XA(7nSd5e5 z^#wgT3NbrZxJ}8(_g_N_sGEU@&OoMw&lD-qEbvi>YEXtV-^>?rxz|k|_Mpbb-4F|> zuv)&&P^;DjEInqX^VxS~q79(QN_pWuxnfuAwkt$ovlPsjjigue%{sx3vSYD<@+Mg{ zC8;6S>W&f#y4F3f!{xP)E@@hhk+s!&p{kTxUN8-*TArVu|1e)>Faj&8sLkW5o>njX zxr#xf3Ohgcus}?zFIY-$0u}BK++?s{%^0bF=HGihs0>A7sE`dfzV}l0KFC+hW7d7- zuUQx@KIqiD0KS+1SPc&<8cn9dz+%wP{-s_eiM8Pw?sPCAufM*2d*0S04ypCjjyY|p z9y7F7t=Bd^Na8PQHj-Lm+#d<|ORbz-h5Y%BL|8VB2?ts6-Iqs-(bN5C=AZiXnLk^V zSo>!cj6`dV{=NG;L1{6U-yM!wZN=E5~%eKF%`TG&fS&i{G;NbfvjGVNz zG+ijHL=p+d@L~#sMs8}2Cf-iHma%Z4E!5vbp&Hi{u0p)Zb|SkUkO^(B$8#w}8qt^s z6At5Eo1R?2`C!=O zt#W@{Cju|}Ra@e(@Icq+ONbO_dYoP4RP8_{F9#^!t}>Nxk<~x_X_nACY|OC^Y_xH z%C*7L(o?8zJ%z78P#sQ2G&@3gL`aI(X>&U}I;`6PY6S`e1WF_um#dT%5}o53V4ZH8 zUUmf*9xP%suEIcd-<~c-F@Fn1Wku$)Ul&bbSQ#VH9cc`w`^-C2ie1kFF|gcSBuON1 zX+HPR%xGYH07mv#@9Mi7r@axT=au0Glu&2bjo$|1@!IDwL1yaJy0)z(-^$ZDts={C zDP!=&F}VE%fS-4EVradi8|yH5Dy?!NHk1BwJYN16wa_aRT7<))K}b+`KI?>uo- zvZ=~}5ML@EOix>`wgrz2C{pX<2upzSouuyW?n`L7+q+#|pn{_!gN#4%6m^7%cYO_w zLVP@xnGfcz20LHt!yJ8F&?}XUAxG}8R(HErXeN6iAhHFaBO>F$R2X`55a*U&^OVG) z6wUZqNO3eE%_)c=j^GDl^ITduL>sq^1dD{H2CCP*El20i$WfI1a(e!3g44=pavC$5 zj%R*fC3yM@_VCO11-TwW{HMTNrbKbw=j}2|Phx?RG(&d1H>z0R-9y-lh>t-}&Uqv< zcUU|eXe^D1JT*QZ(`>(C)3HwcVo$Z z%W-)`&VieMkm)q5e7r-7k56GSXy~Xi*aR+Z4kZ+s(!frzS9LXi{%2XZ1n)93?ZDEUOhBazL2U4W`XViX<5Y^xYb zu_p9)N_%F#4p9))NX{V@F1DOr*irb*vEk6|#WR3EYfc>qG{M9W@#!-K)1yO~NAtOz z)_*U;v~6KsSBe(-->Zh{D{>ZP@dy7ZwVajvc&kSZ;6oA759_!si`HhyfP00XHxN}h zD?;{2@p67>6lOt6#e8~nrYIW8C0G-i2gmnv<5QU7#w9}v;IAQC(7Sc(W?W7XFv$3f zx!Yz%K&3t$%-!>;x}-xz+L#62l~R|Nd={3V)zJLPneq$mh_g}7tNNEEb&;iHkUM!`Vn z-nrcypv$2{@o)qk=1=hN{@5&9)O;ciNvg+p>7N~#QzUA%QqoQG5h6NoIE!{8XjCkL@kNYfgF3@+Tg{zK1wqJu3g}8I|giJ_(T|CevrTb$LFWQkLa%KV`;C zJ7~GD;Ifxy*_fB5Z!I*nXq%;!J>uF zg@wfWiy2MCq3NmOf9Ozm2tjw$MG}?>T+ntdT_F!(!LD6B@TWJ;s==RU{DV9l*xnEp zG*S)BcS3)}vyiNEZERV?UT(Xj)ob^dz11)OX{}*5y%kexwN|U7J;xQY&$;@o;kddq zqiH@$=-?|du>b70Qms8M(VAOqwSntc;$!)&MVUp7J_wQ(@mMhit9`Ct`PW#nmSJk8 z7Tr+4MPT|H(V9~#cJr#7DueTZhF_CB@VmCy?61m_ax532in>&F*A?jlMctCD-(wd! ziGLj5kaOTWg&Eq;^N*UIT+4B9njlr5?y{8KiEIh$(+Xqt3bMFQ^Qapfrj4(!uM=}f z>4z{IV^uzj1&kGO(y!jR3XQzN2?I_%1`Y7A$Eh$?&a_E=(;_BB_ouI%73*Hhob=hq zjQkSeX}KkOBH>n66}Fga)X%Q6+IA(gFxk$zslNZL7wo6{Wz(MS+J!A9C4SzESxn?& z_zzCT^9GnYy9o+|^6=>JiR;iI%-#B*O}*uGZ82 z;@{&zowQRrYGiD@OE7q*kbl9bdU!YDrMM*~lVxiL#Aqcu?h)Od`b;gl2xsMlDKCj* z%=^_bO8w!5(1&asOMCuQ*SAbryGiVZs+;m zD>SAnwKyziim!GLgu(`*@#rq^2*&-nK4FuP z`P$twdfj>JRspyi{qN|36g}~z(W=__u}#>gi}5E*NFq(|p6XasK-t^#9SsT!$`Tqh zYZE018tn?l7^;*;$fQ(E)$P#8hmCx1ak`?eI&95>kR>286h3;IBlqW~KTyvhj}xCU z@c%G#4e)xqesy1FdyjXOjM(dv_uF!z8u9A~+pJ~Q{VUGrepVccfTPrK6=Q|5jmYL4yXuy@&$V23 z7T4is8Tg7XN8c3f)gh3ny?Y{=xA#MWWbZLkaPnVj$MA*NTU1O**Y&_j^hVwSWqRyc zkTaLRx~Op4GaiS@nfQ z0%!Gt(KHuqPirdRdCwK_p0V$Iqka(#J}34UN5Hpl<_*UCI+tnf5e^`+MP6b|mD^G6IiFcNY5d#kR9n*C(BeaZ&Ew1mf`R`9d`|8&J8^wZepiC99e$I60d-keq4j6f(MOUxZLvohisb z)>TI$;1+Z|UqQns!Z>Rp{a;R2_Xx_$PT0#?xQwJS$%3vwIZ4owxgB9MS>7*uwwoI- znW=HVl+b-xgp3eBb`vWlg zBK|v#qWB1#Z&6^q;c*UY0qK11bWXEcXyuk{eTxmpulJ-Q+r$FF0RMOXw};M;l($@I zvOptDHL~S0MTXz06NIg_=2^hW*e`0c0KaX@@pJ&wyjGrB#_V7z2Z*Z*7>KiW5D@z{C3#&@;gN8u;sM}pwcc(Xr__7YP!4qv0!AraMqIGrjaTUB^j zPIEZvzoJk7zR>wDak5ZT>hpAsH}J(W{YDmF!(90m64t--OAJ?(7VtF#&TL}UGg(j! z`t9I7&N+3b{}Wl9QjS4XIOwzIBrtq$<*d?bP&l0&8W_gvN?e+ULo=qEG>$+UQf819 zb271;zgcXsm?W?W`gqy!x0-Kx;{3Dfv^Hjrb(Z7LsZR$MvE8S?7J=5=mz#T9cG=)| z)=?nn>(kPkDZjO4go))EYq$Pa1cgMf_+T<`dNhsY=;fjl$KU_)GVrmptgNBY-T-$z zgCoi7?wEPKcm4%ZsFMw|!`>h|P>$w7H^2P*0&MBmnsw^ut#<}L@LdLUCc@Fp?qGQZ zR2MJre8;%jo*%r8`^iTf7$a90rQ!+DN6rZystF(*K({1)xWE;5gou>5!{>S|cThNy zg_u;~@NzDo&Eb;9`ZrZ;Gk-g&%rr9+x@f6Xk>q($=$&lEEqF7a)#X^mWRx+2>(ESN zHj}vR==rWiLV&!G&107Oc%w5;9wsyoiHJA;{v4@9Dvo$&Qs_h6{|&3nc^;wW?Wi;_ z!~_v(t)EEs16Rlb^`rBQ&u!5qqzwWkNY8yP9;;S@mq*(2up&WpdV`a40heqJ_wbPP!|=zCe-pg!Pk%VcXrdFb=EphccD`P7yls5E<@vx~VXyC$=IKvQLVEOW0S6)@-GUL2&=eEY+gQBxtTBq5j0Mrl;PeeF*W9IwyLpV=uv5DyLiSMO7E}h z?Y@0Zwd-_Mr_Ewxi>w%{yoZL_=0RDHh`$}SdVnXH-2w6Mibt8YgUx*i*-VgaI7wb~#KdwF z{e^VK^=PKV9SpObzG>;><5Q-P!#h`NBvyxlLrkmy0(r%t_=6jK?EF|-|Lc8s zjAgs_V+G9w?*1Dkv1Q|q-ap^c=8#t}#mg5M7LzrMKF5hXp*(&80r>^aDjn!&a(ljD zjO;Z_NIib5&dqcT8b#$$c&yz?zagux&vQaAcjwvQ$O#-yXTz{vYwk6T)R>4XJu#vj6SES^Su6Ni&qwSFgTe;u4fjmB;Iv2?60F9}6>acsNbr z1GMr^{ZiWG{a|-}b5jJA&&rIIQ0xx+a+GD?Q81iDqe|&+{_%PswD%k1c_&WjaI^bu zt}2U-2vW8L#9dduw4J( z*Brr@QpLQPu0TlnK_jwoDgA3Y_L)tn1MU?{nWfq~?Yi zdAk!U4yRgG+3;^E5~L)QBKZ+kJAAF98@?W1?F_2b6=HY8TciP;%|~+hxKn7AgMHds&jem$1zZXHp$HmM7J894XKwc+=!ZFUASE~ z`+cZ{p!3_7+n39NM)f5K)E)ht(#SrLv(SXcq8Cq)ipz?QuLvUS_}A`^pKWOPlmfzc z8ZtY%`dpc8Dpbz4*DL}o&%R2y&%rTlso-rR7J+3za+(^&JYsPceg3q!#P5p+y>b)R zf0i07O0k)=BWCPO2BHfB0>JS3+$tY2q6qnkoCtPOs6qYg&{~}zlJ-`V}DX7O!B@+v4wF^zh<>_FE1ZsR`{z-22 ze&Ulu+aSfYG_H@&A#9<);AGAJ9%CkR~F2z|)bA%WaqK5dXY4`}XqC$+nF75-i~D#xVvRjzl1LP{cfao)P{i zxA3?*^}9?6OF?zU#n-q{|6X#{lbMsBXUxwZ(%-?u`Kb9Z2&SRgc4c@lp!g~5zy27U zegZH;+1u>*CfT;<0YHGNwjm-hVm&rAUMiVupK|z>Sl(>I|7D$ceU8>$7GK#Za~eEV zPd+L$d@3WjnFQLwm&HL2#`ZA!LEx%rN7vp=HwuDGT|WpT&>lvvb4 z8j&LLm)m-|Z*#HBm$zFhxf!gU`IXBj!9dzhAuc5HF>_<3RQL1N^*#1hWP*B*bs>$M z1XWU(1l9z6-2I`7pV;INCsbNA!G*m8qkxx7!O&1|JqbHpH%)&O&Tsu2Xe4}C7#co- z3^WQ!r3`kn%Fcxj-xpj+``hJq@9=UD(5>Fk7cACyyu;aE?+6_upsbq~=j1B^;J-;s z)4{(s%q3(&6L?Y2EF@<^wf(gV1A~bj!F!w@Kp#Dv(O^D`jQZ#}V=T<@Czl_P0TPNy z9Ksw@*{i;ff0+=N2ww2d-3ei@Dso3rKvG~60^GIwa8QD~3=OyDMM~LY{v@}cC54~mL0=x2ym`l9fRYh)siHeGe5^46(vMqQXJV#>^CecCzDWaF(TYh!_L}1NzewRklM?zA%R36OVK}Zp%hS z^QXS1ic%?IeF^iO+@@%J%wob+6J5*wI!zZN$9KO|(+ znAtIx&!-z0KhEtMuCjX3X3+_a*e6y4!?M;&#hfhIgc8S*PcQIkmYrXYxV;eH{ zNMu^A?ajy$@X5HZ5fUMQJ}-D8u?HSu&CetkR?yZy{>ap~B4V=s6Vog&D4f7IIko5P zXq}5-^4I1`MJ$M)aI9RFX8RP1Yz+TmqmzYK_wYg@lhdkCkjx3{PDqNre=LLJD4fJE zeuG|}EC|yx>RAn0tzoIvwPGvq;5lW*#peOA%;Uo{URECqA!{8wvHNMm#Cbs?cQMX7U3fqZhaeWhtMXwc?g$8!(t_&v9 zM{E&72jHo%uU{x5CoUdRUMQ;zWkG<3X6F#J*5(e3>Fx%;_$C>ISK!#sWb~$4KHT;; z{u))tT(HC#FKbUV|7W0hLttNc=lh`4H?u?Ddi(tSMJjLrI`%h66K}3o^#ww}Cy8sS z{~G@@R;(LgeVT4blT<9poEfGUVKnB8M&PU^vuG>pKZ?t&vv!~g^} z-y>c5TTJGbuynpA&H&}D+gTidR2 z?OlP0X!3KRpu#B(wCNgdyH)IRPz8?EDE z-FyBe$hRAZMSq9|W8$LiqN9jHDt0QFPW2EJme;bCK^Uv`W=Y*}+Rp^{Cksi?$fq|jbw#QSjUK;(KUbvmxx6TObIuHFJ_0HbsavEQVR#_5L|8wq=P zmOD%=>Sg2IF}+H0uw3A_O*yZ=HPf3M(-qb$aO^d zsC=d1UXhOjMtV*a4d(FIXpPYc_y2k}AO*7V+=JMo$h@P#qSL7YtS0-9m`85Hy~isP zD>|VIB0l#iqjMKF@8~$aUi6CBhLE61MEFc|26Ptb3iR_{y4)bAd;!WHE_7uinnB15m*j46#){xD27c=Mz)}V}Pg&X?HZ?=cY{w^9u$wL?R$+@v0T16b__=6sAR^UTC~ntl=9FK*TiL@VY&u zpD3jeVo~d=;}IW4T-YX@4uyCMRW1E89fm|89@n`@oPF;55|AtC%?#n`_j)De)osxk zN9>NQ0U?7 zw?Sb=9;y;E7K|Ys1Aq){u7=-n{j^Eb4!W{&@apn>0$$i(n^cMQC;d4jP!<$+nUT9M(k-@~q zrtTDnB|5(=nTAHhCDq1TnrXC}tsD&+Vu~KtT5oj~Q)`$eIXRr}J$en5-Tr%Z@PvSK zv^zXY{sE#qBn4G-Wc~b#Bm|Az-@!=veEBgEiTMM}$FiwgJ4{ffw^6ssHeVf3*dPbw z=6gWdJwmiC+v@*Oa3t9GLP?DX1A115rvC|MWNKZevkC2IQ<@^WdPP?}|X}$}FhOwp=)0E0lflD5titF`JFY zh`=MQ=7u-FSZWxYLP2e4u~;3R%-{%LU0bVq0D@dgjn)gySE!_&#Ihwz^;Z4eAl``b z9@fl=#c8eeU)Y;0tDO%Rk${^Vk1$l9Ch;m8GT1xPU|4>JFB)2->5;J`Qmy}Dm5xgS zm@W%R9y6!a3>5svZ$*ANfgNNeH$QeB68_7fhh2HY?9(Lz1*{FWe_ZV&(s3fyyB-CI z_=O@>+@v7y2B+~Z?JSZr6mC8SjXV%!ts4s7gjfBJk!-xcot-AfZHJ2Gb(`+HvQ7y# z4nAPVa|eC9@`56Ffu@1F8z>k60zhaSM4m_XU0s64k}W>{PFn#A+5B|b5Qwbig|JRy z;t!Qe995mxj<5~p^1ro&UnX++!rBEJCEyPlm|tJ_$Fnfe(M3TvyQI$9&*~%`jzY5E z(5kb2C!5Mx0E#EA50VtK+Fja{rG`?UdG4M~u)BlEYMjNL)jDSy3F1&ypLRxO+r7=z zy8hs|>3`Ph&M^Ga{G^8u7|Q&H6RTP-TRom^Ss!l?8}bhdD8!cN>&?e%2;L{$e{)lq2Q&RRkDGWuXvatB+J(N4V zem#AZ7o;C&zflhVRpiM@vUB-uLJN_3pMx}9)NUro=Lb(Brt&lQ?m&>c1kGCy#Np(Z z-Qd8cSTKT}Y8)z@2Ik>dlL(yaiPq|4X0M@jW8=xf9vZPt!9fQSHOa>4}kUQgPB zA4CS=Ydwxt>4?egtu=0@&8r`Tb{0*N5^gtIiIB5n+7|9w!!RxoPOvlj$U4+a8f88KmsFO{ZGFaB(K{krCqd7 z17ZKT&hK)K3&Fzrkar%Qm5h-T<@zeoY*-)x%QqhV-+sYXK7cHmRn(4Q%@M<;+iCZW zjCBU;`1xA%Gki9Npx%bD&CQ{pAYep0YcYf&oRVAhqaM%TuqrjY)bvr)O*~P4Xt`?X z)Xl*@u+_4l(Qb`b3C>Q_8G%=OsFNOr~)ZI_#UBvoO#g9%%! z^S=PjxSa!TNy_n)50Zn>H$kCy;aZ=5_Jl!316cu0nf~B@6~T)0e-#y5?I8X~VnoV@ zqbIFKKV$ty-ta3T1MW=IBg!oKeM)w|uN-|;v&|Fy)n0;qDg_+!x*SN@Xy!+qGQ4Iw zNuZ~bK#(BvGi|*JqU{s#Hdu&jWE;o^Pwnmac!x=Hj7E4AczQFfjs98t4u>(Qh1Ag; z_b-E5F;^JovGQW%pEXcGnTh5SI`n*rBKymIJL3S+i#2RE9-A?&dvp@#AT6LLK3<-y zqRo(Ha(h(?A4!Du?qmT+`Z_Q$(BzZBjhD zuIZwQ4b^U7M~py-zay^>vbyw9Q~XTuy>8eQyT>Ie+i1dIDu)O?RN)u19b6ngpC^^q zj@Ml5+A)H9vj*1l>9BT;rBq<%vv1W4i?eB$P=c+GbO+b zvh1z`F&J^LAjYWRVCR6@-gi7gJU?@WrS)sCv3pd0NEjF?JXKz3!qJhGQN-aZY}CIT z7Uwo~D2NAfH~)f+>}H2mE&5chKs+DPbg{#;CVlLpKj}PH%?k?gPuPDZgR$^1fBpT% zE0Ix2gKpPA8^6qDh$iY3!3t29z3*e4ft<2dXNDPIc< zA9~l`S*9d&nwe=6r?^(`4kZKw74y(8N*%l*AtS)xmUsrfFqV+v$onY1KQh${_dG#uDW_+4?x{(>@hPt69rGMoEWsMl{c2%V%SY+Rpmk%Ni1{iY1b2;a;+OZcsMpUv~Td|>o4k1e})Fwn7cgJ8`v=V z0Ax#RiP&I}#JD^XW2RHzxPZ)7Vf4*J*!;aZgF(`+1#JVF6oc;a!}A56%DsXN{5 z^r-{}9h_2j%c|*2>zyA}izi8O;Q5UBg~E>f4(H30D^q3Dy-!W>brbMk8&87Yx;Evz zIZcOzd;gFTZFhACzkVIqQ`W_y>>GWc<8rvzd%2`Ge97c`6K(c(2)gJbzK}tlTaf$J zvC$z0lhDV!L2Kc#Z-e>0(sCqC1k#{UTSX;EX}6tfHUmca=-eXF* z(}N=Pio3%I;jJ0r(kDn7#C1s&W2J~7B;@iKp?Tdfc6fQkh8KmUl>-Y$*YgWcqW=}$14ZOHwaRI&(WSkYXiHr+w$Uw7L`g3jh)ZDHR5Cetn1Jg8I&L(bR@d*BFSpAEy3OC()ez~0f7Hkl016G-GY_O38 zS7Q@Q*`rm1WjxSOJ)}fvcX-JOiWVgdFP;h(TDD-3X6`_%XX|{iE|@RRk2>7cG3-%* zM~rf0hyVR?Ck{7Q_qK--{l#|iq0NCT5`^ZBM!@I%V{0yG1#kFFmv0)fC;vDrHyU>P zB;49PNXP-^Bv-gwhiJMe@sH*}ckaPxN z?je(SMf9Pu3{els3FLITA_{w=Ux}~4ksS`I_2!3^WuL*!L+c@-78MD(Y$7~}a0hb8 zepMRADf?A%wXM=CWLnMxDxeUbI6pd#EAKf0Qy1YHRwt7Dx3-~++5DWQHb_tT0 zdu!C_qfsrTvKWjAdFMa+>UhU59`v3fk7h0IB*)1^%eFf_L&DrQ>BEenQrus}O`{PX zTttyC4*~ivHg9To5&6peYkO2^vWW`)>-?iE^<~k{`uGF3-Z`!9X5qN%W4)-t;bI7o z%t{lT0GNb=gwintzSJlY7wOt08Z(XQ(rXGnUbhZj`qsL_@=D3?i8;B%W6bC$U`DHK zkd3&0taiEquzm?dq|tW?6bU_SnuMh0Q7?Z~lQ%S=(SCt|A$G&p(Nkq;A*q!@w=?a? zH`y`L!Du`YaB!18;*FsMv2y^_O~d9@*+xI zwoamhf*O3fELB&Ar>9>Q8!uIoNCc5XWDhEba;%zlv|isQUV61yg~2 zAULb%Ggr&!y6je`WdYV(>ov}6orO(QM)B*%QHfoQ#f+aJNVHA*D68g&WN`Qdw|sDfeRP_{BSdcBzeCzBi+z0}=?trUHpLPN&3 zN9EAYoDie&#~ps!DvAr|C*u@a#Dt{;jW}iQ$_DtlI~J42s?J05I&q6P+vh!0BMbXD z5j6VxRtxp>J)}E}>*uaF;m$3dDxKvqCL2N)n+fl@0jq&{L72@F`HzgAE2H7rYr*Rm z8f+f6Tg^uCTx8tEw4UCF4E<6VKtx&YjwKAN!=zHNIR1)5&_AYNgJH*>v19ZkLeJy<`jU~^rmnyCx8M%W(`#pDlFF#xn zXUoMnb8V9hoCANfo+7)ed^Xl|s)>gkY%uH%q+J-YpvU6=iPe<(r%~Y;vNId}FnFMl zU7Ql!D+U=Evmygb^H+S&py+CPJS>Vc^A3MKjGUjY*<~%z*l?rQm#Sjs02}MenB`ukZLjPhENUqO>AR-JB_s_ z$uymA9!-})k&rNtiO$m-(@lVZ>0)BZcOMToGz9vlhk|EQg2=x_2A?2A}_|yg5c!Tft2MTmenNQ9)Y4 zN}+B+$U7@3-0I)0vNRRj+5!#7S&)u>*CAVn^m7Ol4Ufq_qt^+Os(<%)If)3MWI@d` z9gqOQzEdw^zGmaFk*Z=BwpxC7x@dk0Wd?c5o{dh!GZFtZn7myKVbMzL<`J^zjlc5azDCKGh*aId#@(&* zY-PEVy7_D?WeJCLM@QToo)5!Tg3Esz27|4Cw=FOCB*HI2vos@+JGiqDl*uY_mjN1S zH;U9T%8V-vG`JiNZm^;t|3NV8<2QkCBR`a?!OZoHjJC*m=My0UIpLpNC!jc<+&8MI zR(LVlen!11G>`N&PQZ@xSO8D}o$Naj5iFWB;+L?k%&R-PrkS(iYx28`ciWtX`<%hQ zvhy;|+eb9Y;&&A;ySjS|Pa5A_cqY@iWYuK^dafUofCMmhcF`cfmHR7AbRz_omCsFA zEiAC^;$It|?M7YiZR;FtkZU}|^p$HdBe_P6o?>eq$ZSjby-HiY*>$5H^B9VQy$Wdz zZ-Pax0-iMQZ~GI=Y%1Rt=``Cm-2wkBp@Ti}uJT#=gYW5juQWJ3Hr+0jqZ?ghXHsr& zR*4ybL$_p(f}b^vV~vMaDL+7#bIR2fWCu2se;z>3*M(sG8mwLR_F^r4I|Q@Z#?2_L zj&+$)P~dIb6yMe*ZU2T{3}z%<%4+dt_FCwDaBN~EWAkQ zsK(%bEqBY|RqOQgy?Ou*qbMECnDyDnzYBP8ZEcbDOzsiv+kk8+q>3yoZ*|>p_eMVv zpj2c8dwkD_Ts8>!F}Jp8=^%e6LRylT4pWF5ofTI?>_v7x<+IsqYNj7brDKAm9_KVB z9g+S>tfaF`WZ)NRYVU6FLZX4M=DkarpZ12k^Vzh07R_&<`6$())T&0?7v$wX49RZc z=LJ&&MvWHsEsuPD&Ax-o%dNJ2p&>S)K~XWwx3Cz{pd3HiKe&VM;e7H0XA#@|;YdO< z*O}4ZlD_2$w!gO+BGz@5XB!@)I*E#<+v$Q@yg*7h&^7{s13Tjnet|J*7pJT15AcM?ai6kUQ z`z!ihk>mzv_Wl~0{MB0h&9NKK&U^$8h`ndHOx)~>Xei{ca-RdND~y0fM(HLw{MBJT zj?cD}U{K_MWN0uLOE7un#JmKpxa*7@joq#q#Jo|Y?A8NBSU=gKS_7M;`_sf-_?jb#tuUo(UWwC0= zPL#*-niGrBQkz=%gvNd}R9$9TyQ>)XSijx7;!Rj05*%#;vSsb={yz0gmjGy6N+nBH zXhA$%D2zliUuQzIjN{m~C)(Cue|%!X>vBG@AZoOmD>8Q;_*|QBnq$TL5`rb!UqpFgP@4%Dr1#yN9NTpYN=rHf0QC!yAUWT}k zDRl@m;v1r*Y1Eo^0q_WMO4c`5Pzskjih>C+Fir!4&AJXHm=y`xLh0x0?x%AZg%cGa z_7XB%xv-`-|9&+w5rlh94=bd%7UD;5MS-q-N$oo0l;y#1V6cZ)v&~if!l<;<6He19 zD#c37@N4pj4}M4Wd&l0z-`EVBn0z+;o*NU&3z*sA;XB`%DH+JJSK?=(K>kOuQUxmC zw%A?RY|E6l)SMob@(Hkz6+82Orr>w3L$Nr_ekBAt*7LdbsoZ+(myp8#g8qPl3zZvi=X z@^6B9Aku48D!7$5JdQ901~$UDyll&q9s^&pXrlVgk3z$xf8_gd8)!PV3vMEpLu2m8 ze4P7)W-4No1!yk!%WTdNUkd&7dadtqRMt0Cbb~ov-Fv~()VpJb5=ARId|!V!Y+?oF5fVl6)>+(>b4(juoe=Nf+s)c{6BoLhRtD=RI&EfZWmIm+RFNNi>Q_ zN3#~Ur%%pa6Ww`}xdI15-U^D3lO+BRA;bdDvBdly;tw6Z`R4^tnS>zyLBH90GGqRb zf9XgSgt*MdvlwVBY2412<+bX~6JQWzex&?f2QNv^F9eOp>s&a4?gLAE%@%EVc?gH` z3uhSU@cTCup{dcdn#0mOze13LlmT)QYCPX97##iH@QXrw{QxO6UD_yYD9wc`a4K(bEDNVSST4M~-Trg`j7GoS~3#S}bHt6~4zPy|+> z6_K`t@QIb_S!30t@%hK{EkYCKF{NQTn~pa~scV0H_ujhP>|5VG-HvjI&HmJ}cm_&+ z?ma%b#jO8GKDDTj^CQf1vnE8s%+kL3+u=aM8z!V7H zz+}8e81}aghdohDW=xNQ2M53p$dgShE_k3LvJ6Cs_%WcQ0!XU&pkW27KCgPn50z#s zlwzs3C>hLsSb*+)6!v;b0$R1xg_$`lhV9-o5PLSkq=|R@!J$Vx{fcq+gj(2PdL5WU z3WJ9P{cdz$BiZS1-A*2Wd|8VPL}t-wx*{}(j)b;q{*aMgIv$xrTf^I%+2Qw6EHmD- zD+Cuw*Y@q0zPYR%G7_dcx-FEg&b@27m`t(z@Ok^sdUx-NlW&RRN53B0N)>VY)@9?Q zxB{>3&pY_jKplyV`rvi1;shZl6%}Ieyxfp>A^$?!Wji2se`RbOMO$t1i6s+$ixKR| zNl3mC`_%jkYabhR zehQN&vP5i+`yJvds)fA!{PcpwK$YnRERQmf}U87^nm%zPmJA5E{$YM>eyhyYyUh9I zc`LB6wt}yJae3EvVD+%Czpd{Kqut{3yyk?}z~?~{du}k^VC3!Y2QVu|-gea^7Xtzv zej@aF2Ia=%v--q2pc^{lB_U+MxN-`PyFj5W#LcQyycOf#VyYXLSJE~#t!+@R)mb`if-=1P42H(&29FL zVgJgr6lUF&lWW_{w!YGky=UgX9c`Uo#Pf~{N^iDpjPYL95{uv4^GZnEtJR+@nLmF? zwO+AiP@+Ga3$|7i|7*%al9vsn&J2JEE9bgDUaXkWFgb3Jmw%)%`xv#oZPIz%7a>xHt3p@0lL z&dwFK(y)c$?nyeDK+3W0Hs!Vz17vc(x8`^*nhVe`b$_DYfnqQ!vK%(pjamwd>|5?k zaaDNl;{Sw*d}lDUPRHvP{cf#pq%ly1ha7`E7(0?cgN)0p6E^{oQ(darD^V*P{s+~8 zOBf1F;<~-4ezpR-1C4fHI7Z!4jcAP$l^~mW-&CNb5ZC_HO!(z!Rq90ZyoqnWx;o_ z#Qrzcb}Q9#I?07pl&p;8#pnomTlC4n7y*yn)L^Gtpcu!N|1Bd$z~{sUcrK&?Vh@Mr zJXzFeWy`Z#VPRp^eHC`sFGQcbk-jl=DsJW1dX_O2ei<=tbo_EW|HD-kU*UdfE^w#E zpFHMvGVdJ@Uc2&*&{tT{NJ=G!!RMR(`J4%-YEk+QZQnrbzPF8upKMQ@dB(9AU(`-- zp%Mt3PyjAUwdU;+B^{G|VfV*_=gbe|m_^BBkIAwz3_pi}G6-mUsp3?-hje|09)Jmc z=aD+NoBd4y=ggL)6=}g(GX19pi>-l(ZLA?ycMs6IZZq&^z`g@&fC&BBO&t8_}A5{UT6P$L|?%fN!AipPNQTxw}&p!=XViq~M z0zRIsZiN!g8EHT%bc@}bydtpgV^Vnljs(ImtB&%Mxi8JVfz`rRlg2Z{xW&9PT8PPR z;K>~+j%xn2dYVoe5hM>F;uRDT&L+#AEwtrL{f=pBY`;igC!lr0 zTgNh+@zME*El+P`0nGgm*>^oW@fbc=xvDh{&&*0Fwye^ z;b;Lb^oH$3R}|Fu{PFOqHDkF6*q~SW=t8uRC)KsgoJl?FNHwB{n=8~G(S)4SH;0@j zWTz)Gx)l`QBIxa$UqfbHB`jkgY@sDoK(C8Z4l^eP0 zmgCbw!C~7%$59bkE$&fCbgy0jg+Ch5UE4g_>2*SjsH08(^8MR`PCMX!d-UZyr)Bn* zNE<*3pz40>1!zlTRMkv452JwXgUV8k`CfHw{*o1aMUu{~+3U2MBBzCzhvUZI!|Q7A z&lkm%Qrqp!;jiB@3xgYHGC$<(*~*5@5TsUoI9qM9_BdFVL`U%nqO&as85~F-D5Lm7 zzq;WT6IlTL`-9Nuy*ozZMrD4NKR8W6SAJjM*_=GX1zhh)NCo}H`Pv`GpG;v#@&RUh zRW{R|NCwXWc(&Tjk@6BC~INF6yoI>Vt=t8YQ`kWxYj zs>ta!4hmqD?JC9;84q_>jb`H15*7A~oJ4x$5Y%Q`?G^7!lylni*_wToN#QclT}&nJ zPYMB2p-NN=i_|9!tW|Tm6dm_dw8Gq<>V3gK_I%gYgsmPfF!QhCeeFK*by`j+!t0xm zW6%fVsW;Bk>n{DUWbN@}HfZKz(QO`eV}(xXXLpY~!pJeVFUUY85|Si)9z?$}DMi)a z4tWo|*4j_9t90Jsjj+h14u#5!`I+P6r3qgSF3;FT3P%g^$cwQne#Ri!kFkcAAWr5j zl{f3R&mXFs{2s;qLMIWw$Y-@f6kKx&3M2tOPI6o&c-207T`T@jbP+3xd|vY(mgt-M zmy;!;ma{SXO)hmZb(7@8B(>k61+vNgfrFV`m`5OELAeGM&b>!LQ7OsBBXE{Q!{_k9_n!@(oNJf6;N>#{WIK>Oyy zG7!X-o0k2Ct*Fy@K=(9MoI^D6x}z-F`}3_aTgb17BsY<7fK+FOwVh4!V!lEzl?NUn z0*37CZuJEJpjQS1jnZ1HwDvCAdHD&{^DcpOkGvu` z;g7FZnn7qu>%xg!w17>TA~WhBuP{S8j~{$MO_YB(Lb_0mTBYd^#r*;&GQ`f(%)T3H z1)zRV{7q>YSoq?8Do7Ax4)~gxMriQ3-I)Tu8yXr%WPu2>6-##p@rXG@D-<+vK+fO3 z_rWt?z^zeA6(I#QoT=gx_i1Nq8B=#?=p+KnkyOSCdRjwOZUWw;1YRd*3~uk$slH%KwgBk(gGcxa6P>td4;sA`sLo%3?(!f(53hgHyYL?%DXB9&`0BW4;bb1q5AFR zj4=YbM@;zUSF<0b66$>okp_aR)dhVdW)`g%ezkeZrJUz+cJhG%GOP}F$=|nUcTNa< zQ06>5z({Sx(=646DEGMzZQfKxo!RkScswA-d;sLA z&zI}o%2)F8g`}%>&t<@UKG`~L(RB|L=6s%+G!3Ga_>At2LoB8sSK>HZQaw`F-i5^y z2|13PnHh^Z+P9)csrk3K>6Qnp;dg~nyAwG^wJ7qX&cPFXqve^upai3FnyUssj%FJ- zefcLEX0m*LyzlMh1^$7u^8&~*GXOU&|5kut#2kDyV4Bw*G9*gTNh!ZYVAk&Mzk7Nr z#qY9P#V5w4EHhP+m`T~-VEwx6Tzt>k274oWEDd|5%tc7)69knmei$vEe;^q|N3YFT z7@E#d`sE-Nn_}*VYrI%#WVCv^68ZjPWb4{A(V0}mr@C@Kjzpwg#QC4<3r_kaINOM3 zB?w~t?f!3}6H;Hd0TP1LY`$G1?j1C=v=01SLsK`b%rzd1HNc84dj5>=RN3+LWV?j- z+Esg%CI{A}!;5PG;t$meZ;{Cs$UujU>1cOwqN6mL7S66e7}OyNClMmFRs05R9~FD5 zn_HS@ioL$iTyWSpPU_yUY)P9>Yo~mJ0*p^YhEk_4A5RN6(*R4Ph+>bWv?XHZsCsML z(R9h>-XK_n+4bDuMxXoles@cjp|*xia=5C5AKOLmOb5md0JQ4m_42oqVK51+2(LUu zx`C^GrfKFm7DzX0i|t)(94WhAw1iyLL@l3?Ns>0d1NKpeI#C5IQfrZD+*ujjm6oua8&X=gZYxce^l}oJR zWHoHfHR%ae4Mmyaw&gS*Rsa-bZU>_Qw@2KezOxI)3>q|pbQ){IuSc%M_ls=EH&=!2 zO#?H7(>0hiqQX(%3YZQ1d%boA`2`o4-jhTK$>sQ(j*h|P?AaFzDDXj34`>g6Ud@2h zL2^r8{!O1*K7q}oR%_LI)r%$Hx#*lPTfg=6@H7o*$`wNOdwY@;@1AOW#)`0e4+-Gad`VVBO?e5er4*=EnAWr2m z?L)kMQvu+`!~M93sy&q-vAfk1Hd|>V+Ed4(S&9P(ulVJFgTAxo2~hYA^N)=16Q-%X z%yHU(*aFHl>CXs@f-5>iDT7bBmuAhL-IfW?5>C-fxU=(|UM>`SLx}@Ut%eTkvs?kh z$sf+4oD}ss=4QA){;MGM>H+RNF6?Zk6sqzFd$+OQa!I`U9UMz1!H+g97_;)7nUSbw zkMn=3V=h8>snrhxy}-~B#f(kw?qs$yARr7ubc@nvt6S&ch*#it?V3*Y|QSb@z{h{`Zj` z-8g|#EqV81)*QI@tY3{=pL~3LW~xkj46eiufiYvKS%q31BjB^S`17}zB<9oOvpP`a zqYQBPJ-K3>O*0lfG~IfY(K(+T~g*{@S7JKDMy0hJ-w-bkuZfM|{jBYWXPSy<|Z z;Oe0;J6{)9`z+l)UyF9A7q$~5D-s1q(IfqAi;Kc>x zT7K&O%IRV3X$5OQ{Y>59i&ZPNGx~Y#Zo12={&)5AFLdT{$o$~7@p2>ZU8~p*pJB%(; zMtdp;A+IY*$;IK{M}Y4gzc2YD3?n+X?Ye$FH|)O%Tk}!S18`?bs`&GMhB1fuILw&p zu{mcknQ_*dX8xO9(B86P+t{hEidu#0I$r6c1C`jD`A;`oMV5xD)`QYA5MCTxg{VdC zqHcqK+fXAv5y2tQF;$t$?@vyNAr&k&pW+J?hwbX>3VqewocR&97@Jbr@D77N_xg|e zTxn=$)qW^%&4|B0R*m9YGOC$6N7H{Fe2)@2 z)eBz?P?;5+Bj>$vSMIT77vXAkn;!j@C>Rd!$GQ?mix6%#0&t54%8(m=0}tg@-z3qf z%c}Ws5@z9jW*arq1zQB3JYq~WiE_Q&k`*u`vC-wiV^bILe`yRapNs8^6?xLRaZRfH z{i8FjD_9{kdMe^EGcnUtf#Iy1!;1Hu{RfcIi-nLS{ZyDk(3l*ea?=bTY zF)7_P^Q~=;(*TN4hWvwHP4tg;-G1Vsr|)(=p0C&bOLV;oXiDR0hv+VfI4GN3Bh%kp zeDEmH(LJEiUVosAd9^yNvw}CaxtWD{It^FpF3Jq|*Xzt#V=&8MZJ#%Ks{68>{Ia97 z5b5?rO^n`8>C?QV9wvbTvJo5GOchOP+PJdtBW|@NmZO_$be2nS(HxLiV#oxo%~MHh z^LO0o0w*G}R9R?Myz%_9Bn2dAig2)M`rHgi#{fG~$uhQ)YMd*^%Le7Vt%V{@ota6S zgJjeB)os@qP>Mmd+2=0ZS-N9TYM~>_%}|0u6$xuGZ;tN$c)84Jtf^>Ykzl}&;d}d!15(BuiAd1KgpO5W6FKf3y?LYK0a1s$!8C|xsE~-s zdm$e)#IpUnn!}gh3l@e9JYYH6g zrNkzprlgW5Bk;-lwkVo8V=f$k6z^qI=03BP5sLVJ?ON=4Sh%(7j$N5>BV)*NST{RB zo_L?sGo}NF1U|CTIT^K55e7Kw>?F!ODPaNyjWWkT9dwRwL3%~*x zRmM`2C;~M}^ZDu6BGim&Q!DAa&u#APAH)?O)VzF$J(Puf?^~k$_-eC0}8N`j_}NLF3Sgb{`Ny z;S?D3`y|bJgyxW0mVEo@F52(LE^cJ8mi>Y)zgsvnEZi;rE-mr@6>gZz{dJ_GX)q@y zuyNfQ%Pupg*-(0}*Kian*-d;XwFnz__W(2EL(>_&mR(&snC;^bBfZWF7Q@uGFAI&p zrdwO*_1)(x8zIq|=QMO<{yx3p%6!^{+ubZ=`X$CG{{)rTOvw9pcdC-NP5qqz*vS>j zhGjx-v<@|aYe2RPWMpY={ZAfT+{*_qgj^Uk-{@KAzud(JuD%IRfMz%-u`9`20H!&r#sLgo7|A7 zj}2>;3oR9F@=k6;=dQAl>1_oF*i1gxco>ZyX-Nv>EBt3T&7Q$*53&d}G9d!f2D{ru zpQ8Fr5e+T-U}-YH8zu9VA#|z%hmib90~M0xS%;|*o@)kTx;vzLtg&~oLfa{t+oVDJ zH19>o;L(WOd^*lfxlr&tHbC)hiLwxv?E~i$DM;T*R4Fl=zu2S>n8@DiB;>BZ_Rp;;d=jm-IiL%KplBzl_xrtr>s)46pClJ|TBB4g~JL-VNjG*6T^t zU0Y%`sLy0=qAmvsL*GGswW?g6QikAK`>2KRjEec(@XLLT%jT+0Eel&)eJdLo#O8l} z3q4yqSE#|5_QJ~<3#BfhpcaE%2!*m?mlNiI{8~^N4XPD0L`WGKncDKV`}_d^uk1Mu z8+s(1&ktX2k8jCIHP)16)~jSU}1Xux}p8DBZDP5d&e+Wc>vWpnEgc}M~X_basw z#(E$)0TAC+OqgjU>$xlak{-y{{Qz!%9T(I>K5yq`M2ZymSmwjqpdIfRl)D2I#9ybU zIVzh7yZTZGzO`^(djD0rzg)7bYHw%hVy6ih1ef@|x=SfnlmFXMga<3<^|%nNHcV9^ zKG&!!4mVz%N5JK0;|O#0B|ctdahy7QfAchcq{2ax%;$uC@f|R# z{W}=BxuV0s@dpT71~M&yMU8k4MIP}{qzW$7jnu0Jay+w7R`Rm~TQl?wp5|e^<+?%- z@=m)>5WM}+nGRd-W3UZc$|l1yf!=4ZZwdV6C9;6;&;TO~L4sh7Qh>3(Y6qH~cb|9N zt9qnpU-jDTiK{>=Tb~%od#si!&CN_70=>4_A2>XPcD$eTWUIB0Gw@jZ z;{kA5*n|1Q@%(ydXz0mVKzI^!NS`3>4hr6AQN5@XJ~p z@^Ugt-D-$+y-Axgd?%)F=`vp~*rs)ln9@`>}~%j>+srs@Zl zmiutVj~>QknOWxCd_D@55phI1w96hwman~T1gqu;r#mQU+1>cRa8n}aI{EciM3CBw zXP`VA7Kq9OR;a{W&nMv%a+Cgr{)$zoXcbXb^E9x-LEV}q$k1MyEk3adr$Yu8d8dpP>|!;wSDjN z>G@%-nWK@ATSf^kMRs>>pm^bREIbu?#_Ha2!tZ{agn1#+@3*`$z%FNO_t?lfpI74W z7490V)_P|9xd52GrMzk&!%FMpIlNm1{S-52D?dJ18CV8h*Vqp1UgG#P#f*m;s1bkE zLw2lfx+98GM*-Q%xwKTZ(lzWKd7x?pUFemMTE?&iilsrb;1vpMJ3{K1_x2vWvGYCi zQ+*f%G9=naO($tzc!nieoK_yy-NinBfGsdvQY!xw1wy_b!Myx|vOXaLYe)JsnB`p* z-=!H!+@8_Mf-iPTgw5A&oKNL;bPHlghQD_hDNPj8JvX>auPO!0D?_&#+Y_kIBz0x5BkgJzedk7IHdEzG zF#Q+iBFV zWKd+NYWwVS`;oIG>&FSn@WwLX1gH_cF0)?CJL0fE;)W{kHe1L{2pQlUnQNAKc&n~M zb4(aka8GOPSj?MSrEQluw5nKrZrXGeLb*$aF&vp)s_epQYEBbf_P^hLSQ;LJ{M8*nLR1+@;&^ynvX z+!reR?1GrV;dX{NZr!XH5Pj#Y>|CoFp1+bb$Pq@ZU%P}#oOy*yt3KW%YNO6G(rax! zY%A+*6gR@{bpBiHimjE^>}MYAlNjoo|77=FD(*aNE0U_V@csK1N~Xxi)V}5!5B(wQ&@NCqvkbUdNK25CM*| zG(=Ze1O0D;tBBT#WnNLrjju7Ia`UBw##dO$sR}hO#}qZG_XZ7oOoM|;^XCZh17rat zk&$0Y$LNDu&`BbL&U2sc&mC`d(NWV-mjI#6;2x-2&c_&@`IuHj z13Yk|pkkf3bokBD9I~Om*ZW<397gYekP5WS65q7eD588NmeO zZmWdc-4d3r{5aZ0AvL;XJQH|9DC%!a>a*3kX_$haquy%$LKG4Ka4aZk}+;SmyUr}Z4*}h#&aCp+M?9049va*(MY*oyzWe)iGV>Lt* z_Ts(Dvv$~V3o0xqt!*wn8@36X@XM<7m9TahRGqc^YN;lI?1O}fvHOW|WHHDW?1?lL zuxeoqJHTcrk?_ttkBe;7%C(A)d#`8J7gnkGx>CaPa$oTP#|J3a{V_9^9+(nGt6ljE zW4IVn!;6lGzYp0=l^zZg z>4@!QlVTJx-AqhWtoG?^8Ahu~mn*l&ng06a&(o%~rE~Bg%DQ`tkSv5TG!{EkV#j7p|xwp1vTu+5Emq zz|bdrZQ9Qc26#_U`T1Hs2=b}j*ApF3J<`z_ujO!m$7hTU7tqT^9DCyI`mhvkt5Ybh z92&UUs$EMoo1zIsNH{n+vg)h$AS*M6H*EWl`%?R+pEd@J%L0PtB1x&maCh_}@VZ#N z>{=0TE56%sjewnX7UB?gk}w)edJ}#E%zd1N3YC+@p&SMc3lJoY zEu+J6Dpn0g4d{9$;QC=xj&+FZN|D-pjkHAXDec;p>%;H#aHsDnZfOTg2m(0Pzpb2X zk3avn5q{%~!}BO9b{e#L=&13DiH8}=lLKhgMoV(uED82}J} z)Pv;7ml19&vw~Q#M|{s93*YyIv5nUTQ3f+z_Ltg8hRK%Ezm?lziQ#Ka_ErR zek>6G=#+da*8^^jv#>IBf}8Fp_C1O(!SI!AZhWTo{CQ0EzD_lZwkuajBCo;7=-`hB zzT55b_}dDs_v39)PppjH(*-^j)D|#d!~h zu{ujnAJM1k0U2|!K{jTD(`ILog7Nv4?ATr_UGKQe;vJmdBzmDV+SDnsbS2=i+MO5LI>-;!V4jOxF8m4*J6tVI@N1APOhBqan z4>dRF%bB4(#6(xUFTB8o(vQz|p3<~3bVJ>S8Ce-ij1F1j>0Wh^H+ElG*qnOL+SOxV zxJhbLHG_cGX*4VR@kUUqs>XnukISOl-AACx)KWI8$9;HooE&Z2QbzzQf8giTG4=Ysq@vBJ8E7{;GZ^RUP zJXXC_>W5|i#fEJ`D^v5#dmZF*vLvv)U|mYZ?%6t1Dy*;dhDXjp&GoIIr0u2+yK$wgYtX8JU^DF{(g- znqD)N!ti2n943y8PCwS8F)UT z4MOT(IsG7-uWFPvjtTZpG+m`ZDK%qO>h(u57}k%Qc(Wa@c#)O?h_XR*7|$OfN)%Y^ zNVGsxuXRj%t9RaaYjMNNLFrW`e+39O6op)4;Ye&F&QT=9B`DJ(oYRc&NGaP|Zh}%n z+hGsIIMyu_L37Bdo4cP9KVdQV4CL8Uho2a{p>|w+JKr$YZ;-v-E>pQ3Emk3Dg+(ep zx$(Y&5L1kIgo{F=(v$45%RlfuW-wtO+sMVG0v>I(%x!&)_RMfXo(Fy%Q{1`NtH`gGRO@` z6=O5o+`(Y?$F>6xVy9-jlYt!d#e*)LWm`v`A@$Vsa5&~`*8>kjxDGSKUD9|FVgjmC zTPSrjfajC8@}t6%sZ<6*0e*6ptA5g^X%MIo<58Ha-GvBc=9A>gjaEYXXs`J`3GnM7 zMINk|hcHqrH!x0%;%b4=f6xq|#M+9*Hr~TZ)nG%mGZvW$EKt3PQiL#2+27Jz?RH?J zBv(9SO5&+Yv}7Q|6kr?^XlT3*HH<^RrMnM!Z zq6-`$*Nw7^<-xux8&i@>gyob9eee}GD=aaI{A7-Im>iO<3L&-FDe#HNvMPSeiADto z+Ac#Z#Q3n}(RvdR1RaF=bTro-IKvZ=CoJa2hLg@G-jG}2zK{R^Wh@7p2b2B=fEZjI zO*m(N9Eb+!cAzBWy2pX)La0knsl~{@NkKBsSSi56xq~#|W*#LK9d|V=&pqTE20a6v zL`!P=6H-RFgj`qsIOA(y^2E&~In^fFAnJpzi^3$@1p+gm_;bq4)sTUVQ-TG0G{J`0 z$r3a}jd|8_KvS}cH8 zI8)r-6wfX*ZfL(Lnk*TOIBXx<{c1VzTIg=%Yl(<;RgDLdhB5GbI{PIS?Mzf>fy(+u8mO(}Sk#=-CNOC%ijqy6}QcejRD(NwSVKtl()N2gC|N zDvgy{#vRZjz)Q&G&`)O%rKbNlaEF>&BAe5Q%7Zc<6mA&tE247jhiZGcT`Y)}mGi-} zy`-EeR#~s>Rey>u{oHl=fzcnulev56nihzSO(pQQ#{17Usg%a+BR&>9yanL=;^hYkd2&>`!>2 zGfcr+HDzlq1H`CfqOpTvCx_l5K7 zOV7lM<$J>RFwQ34rE|mWmBqG8SF3O#C@EI%nqgT4rdPE^ONXr-mM@|UH)F;FS};w} zsQEj0T-0Lr6yPVT|MCGNg7)>t#|qN8A#z2eN`6dw(RoI_8Bx+JvPx*PSrfkRU%*QH zoJ+~R=nXajetJ%W3*SUtyM`dIN-Or8JkBe{$PQN%98%;#t#n7mW4S1Y94FbGaO9%P zP;gy>l6#vB|IUO3%g#VKj+&ku5A1LS1Adyu0Bchpq-#Eil8ZC=d}&!6Mb&oB3^8{Bls-(3AIeR zNKBG^|NQ;CGr7;*6M=5-Cpz%mF3!B!ahvWTSaww4<*(EwrlUKcvW&Jo8sKh3SIS{* zeA`3d?oKh0s_IUE(LrW9deaCGs6rez;_bSu9dRl1w1lB z>S_94DzpF(GwCJd%EeQQ5gKU$7g`_zRNeR6T$0@p8eGYQEH60Fh1BtxK205+yf4dC z{Biuna3a*Hm2h=`#9XvfTCXE8Kb4rG#*#ynXY2Blj4gQONLoQ_I1MP=ZOzr zk`vxEc{vX0@3~74<-oe~XbxJfs9_a(;H*Dj-Aw(Li)&HcUpl4zn9gM}4dfe`{sM5% z#FXbm-#e}@yFIM(sMc%4(#s=E?TL90h9sOH`k9v`Y$9Rex}zsx=E&e3+05P*d9K%< z$s*r-gp{3fUY=o?t{OQqy+8H$Ux5I=zysH##XrQJ1U5JPf3I6)*D*FHKHpO5V}{2sXcV-VrG_wGwM6i~5zZywfkjyZx^}rBp60I7ud2Q5G6r z)oz|`f;fbdU9&`~41}rY&RWEMKSxV2I6Z_{>Cg2yP;?LMyT1G8i9aBeEcuhu6j*PEeclYX#+FzKaLE+;8VY=(lW@MgvU~ zs@|FsgBoipCgE0<>^Uj%)1Qfv2=^q$#_S05ho2nz9n2L+>Y#1?vtQ+LN1SI4v1J5 zq6R!3AEi?$#wlWIfCa>xKy$=Y zswC6BVPcCJuv`}UWF$&&(-kn1O89GmEDG)2S1Iz{wNwvWZ{>QH6DkxU0A!at>7q~oW;oA@dTX*>vh%)((QEd13E^-x3 zW2c2QVP^RUS=&i$tW_l}H$>UVU?5jThRHm{fDDMKsugPiw5bPK#KzSA(9lfVoKD`5 zmLJnOMsz<4zY~4O+~r8{;O{i|x^39RbNp*b*WNu;Ka zy?ZZ~iEFXeX{Utimc|NdD_!^9`@j#&(pn$4K0?)aOVK$u?s&TJ~lI3X9W zQAA0_a0x*C|7w_11Bk5Iu>BqUH&lke3H3G3p<0dQ7EnCrBd>8!3CWZq*gZj(M33=! zH38TdbMP=<7~=cF+W!7$@Bb#f$y3=hIzWk<|5O<9D`XIQNTuU*hjuH1oxF4$MNF5S z?sfXudcG~f=MQ9M7$N&pWdB}`XwZN0!XW|NYo8S37kXjl4*5x>6HIh4=NBij;@9Rt zmqSD>$@eL~$my|K5&QV&6%ux+a;MZ1{{wVdA6R5n!1K>vLKYD7RUKv^|%$ZUjKR<0Ukpd$qVp!ok)CCG0|SV>AgNfh}&qJf-(>hqTirn_qZ3*vV15gy>?kiF%8h(R#Vs2vMih5Hc$8gr4^ieWN_v{ z*_O-FJrCpOedCdX52Ma9UOMR2Vomv1RgA=U=hm@Fonh5oJyI(JqlE5XRprUYW8v!?63zG}6ALL2g+ z%ikCYlAXMjNyz=$B99CdubyR~OA<%2PxRi@WK#^7Xm?BE z4S1!?iJ;z}eNOs7YEzcG(D_3n6QG~2alw9JX^oE~Y|*avh8&K}g5_uQ?p!IfT(&O% zdIc!D{@+wpO9wU`ffm$6ocMb+4xX%f3Eaig)pIgEt!Z#~&I6Bpz&g2ib0yvk{hE?c zOdU?OT%X%lXf~Ro4!gj(=fT%)=Ad(vckmn;E92a*y~XbUq;uj{MF^LYifOAXq&D)a znOr(3gDcM1*$TUyIE_Z&o;}fJOJ>_kR=lb-_t+mcEMfdY+P`}z6;|ZqEAw8f)w6gb zh;yx@=4EKLthJAEHI$?(`p%w@ak(C695(oBAaI0XbZhdj=r{ zxYPvXhENDRWFAlH|4NLF!#)MKS5DV`jp~%&FEP>pGQ>i%Scrn3sB9GsQTBf?G=cYj zVAtwhmu-I35@9>7m@-QIq#OkNPF^aJa|g%z+j+pQ2E2HcraS#5Gj{I7Vsfreh1d;Y zJ)gQS_I43YxWCc+#jZV>gzI@$q!RZovTF=P;+1#_AzQyQ!~66D&PMF+HY z1lh3iE6lAewR%Fmt2yW)?qm@~aUgE!k^W?7NTX1KQ$|cKxb}ZJTnYjwwqjyV?yUV> zfFO_aWkWREi*Q@qz%gEzK25J@gB?j!8u6^md5m)5lLY|0+KhQuvact4mRuRv?X(mj zvNMrePQ(1gEGm=_1a$|G@DCp*iK3h7zG)|PUw;Fd3teCSuL$~gsBJQA_WHPgr)!1x zfyrTKeZyTiqdtS3PbHiwEGarcDw0F-%c(&^pA*ME<7ZJ#hUFNIgd+T&^zMxO(`6Wh z=JW6enPd+L;&83Wl0U7s*SYa!e2Mc~F%Nl!h0-s~EJvVJ{MY(I{r5bHK>*&59cdo+ zm=Kn;G7L$~Up0*_fgRH!kGQw5HAwS#z&#GKzBL)bdMSOgT>QP|DwD?OxGC_rJkEEq z<*j6Qi{jzzdS>@`l~;nNo?PcZl~F6r(r38g_wN`~$R=}-ivduRs)lr9PBmXH(}`fPlE@45cx)A@R?^F_Rd zVXwXRTI*T&bKm!~_P0ZiHHUe2m4~hlLXj48(q4xcd;T%;3(1y6B#L7*0K{?zuf-y< zWj*A#1J07(z)iVaH+?JO+;?ljUY(%4OiVL+D`Wt5Exe20wLnzqq0!N`YffAv0LHqA zRFnaCAfNWe>6r7oU#s%OwjvCCb{cnjf;uXAhgDivExV@M@pAxj)3MUwCr~Q(mk}(G z3i<<}Ue+%vNqSSC!lBaszNsMh?)}E6D4gh~yw=9TrkSGEjE>@>S|ZcxCx@8V=B-M+RR zZQJ%3e-+ga__l0;kthp>WAyrEo%El$#)yH+uVVc#?bHc<5`dNeG()W~&AHek6=n+F zl`&zQO@#jTfGUmk`J?zJfvDESAUZySUx!>G6{1 z6H^Ehlo|Pg_4pMbWm7z%O{-9(VcOS(`*lu>?{Be&1|_#Jqp0&(ukM%07n5D>NTw)F)mf=BW{p4F-ZWGRA^xG%^(E;q=hhsKyC&0*rWdl<1E7&Z) z{IobmTc7m)?31~}wW?=UdceB^=N`**)rR=hNS?zvz`jqfr)ffGExklgR@Ac8J62ZiaEx8 zrL+Wk4LER1B=O(s=U<-b(*9Y607<9P$*h#?MCI?R5h#Sd;RuE37*3r#&hiCxty&i z!u8F^ygtC=S6Pj1JhH8A&nOdg`>@6Q{cXF<8!=_YTqCGIwO0EpMgLaSzqj$bIWHh@ z2p$4Zrlph`gOVn7CzmuO1KcI)j2uRTbVlh>5xumo?N*+~pN(d;{Um+4R!2O0XwW_b z_0P=}d?&7UXi|L#%ZUqUQ|aaviOH{H3NVvEa%`4guZ4Yzy<-> z8{X7q2%FzJjBrdpVRG-IBXUPn;U>;Pa?wN$0{3$u71#XxX7?>@;xE^`F<0EygqK$3 zk;3O+pG|hP_cVb})&q2419AndfZ_n~+7jeIvL9d$d%Si5WxHC$+tqf_J{6eE7yBquuE__^fx+y*eBT#fca1CS19P`E~zI(v@fh|jF*Xrgq#5f zSpibhiu}1lN?`t|fU$rC7^xvD8*(QV&B_EoWr=*qQSHFf0#4-mN5N3(9b_x$5-&Pr zjvl;g@r%ws>f7fV$0RYeJ2!k2T}}bsqVMlHdsV*DK^ig7zc3&^hr7|Q*Ztb5G?N*yy)qYG(}ide-Wsy_w4>|=7jp%N*eh|Iz1&mf&#a`n4DrCUtXwC|e7^--ps z@_Ta*5o$*0=)^IZLs-FTRL;*X*tdSKVvO;vhF4H&H8&&JvporbYz1&e4?p;AP*j-h zlRqWh;0A@k0x618qVOZ7wO8ZzzM?|#z*uERj4g?JwIv3tT&cF-jA*gIX%6$P9=lwKEWF@o7ID}k(E24J~1qu9Px_Qc4imsS*|#h z3Z!4xkmoXh))KX!?&LMHd@+yVU!3^EcmR!km4S7e*6)*uxLj@MaOsb2$Prm@eIy_Ek^|D}l)^-Sxr#fdMO6Io z!u!emb2ryUrRId6;P4Mih0~u2BwsEo9NaR>M!~=cTIM9*a*ixdKZ$tl3oB2Tl-bD< z)iu$Rc$JOAWpG1#MX3-ld4yZztc1yNXt(&qVu>O7;t8?&!*2E&ku%`tn1SNEHlXFaAn#Ecc?SY9_14{z~R)!lpfW07%bBbkzM| zzyaZ-!<2{)JV7DwO|!=j{L{iBNzFc~*acJP*sF z1t`HOVWzcw5c2s!F1*|8k@Au5xgL-l|6s75cLI-u_t~OtC?V8Vge2Cpd%m2Z%cp!I zK1GQMFW5xqxX^%%c4t4{(ci}F8jQA4cGj658ukMe6e zOJ^ULHf6@|{a{pfN{&QGfWc=_Wk1;X>j*Ehg^x9-fgO5?lA9}|M!11=%!)}6zSlHnymYpl3@%(0@qwE0Pv z>teQ$=PCb#Oo_q2sF)Q2I<;C!Q^;`X$p~F*T_W7TY7I-g09VIwN5tm7&nCd#bk)60 zW@IwmP3*L;!s@B9N9zjeOR-O?(DSdWjMp}agAy-tt*cgA-Yyk={&N|-o7%^&w0a4s zQViJx~oi}6w_5| z$@6D%;G6VZ`|_1Hci3~2y{mUlq}k5mr?}VDuH-4M^*UG&Gvi^htBiGhN`SK90;Cv> z4zk38_%;qWa3ar0SUsd5Q{2g275Ea6#m2Qlw)*}Clx72@HkB*>08uy_&t?8l$H0a3 z@WnetCrz#?&c%Kj=NO5Z#{t+q?+J?aS3F*<&1#SPH364F)lk%gGqEUXN&{?_g9c;> z*C{M2KYDsQUy0XWJ$=6sCAq%0nf6RNl&xIZaMd;6^7;cO^X72n4n0fGsP<@cLa466 zJH=fFR4$(uK}w-C`uiUuomUF;p3Nr*gx_-=t^;WwIwbKBi2VP{xtS-4t2m>aa^F9V zB@{zt zV~f{?`dtL{u^aOD9~t>@JMyE=2NA{qxzRtg$OXQdW`h8kzJG@-{>=$vB4;zXeFVp0 z+M~0M?6dn1~*62kaTYR?HwAbYSK9E65vLqUdvO=~E%;!xY*Sk}34$ zj>>I(vtNuj+SDB3_2DP_=~8aL_}8;FtN_44VOxkJGOUYjgs&&5KN-dxn988 zy!rZ)3e@ZlJyR(&YR}=```AYweLf3l@7em)x>FeK+UHN%=VgGqNR+8(o{1iDH4&qe zE_ooe&)uPjFfGPlda!bwJZv`}klaQ3fb^d))`?pGyFYPL2P*vy#A^A|`iV(syd+;y z0H(a>o>N*#>x#`x*pUoRdo5M=3?*z-d!&A}@7UX}R`|&UQ6$;QA?XY?4AK-2&_!Q- z_VK&@+a)Xp2NiX_)xX}lL| z-zgIA6moxS4roL3xaz1Y*D$v+*lkz?vVDmmrR9QU3v_ovgR0aYhbCkXa@kn?9MPT! z)X*4D2cXh8i-057M!qt~B?=V479Ax+BTCQ;|5oNDT?Y`|Q%Q7c_4GG8N8_?@aH=y_ zel6dWl-Zh0FU|@&y4Rs`3vy2WpSb{_jEc%ecImlt#fRLd1Hys+Ys3W7&HWQ#uiTP; z$SQ@$i?i=#?uT-ccN)|yI29Vjn8=>caaBB8>o&0p?gL~-9e;Qz;StsPIT20w8Ji!0 zt;uZjs!#=$i?|wjU8^fOp$f98LpoaI5ohc~6A_$cEkk(*%P`+$u@;dS5s zdh}9hR_We7!K!wisc0_a4w?AbG4aS^H;t1#;PZw*i?30;H7G@_NmW~38CWlw{onzP z2U+(a`;h~(A5rLg8aUN77G7{I{S{O9QlkQqmk5G*gXD6C&L5~bA)y=jzPiWysZ*6l;1E2ZQBiW*Qt z5*pG{hU&aHq+zqTQ1ODX-CI+O_1|RTR zJnkVYTiKgqEz{%n7ZOeChFU5pCj4-WzzM9pPod)-kJH4}$=~sfp$|&42?aYY?Hi9n zx4*X{<}~r3f6NMj6y$$dQx+=vRd$HnGv=RPWAdjl4^Fs^N}&!3SGva^#6f7w!KD5v zT?|gudA6GG03L#k8Uta)xxJ+qX|;K~#!tgwXd4+zk2#vd_YiolSRfeu_9F~C{j@rbhuf`MI9cSghfI|rTW%wi#<-fwC#2;Yg;@%yc1WHROxtB zD}7n)`Ob-2`}=6}QM+&`KxP>V80olGDy0-^0NH9>0p7*SllfU~t%1JGeD=vU5l)yZrn)M?4dQZ~5@6zq_N>@wewL*V19C7A z9;Gq-|IBE5X_g9P%(Gh1sC4K3Bl?^Uc>`?qkO;zb{E^mxZ|l2@r2J zy_U(k!$Z=ls*pkpt52Ra_9dxKZe-xI^!dBZ)p1|x zuHo#vv;aV56(ME}=mD5NmI`VX>e6USSIrW@!T8_i#j8>?QUuyecnIR%f{alcs8c;( z{J-gVuZm?*FxmF>=X51?ZKP1u$a}ROp-y#m(X7d0I;DNEkH#F1{Bp@8l;ug}0_VBY z_^wb}YPk+NhHjyEq77y1GKg?{Jg`GRkbV#f6w+uVh}8;ehPP_K?fTR4!>}Ikw&?-h zL)3|w`wCxg{5>8~YkTGvl3=DO;WK+h5%Clfc($hA=!Crb%H z8RL+um`&-|2YgbH{{t7{Ge%iv-hAUN!5g1^TLQ-1>$mMGjo#LE#5a~w%4Kgy8PTT8h}}r(lsKPYd#`3)kbZBC?Uabb1C$|6y%ThoL${O6n%*wW=faO+R90&* zcICHaSXmJR5g&n|9%{SJ`LGQ>d*CPlsJDX$Hd&z`Gvx84R(TX3)k9>}NY?$nh6S&}NrgyJqb`w`M zyN%!uNcHgn+!3jkU`Q~zK;mFzNnS634fkRGBa;Xcc5+;YMBQ-6n^#eQ@IyB+0}Na% zr8Cr5?+vf$hjm4s{%s&YLFa3GV&p8O)H8jftomF0|7?Hhxb4qJQh_1XmM?6gMZ5=%|i3ql^84FwTLJO8z=phDt{Rx!-9G zeM%t~;DAW(W)-E|x_dI7IY!^z_+hfhYW%TY1h(R1lY9fVpvRd5ouQbF%U^{TIfe2A z$#9qpLPG&dLysD>C4if6Mv=&4Ks-9SOt;|1qV-OFl5V{Fu{D6yOh<>Q~)*%gFn1?K8>v^|) zXp0_WTFCT@y~l1)&vFMH(tdCmGuYhmh;MYSD+dOZs4SDBsH58n;&Kmj{*SdF4IvEec#+zdHb-JLBV;(o zM~1OAjVL|dmaB6}T=_8bVJEZbcL}PYFfCbz7f~i=HT>Pt%+Ee0Va+x-8jJ95g2Sx_)WjX- zOI*$7qetIBo4*3>V=7+Sri)ZTVq||(psq$uS%!yhnx(9e2vn(Tueg;b&?Bs~yl8+Z zZ3zAC_QW|0@~us9wRa!z`+5dQ!|bx@`nzz7(QJh)ZWykZWNy-|k#47~@S(7fN~R*! z0Bo^{ay`lJka%V~t_D*5zx9i3FKV2oalXIX{{hrbYKn@{BU+%+3T0dft%&;(Ca`j> zJS?FP*u{I3KzX4A;;v*`K+(FBYW;M^$Z?Xy2TB~K+z`y!SVG%b7UH;>iPq}br^IN- z+u~+V+277)($p3EJgYg(Ws;@M1w6g~GA7()^s=QFkTk$VO^)<^?iEntXJt;I12g(M zLeJjHBz?fgU*mtf?Iv(fOcJaA^yklahbDkot!agQmcWznB)>BJyZVo#kb*x6+{A$W za>cfIi-X4l@KFB;Zr$jmg}L{XU?aZ`Aq`0+v*_*&UNvi6{gvG%s=gIwctdPJE8l)d z^km(lcC8L}XX-cSwI=Sgputjua*HE6Xk@0;)R=B3H(aCmmhc^?q*&ia-jcdbS>sf4 zfVO#Jz*xorn1Hht-5vv*^bVCNj2I)-`^YwH8fWPF1-;iqah+)@au%N^=LPNvELY)6 z(N;%b4fi=HAj6$H!QLW-`^4pIro6>zI!#sD?UO2lTaaMWEr!d_o9s{kptk{n^&KCw zzI5(z<#0^^P}mWXt{Y;;*n5YATZc&G2leRdev_d6_iHcq=(r2D-Yn$5_zYNF01Wj8 z2-%_IFJQ`<+Vo(N;tr*;C!O4?)CM?vX!fTip>i`t;>O{~kY#<}g4%BGXccw|MYOC$ zJ(;^)5uWx=0yg68!q-1s%8Z&wUX$s?niP73fU#Wn!(iKcbf@FWis;jbtLu8Y6z8YS z;qx1H>GYk`frvm0K^BS>8kY5bsF=DdkTmFu80JGAZ~>tI5S-mo3Mqks={d)a#C)k% z6*AltGfOgezA>RL&FdY%-l4|H`NHYP+>`tGd#pPrgJ@213b}Lji1*hgz!>vOqH1`* zO@8vAsVl+29~^4hHvrqzV}8AyNRr#(e2{y|qg8MXn$p;Vuig?Z1o@-4#@m-%?py^1 z6kT9+r@b->JW;S*^=!8ueP*{pl;nlW_L>He_$ol)neR!JX;|LOri>Bp&p+cC<(E zRLZ}>S_0zpgOLiTtK0*40RV?`3Jf;sMeV(?{YpNqZ0cnJSm-s@WLc5V)LANBkkq4b zANzBhgG(p%@1ma9DPYJg7hsw&WytIfp?)vuKpQX@dJ^wiusySL_x$kbf+FYf_=ib4J6&qP`U+FK z*zUPPwBRikG}2%5zB(U%SLQz9Hk zk;}}&%}^85xB6?2Dj!Q2;U+*AV?4mSi(Jx^Pf`lSfpL|m0JBljk4r;;Czqs|y9PrD zQ-|4*7%W(GKSVuO$s=dAP=4Spjch;LtdTUiqYnNQWwtDjXtSJYBeApytJ%*T3xU2@ zg}jL>hv+`D!BWx;|7W6|BDS^7!G2YdUiq=Ok2+87kd+0<96c3b>RKi+ph7)(1YBkY ztvF;A=w=jZ`NTGz43brZ$pBcbxWWmrFa8(cdiudvGx{PamReB@?l2%!19ADo|9&Bq z8S3B)fE>;L3PfV->KMU*Ill}$KiQHPsHz9kGDc}}knW3{{_jU1go-hq%&AH-ME+x%XZDpwR^?yzW00aP&6o~!*yg{)b z=Xio|wlDwLt{;kE9%@2Xg22u5d`8hw8spImz@kRE=tuRDAOBQ(5WF z+`hnor>i7Qwpw()s}T!dQPX)S7rWhZ*S8W}sHzxV2Q9KA&h?v+$c4XmUSdp~hlW`Mwf?k`H_b#n$k006z+o^*L@v zrr#o9FN~3g)k39*5d$J#FG?`?03`Cq%G3kfBYzgL?2`=oiNd}ID~(Tj-g|opnimDi zAVX3}B*Ma0tQ#4TnH7btz5hx!5}?0F++kFYo$#kS{UFa|zQ_UPQh@w;bZmCsAd*su zx^L?C_?ewSbI+7qi<6fbxo5c#EBOC3&k~|d06~OZ_xw=Mb!F(BkTvT zl}$k!&?Jn%yuGU_K2EX&YpaY=Uz5$7i($38UD`Uj09~Zg5ivyd^1w=?hKS}P%9=%TN&(6Z`7Z? zoW0!2tl?fWIravt-#V72rE``q?3oKO{i1e9TQ7Fpe=+pm1*ZTnb#CqYndg=}pMbiz zg8jvW32+2Db4)4E{M{AVxB!?B=~8la$x!?(6_je(Gst`?5H`;^6@gIm`lR@GB`0biUs$wq#O(V7-i))890=2t!iM+EV^!?U;)W79Ya7Z*TIXXD66tA2FMZy)scN376vPgw z;2;$ncJg9tfR||BCSd79y{dCH&*39ayjOhFjej+j1)o7lKQ%@Ts?rNJ+x@}p|GhPf z8V|e;)0X}I-y&dzaAeb0&p@=#rsy2}?mztw^D&&w>{=b3w0vLHPG74zV$8uA>l!8b zA+&otFYrPvZAf>v+eLOR^xB~;>|Nd|x71EWM{!+>%8xkln)P^3Xt%(=u^U*KTL1iS z_kj>l71r*+DE)EwhsM_iq)3+vN&Zd3lb}@}?rZX0a~q!tKGW)toGTwhDHG?$2fcAe zdXUp(JY}>}m`JG2w#oKfQ`b%nmF>{XAA_3pJZ{9%7_}B~tcX1Pwvq3q)>9$9=(6>e zys67mz4j5nV=0eo!_c|zCwVRipVwnhgwNJ(yl6vh6UiaAc*^j>ZOIIWZGJzapgT*T3xNkR8Me={ z#2c3T?!G??zDER_V|$yga=s3bEb*J8uP{e< z1>R&KaNa+U_`&YBUqz^FXlD67!4W4r(Ig(&UcV4FD<;vR!!(J2ha?T&;sO66r?+~b z|DfowBLPZfw~wpb!gpsXVGo6yNFl_#t2$0^#;Aw98YGRk6lMgQ`|qqC*wF+22nUXo z0<8i*Ai$OfT)6v!7H9)F5(zKtP#Q3EH8Tn=04VW5^WR5;4<98!9mtqje4aSNXwhX% zaA}{+ z-e#*&#jQ$Van@hS@HaSy!s^I)Hu_el`!~dyOz%XYFZhbMy%14xc~gx=kq$-ov?HJ)(w}lOt0i6{eaL%%sFxM|MLsT!dH*35AIWIxZJ|%hW^@W8J@meZDJv;2G*@i zkr1X*(u9lbziRGzuW z-MK{*RJyrj(L%+X#7AZ9Z^UPn#dR+qqVWAadvrmR9hscv=}5tnogP)DravF9G$-W) z;m4wZhNsoD_xIo62%%D3!9UzMjw7~`&4wgReC^K`rVJzxQmNtMtM+fg3a1_xZ0*2j zd!wo##PhfE z=;TUFA#tv`xpl+@;fo1eYVB1=R|A+X`)1^`&t(LEA_LstvnrD;nSLE`u~0HRB|Bec z_o>nwxwtv(R<$3RDX#^Rw(`rvh@2N|O#x@wj9@l(`xibhxcj8~WaBPK-Q(E$O5^zA z9ODj2yIeL6;#|o{$RbJS$>!oVN)EZ%R;V+ihItq!~Xmhn#LA3cf4!M=^7 z3RIT4i0eK~4pgPvC%xm9oAEm1xX_UNU+KEEke3TRAy8^I{IlItO*<2rW)+H6Pc9UvG^3mNg-+^9;;0 zGq9NNSy)Rq(BQcnN;pxbdc z`;p)43hvaE&?ruH*|HtmX=_KjuG8vnXNPaqElxez_81ra20FX0t!<UXaVjNoCp^Xw?*fteo6HA(226N?Xs0Wx|yNG?zgMHpH7bPgsef#rSE8e7WhrP?AskLhA6idNAr@qI1qe161 zuimEIAMtg$a=Zjxjkn3VPo>d%m+^#=+SeAeyd(K^bg?jGL3*wHX&>jPBmtd;B!HxU zBl8!VWI!`iOh5xBNH+V!4twb(G8^ld{HF$=xE+tA_BrY$7!fF9Ou6*@>4hHr9w_K! z5uL@iCHxR|>@PXmeDm>LqRQayP^G@|d>NzkevK8n<69NigO7AqRJbSUbPaw9ZES=F zDSwg2RY(>Rn#3JvpVlKL&5`SYQUSCzQU29hUmN95hg4;lye==VZ$||Z`g6W|-j5>l z2dSte6k&C+!?`WKpueXh83hcxWPi>VJJ-tSqzP%u+ZhZ8H*vcQ&LDUAk+{C~=(V!A z>^+xG7Qt3F_Z_5@{DJTt6jv^jIEnVl$4y;~Z|`u_eX-0jn=n+|e8Z1?rvM7aqmSo= z?0%D(IF4KMPys^NuLrh9BQ^6q)$X`hHoMnRdhebts6Q=CfVg zI=$(8Qb4XA-A;xEgo^y#{3$4B(jc z7?9sK_C9af&oQ*KOJ>T_s6?vp&6UrVm`RP=GxdSj8Wh)iqG9C0KoIWOb6&?dD`E<6 z3hw{Abm5|h13&D?LNGZ+mjNZTJ%x{GUM?J+cJvp>?A|KE*5LGrl$~J$w}9lMWyW_t z8?)}4l7EE)x)&aAGzUy$*K4}lVK@=pimq$C^|Z%Y6-dK(xnWFbK8?6Ayb*uxd#c=V zMfKbm&A$GGU$VH5j?FONa2k1Ucz`^t8)?%)Hsx5HMdV=Z*XW4-e4hMghOVRa$v5ZK z#%qf>Ab^;=a#?`x@kGm43Vj0F zuUvz+)CKMbkeSo>^g>^${eAC}k4YqFL{_J+lR>>&Y|^<_u-ldwNLO`atlwDW4o{n` z25%U}_Rc2(G~)27v--a)a>9BM2Ip+Kt)5OlbSEb(ZQjSlIliqY44>D1w-ZAbZ~?V4 zg7f+22DmjDod}$339xh)xD9YIO~2mP)e>vm*<4H7dc`>DjY1fa)kma0M^#wxI@<-E zcf`iFD>*Resk(DXf0p%B>$s)hbD;)V-}VEX^BUXhdfA5H0R%;4wcB?L_BK^n!&8VE z{1|*LOoyVA&AftbrS*LTPgZeqeV>xUPBL@u3jLhDd`uWL9#|1{>O#0Ez zxtll1Y3HwXla8UcGNa6daW_#}Wtj`2(sf1O`$?tE8QiL0gZ{ zOm2rJ%fu1rw#e(O{W|M)f~D#YvSTP$yx$q4eqHN!QER9a4q) z9Bu#Ai6>Ka(8v(ys1~&Hb6fA&Zx`zycuwPr^S5d+sqrL-D?R)V260eE8|;uN>*K`P z>xOSg9SjKp4`B)8biRd%QMn!$sW(wE#ObeTCI3i6^GJm zg#!;hcwVS#8H=yN~QPy!b$xILdZ z_X%rAx@(cPyGWjUauKnv+~nun46RKnOZh&1$N3_+sxtieFlg;oYWKEb9&I@u0^ThN zjJ_Xvd1j>L>q**q4GF4ZM{r9P%t=y~Dy}D*h81vvC93Hhlfli^wlxfKms(l-&s;I@ z4kVU#WH+g^wr=O+XTE_u8cv-OyH+qT4h~pC6K96Yg`>_D*nB;YO_<7A^gBa;!rj{l zPUX<|{cDxEEm)?*D7tzKAl({cY*Y?J;2Q}dN6Ls@NV zL~oit5>Hub%$P2CQ^fgM=uf7;?VxD-(5zR1#FSxC=H2&s)ZyjK@IN@yuO-7*sp4hg z;c;mbb1`==`EiRv^FK2hKO8CHcdK##9v%#14J1DjG=qQsWhO{Qr3mvR3qB!;Rbyir zJq_C0nOb0!v^u(ukVUw)lwikIlivRU3izq8p;4j9jxpUASolF1#0X_6$wpzB>YKnp z$@K{VWBs=oD{+i(PbU<*1Cw5q9pfU=XUsfR)*2ilcx>{Q8b?I=4~#=#daXh>$rUli zUr|gmwcuuz6C%AUj1<>&>A`%e{GCh-Rm3~Az(F0XGq-7ysJ*r+=T}+FGk!WXUho#8 zYymaWbjI(c6CM|BwENIPTtSy)6)o zj=E#@U{)}%M76CWo{8(*&f>P;^(99JrUU3RgoG|LRIC`w5@COO`rq0n9^56!S~ui= zj=bp3{Uv6QD2TB(>XXotd7yHz?_dpHqFlA#v&GmFK)#_JiZa{hS3^r$u?gCu&X8$Q zDj6E}M^SVqBw|D|@4v1tQM?QGpLyb}pqKB{w!8b^%NDNBE>k{DsAe3K#MWYeo=XwM&m@x~>VKg2NLt#D7=?`qT`u;$;v;E< zCOUW_Ck(H(YtGYbMm*JTe~!<7q^7H}lSuL4(tdP7_IHt-Fo2_Uo-hngb z3~l;jN_#xr+n@$h&~e8h!I|xtO0y{k3KfxxK>?$Muw>|HS@H^g>^N+#Kxwt+1VuCF-_t zTwir&Y@(+B8n(xfbclC%oL0#ND0GbNBG!ZhhIHYib9WzsR?EECd*_YLE?ScCHo_Qd?v-)K z$D}b&fuIhK1BLEU+RQ`S6;VR$XM~-J0ZFx%x6&S}W)8LJ#c_{_U)FuK#V^4#M5X#J z(Gl{(0S_@8*x$Sf4+ZUy`R3>|Ht@%`CE0QJvxhnqK*G0A8tbC6b|8zrN46pMDzW~3 zBPSHCe3AYc!O!#tO#@&02@1(22s(V-(;Fvt3r_56(~EwqB9AwUp(M}dAHvgau80*u z!zh3Bim*2|Vo28xKU*g@uC4gmz!%4H!`GI!qE0tv{kGto!#j<#8Z2d2ax|4TpZnul zi-H-rh0Y$P&oXo1jLw|8Au$rerTC0f%tP#MWYHIng^UOynoX@j<6lUI~|rXqJ^ZfEiBaLy)SJrQhzgVyBqQ>IkfMVR!sd)Pga(9=dhM4 zdqrPI<`p|OLC7T|OH;m8ry^e6i3Zu|WMtWXtxjX(C^!xIF}ezc_D_a9w8-eDo6O;1 z6!sxbDdH8Tault|*Eap>m%{plr1%Qdc^+-`zQGogT2fX;Ej^w2Zt)xv2|Ab?zG_br zx{G`5e_2}0>`)aMmJKUb7cn@p%}cUlLTUYqrxaX#h)Wl>yyGY}(2Ut&rEUjI?#YAn zc8O0%!vx2|AoTFj##?t`^He;pd7@?=e+a*c2M1AMQ-Y6O4nbA2dgS7s_jIRm!VL6p zWevyU$nSmg1tal;FP=gf(jw+-@(zj_@WlMmaa1<$R|N?cW?L<~{Q*tVMr5Z%~b4Q1wm%R`14_259MEu@B?rqKr!@;)99_^os1R<1=ym{7U$3|6hfyy5+KohLlav`KH0MnLfgwuSW^fjEsP4yY%1tz9{!kgI_XCtc9QA`sR7a5R%)Kds!#0p)&}Z6X4seutEE2 z)4TTbDHrsRsyouc-l!K^u`M1IOixA?-0>P08|R`u+Up#O(DQqQW!LC4`|@&s6;vYL z6>-7tUWK|Xa%0R|kB?ESxCFCZ4vpWd2g9dOBWiXhMJ0KJ!;qkEnRG~(M|>SL zrw5Yw`i|~0wRU!AVXl5I%cJ5`x7SVL_}bubTNz(;sBU9%IK3|~t2wkQyq;IUA2qv> z4K@pReS3oH7Q(|6B;^v!#ChKAQ9&jl6#p=D)Q!TbG=4DwNiEtSoVRQ49 z%diZOW4O`6v?o)$@Bi8U3Y-$Hj)PFpX{q_RM+r}UT99&UY9S{h>ALFE%a z@bL)ygG(r@Kd;m;_LOy}vm1s)90}V5>LzecYZ^5n? zddJt_H@s~3Ol^VZl(@B^ye5{=_ ztRSVR64D{v*LtSc?;I4|Y{72MlwHf9G6%o#J@kRf0P67mh z5DnD5NM)T%{Z9!qD)ze+bmM&w%2Ebk6p$4Mx!o60fkeHG%VXE$)}=Zq_@+x{{x!g8 zqRVR{KlB|ig!&KWri^>SG7$`XbS~s{u$dpV*;rg+U8N3ixAOU{iPvA3fKHHX_x$Sw z?3Cu%Dl|h{2}E^Yw+caw`F)rbKT-D{YLPPoKB6gup}##1l}ugdCtJEXx{ZDq32kPi zzp%c!6v!+#kokYw_+FbGH^$#*$FXXz4L;r(oiXX2dWIhsa>ek_$^zojJz%!bRuf-Z zV({|QZqOXIj+7sFZf_>F5@IbNhw$m>V_~@}8fx`ETB%m+v@yAg1 zaMwc9Tp7QqF~}Xg5Y|r(f#m&8^Sd;EM!FC;q%CYt28_G=)v)YCQ(?BhN{=2oBoE@n zaJ>RUJXgJDpBcMp;6;;sxge!F^@Ql*NjJAiw**zWgjpZf*lauueZ!yxOaCC|-AE^t z%|ChF?pPma$Gx*=sqOiygm!ct#v-FCFgELo#{^Kf>>K<4n&{0`buGw#)ju}I% zeWaHe@If4Lp^bw7je4HPHnP>sTV|iSuBFr!?J#+LGn|D=^B4O(wEy+9?zf6LW?61D zM(ySo7xlLEQRF}Ul}vw62n}DN{P(CvM7gGNVP=fQ*>y13Ms+udMM64BARP`$HCeu` z?@diqp%7nkpkZeu9&m=N6>sf&W`zhao&mye94RS&LW?I zKCF+8_Q-GHT=7C7cTfJcLx@1Tn*NnJSeuQp8%CwXJO4Zd155okjGx<$%G*k20qe>~)(}7dC?Jpwq$^R?yc52`O7+Z` z2}U&{s%ZMV4vs-1;6O$wfAquZ#PTCsWVP}B{n6V?M_5Z$g{%mXG zk@}@#R8DW?07uU>w!~NfdqSQvJn{L#nNt_@zh-Cy^s4C}Fv_lKq#YxImU&7(DbS77 zj-x@;>iGPQe){gsLFAt-%5wCuO}(S_uvw$_Peb_XUi2Q%Tf|qX>wHN-x(Nm#T~gp} znNfLt{bKCMGRpGLN4YDq?ZcDci{!piA(9`p1I57TBSaa1me%Y>xPaiUE1#5DMuOWD z*V`C+!7}u{i9uREK@X%tVtyC!+RvVlJBu1s3tiSG^d1etMu$F4~idp|pj<+|x8 zq`s>6&Me`lTv%4KzMFox_{(En34$96Ve^Mw-k8 zRpDB@Xk3ELMN;>0`v>n0LwQ<`>RCgXeU1Zi;`_1u-h^U|L!5K`!4dC8b;FPM1j63L zW;tdsad~0$NxUq33uv<>8V#(VoU)q3m<3i!u=<1n(~R6b7h-CY)~tj@j;@FQ&AgZA zV~)S|=oiZjJ2&TL<9iQaZ!b(e6qPWwfvlB!G@Bq4J2Bum*OYoncjGl_IH3-t^8MEK zr!QPTUQWMRy`9@{1OFLaBc9S4I39S|*`IH7|C?Q~C~J#O-LtYfE8qIf>M^0T5SYjvwL z6f)3~4qUnFO%UDdG5X6&f44=-nUi4UoTD`xd)p>+p5D6oHC6$<_dQ1pMxAL*1w)G1 z^huYWnC%&jImjqybCON9Ar%>B3Jnr#1y^yBcWnm^O!9=4Z6;_cyd9Y|ymEXntds71 z{e(cre>k&7R;(xT=fK!+_RU4>bDFo}sogKn_|1n*-be$`m1q>hb&C>y{iNn{2?@ve zzsAaZ@{Zp?)}JUQ`&M4C0fg{Alwyadm1*Wh+Q2Ek0p72J&T}ApZN%{J9-a|0(VyV9 zNHgvoW)k8&!~h|XOJQOQH6{J?3#$c3WeEO|%fQJvBXW!9-(V#eL&b z$B~Skh=O$ES6FWmF^LWT;D@$?$f*I}3PD3x3QIXj24o=iew%h`dD7u0&;T}?c`-Mf zd4qME-UUe)R_hDzS6-g46*!ibiWhCU+CzukE0m3zW;;E1y}c~QNL62}9o2;{{Q!iL z$!6DgRuS_X90 z_{>l#O~MQz9E$inS2FARjNAe?GayVjb;o#MB&+8Ni@%bq%>J?PYi27~@5E@>#|lA1 zo3mlR?!`LkdV#6WTw~HU3zV}-L5%U%(3;xma9qH@_784>Fe+{EqVL-0li$09imzjD z9vWC@i3Ker^4QN~>g;9Z;_wkt%df5H@QZe9k~GyCpVI8cc*w#Thc!~m8O*YL8Q-B) zdKa14Y{p!dE<2DoZ4rcI!3G`o2eO{zQ3!v?T0_DhS;k4Z92GA2vR|NqtaLTOOkvyW z;g*?vizqQmk}fiExm``D?Buya>#Rl7i)TM`i_2-%|3e!CXfk z3$>^e+_9OWV-RG|gRf&inZJ7^EPAReVgYU3DJP_*t^c$Pa)p&?gGq;?T=BY z2RpPSkK>QIgAa#(&6^92uM_DUjYw1^!D90->ncSkcoZBC1FNLYo%$HteZ$of_Y$Uy z*@a>oe4O|C@vLlu=J;0e7j=q-%#7+oHpZfYcyBJWYE6SIP-W;MVu*J*ga!nth4450 zW*%?90`HSNyPj2=y|LEFhl({bNP9qSk!trZ9{t%pZw&BPb)UHf9FtTVX&i@7$cME4 zLf&TDH6YY>Ud;sN+@0!K`n`9Ev-6I@80Jqk{Y+NwePs{igzHBV?jy-J5-1w4IU3D_ zgaayK(O+%JjKS&ecntEQ(k)sZJ~twgLU8pd>fd~7i4&WvhVn8y%1fezL*;r%*Ne90 zz$Crj&GtU{r4K`6^6`p08{^|BEj_-2^~r_zKMD(|U+CzH;wNYZS4v}FAzqDQa2rEw z{t*tTc1%W~qu{4LFRgNdU&<|M?#jdu5<-q;SKBwGbLyKKy;YU6n(qn#G=&b?LlL#M%d(fi|A3B&N&m=rKTff1~Bf zxqMMN?-(&Y;6TSzH?TkzoE`V-*V<4-F48E-#sj=hGqd};>RiNV*G?h11e5EslYkzh z@`#e8*z4>0J4IE4nJ{)GPy8khwP|Q(AaRkmCyBP6+mJ8f^^YDHz{@S4nq72?@}axq zPdkOKAVd9&dniq92(X*S4XkvpI`50)zwnw)PYSczp9~$D<^A>5fbHv&RpiRvH@rv1 z+TzA^*JTFq!{u~>h!E98Ta;@4@R5&lj^E$8xUQi2Fx<%Ci6zvAlJ4EmPS}GkZgW=~ zXFsB9^$28jrAfw3-Iv&5^ddjLj-F-kcT3l;RJ=_*M+$XU-RWp;S+q&%Y}jnlvz<$# z`z9evZ>$n+?Swo_3TD<*IQ0E1vGKQ{74A8?y}3xeu3-$QSIzPO40woiq)pFIZcqyA z15hu^Rh!epnue)x}w*~bk)qEnoRgC=PnQT(fbc}Hd8 zNp+W;BNByY*g9X=vd?XURK~quFENeTuXi)jlSVCpmxT57uI_Hx)huP9kv* z)o;P1un6~3p9_z!*R&j!6{0#@)K7W{94_fm9_Cs1w3+-JPd>-vzSi;=Ewx3#Ld-#A zBks7w4e|aqqtDSKvHrlrxzie69l+`>s}E4ITkN2V0t#bsph5dzGQZUGv?os-5+71= z-1;#qTwY4YDvHnK)|rxbgX-^x$5e$R^s`ffoJaCFl#7IW0fOFjHPO$QXN4`ztSam>%28AfQuoxj35Gm>7-2cmw)l?mNapEs zFt0;3sCX{A$?3_9Oycs3H&-uzhy9`C{PBjhdw-_ucI39u7=t-_i#RGz4}Z|q2#81o zig$4o3Hb_K@qqO+I3dmn|GMM@ZK%ZvIt_EW^8RrX?)2DG+mHXH$e^xb3d{|p?~2EtLf+X6h~_OMFodh|b`SqeU7?wO~`K4$8l;tzLB)b18~BlHEflT1u@cWmqxm zB&NK^Mc^YXBNtjU{jXBO?e08y8S-AE!l-!9dN+St+FN{oym?I@^S>rT2 z#h&SMU|y(q{SAFA8ZK)q_Hw06uLOp*Sq6yq3?Hh0#b0<>nh+M&t>wS<%m%VOwk5kd z3oGb7(yq`M=YSOU^k&}7TtZgpoKjh zaXcy+Vsxo=Bk<=br~98^q#MZ_0FTXQ8bTz=>lbgxKK-sam4&Gj(`TlSgyynT047IY z$Wf_}_UR0LAF1=@9pt>@_x|Vl8NccwS3-aEb zE-Q_(IoAf@fpM0(?`m8AF=*&!xvlW{G31ozCLcJ0qdwpmx`b7@g(u-w*OtAVwZuT? z;JDT#xms?ySm#KAW zNqUCP@3v9)fiCG6>#27 zoF#xnRjA4`L(&lenS`3b5&% zOR8rsZ3RajJ}V;Lq_Rth>0idbqoZV8wk9xBcPslO*v0~~;J7m3yjqJjfEl^Qr2>Ne z>%p3iKtuk{{-;bJA*{P`Dp<^g-4za}JQQ)X=p$$0GvOQ5NYH#@7fKv-`@}&Hvcgi@#T(+d9^B|b%4rw+XmxmD zK+DxVg8DA5?5g74m6&KoEgq<@D)#6o393m|CtNu(=@V{6a*Iv*gmkkA7hDQd@qo9fj?0Kv$$GoXg zJ0SOFM#=ee$%+_sSuB1HlJ}r*&zmZJe5NS|%Y0JVpW~?gg>zD)7i!gO+@p6tRxM9? zfo5H|OaS3%#4+CM%-jK2jV&@+HUVU4{S`Af?kv{d4<3bG@7P|B?xD;xvz3Dq5Z%6>f+50xNPTTO zO~42D-P5)Il%fq+RMTSNYd$oZfEw!_bZtpv~uv zF-2)JHNI4hpun0jiUkltl(tlZPsxQgOp=Av*@ZpG1B1I+JqUgs{%eqwku~6aF5k#A z)s(VO5cyjOeM3Ckc&KKP2M@jqCV)@xUIY~U8YbOncT#mfwdPeeBs>v56}vk+d%j_n zrfNC~O2yZkV03^-K}CX{j+6&Xr*8NVzP)F=f!F)Bezi-AW^#nVH0V{PXicHtWCL3n;k0kO&sL(uqO#wbI=YKd)^u zYOce8^U&ibw8_(Ffu|QM?9}?!=Yu2|mbxBh9sBoqCz)6`mjY-S4mEwoR3troCQo~{ zFK&fjBCqzWP}H&~9lG4{<50(;nhv;}(+K=Sq$60(N8HdpT(1Y1MAG0`g_Y(1C6p!! YH|$vW>D44+>&|WHX&Y#L)NqXXKf@SFE&u=k literal 0 HcmV?d00001 diff --git a/news/2025-july-11-community-meeting/index.html b/news/2025-july-11-community-meeting/index.html new file mode 100644 index 0000000..aeb9eef --- /dev/null +++ b/news/2025-july-11-community-meeting/index.html @@ -0,0 +1,12 @@ + + +Redirect + + +

Click here to be redirected.

diff --git a/news/2025-july-18-community-meeting/index.html b/news/2025-july-18-community-meeting/index.html new file mode 100644 index 0000000..8e38bf0 --- /dev/null +++ b/news/2025-july-18-community-meeting/index.html @@ -0,0 +1,12 @@ + + +Redirect + + +

Click here to be redirected.

diff --git a/news/index.html b/news/index.html new file mode 100644 index 0000000..8275cd6 --- /dev/null +++ b/news/index.html @@ -0,0 +1,12 @@ + + +Redirect + + +

Click here to be redirected.

diff --git a/normalize.css b/normalize.css new file mode 100644 index 0000000..192eb9c --- /dev/null +++ b/normalize.css @@ -0,0 +1,349 @@ +/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */ + +/* Document + ========================================================================== */ + +/** + * 1. Correct the line height in all browsers. + * 2. Prevent adjustments of font size after orientation changes in iOS. + */ + +html { + line-height: 1.15; /* 1 */ + -webkit-text-size-adjust: 100%; /* 2 */ +} + +/* Sections + ========================================================================== */ + +/** + * Remove the margin in all browsers. + */ + +body { + margin: 0; +} + +/** + * Render the `main` element consistently in IE. + */ + +main { + display: block; +} + +/** + * Correct the font size and margin on `h1` elements within `section` and + * `article` contexts in Chrome, Firefox, and Safari. + */ + +h1 { + font-size: 2em; + margin: 0.67em 0; +} + +/* Grouping content + ========================================================================== */ + +/** + * 1. Add the correct box sizing in Firefox. + * 2. Show the overflow in Edge and IE. + */ + +hr { + box-sizing: content-box; /* 1 */ + height: 0; /* 1 */ + overflow: visible; /* 2 */ +} + +/** + * 1. Correct the inheritance and scaling of font size in all browsers. + * 2. Correct the odd `em` font sizing in all browsers. + */ + +pre { + font-family: monospace, monospace; /* 1 */ + font-size: 1em; /* 2 */ +} + +/* Text-level semantics + ========================================================================== */ + +/** + * Remove the gray background on active links in IE 10. + */ + +a { + background-color: transparent; +} + +/** + * 1. Remove the bottom border in Chrome 57- + * 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari. + */ + +abbr[title] { + border-bottom: none; /* 1 */ + text-decoration: underline; /* 2 */ + text-decoration: underline dotted; /* 2 */ +} + +/** + * Add the correct font weight in Chrome, Edge, and Safari. + */ + +b, +strong { + font-weight: bolder; +} + +/** + * 1. Correct the inheritance and scaling of font size in all browsers. + * 2. Correct the odd `em` font sizing in all browsers. + */ + +code, +kbd, +samp { + font-family: monospace, monospace; /* 1 */ + font-size: 1em; /* 2 */ +} + +/** + * Add the correct font size in all browsers. + */ + +small { + font-size: 80%; +} + +/** + * Prevent `sub` and `sup` elements from affecting the line height in + * all browsers. + */ + +sub, +sup { + font-size: 75%; + line-height: 0; + position: relative; + vertical-align: baseline; +} + +sub { + bottom: -0.25em; +} + +sup { + top: -0.5em; +} + +/* Embedded content + ========================================================================== */ + +/** + * Remove the border on images inside links in IE 10. + */ + +img { + border-style: none; +} + +/* Forms + ========================================================================== */ + +/** + * 1. Change the font styles in all browsers. + * 2. Remove the margin in Firefox and Safari. + */ + +button, +input, +optgroup, +select, +textarea { + font-family: inherit; /* 1 */ + font-size: 100%; /* 1 */ + line-height: 1.15; /* 1 */ + margin: 0; /* 2 */ +} + +/** + * Show the overflow in IE. + * 1. Show the overflow in Edge. + */ + +button, +input { /* 1 */ + overflow: visible; +} + +/** + * Remove the inheritance of text transform in Edge, Firefox, and IE. + * 1. Remove the inheritance of text transform in Firefox. + */ + +button, +select { /* 1 */ + text-transform: none; +} + +/** + * Correct the inability to style clickable types in iOS and Safari. + */ + +button, +[type="button"], +[type="reset"], +[type="submit"] { + -webkit-appearance: button; +} + +/** + * Remove the inner border and padding in Firefox. + */ + +button::-moz-focus-inner, +[type="button"]::-moz-focus-inner, +[type="reset"]::-moz-focus-inner, +[type="submit"]::-moz-focus-inner { + border-style: none; + padding: 0; +} + +/** + * Restore the focus styles unset by the previous rule. + */ + +button:-moz-focusring, +[type="button"]:-moz-focusring, +[type="reset"]:-moz-focusring, +[type="submit"]:-moz-focusring { + outline: 1px dotted ButtonText; +} + +/** + * Correct the padding in Firefox. + */ + +fieldset { + padding: 0.35em 0.75em 0.625em; +} + +/** + * 1. Correct the text wrapping in Edge and IE. + * 2. Correct the color inheritance from `fieldset` elements in IE. + * 3. Remove the padding so developers are not caught out when they zero out + * `fieldset` elements in all browsers. + */ + +legend { + box-sizing: border-box; /* 1 */ + color: inherit; /* 2 */ + display: table; /* 1 */ + max-width: 100%; /* 1 */ + padding: 0; /* 3 */ + white-space: normal; /* 1 */ +} + +/** + * Add the correct vertical alignment in Chrome, Firefox, and Opera. + */ + +progress { + vertical-align: baseline; +} + +/** + * Remove the default vertical scrollbar in IE 10+. + */ + +textarea { + overflow: auto; +} + +/** + * 1. Add the correct box sizing in IE 10. + * 2. Remove the padding in IE 10. + */ + +[type="checkbox"], +[type="radio"] { + box-sizing: border-box; /* 1 */ + padding: 0; /* 2 */ +} + +/** + * Correct the cursor style of increment and decrement buttons in Chrome. + */ + +[type="number"]::-webkit-inner-spin-button, +[type="number"]::-webkit-outer-spin-button { + height: auto; +} + +/** + * 1. Correct the odd appearance in Chrome and Safari. + * 2. Correct the outline style in Safari. + */ + +[type="search"] { + -webkit-appearance: textfield; /* 1 */ + outline-offset: -2px; /* 2 */ +} + +/** + * Remove the inner padding in Chrome and Safari on macOS. + */ + +[type="search"]::-webkit-search-decoration { + -webkit-appearance: none; +} + +/** + * 1. Correct the inability to style clickable types in iOS and Safari. + * 2. Change font properties to `inherit` in Safari. + */ + +::-webkit-file-upload-button { + -webkit-appearance: button; /* 1 */ + font: inherit; /* 2 */ +} + +/* Interactive + ========================================================================== */ + +/* + * Add the correct display in Edge, IE 10+, and Firefox. + */ + +details { + display: block; +} + +/* + * Add the correct display in all browsers. + */ + +summary { + display: list-item; +} + +/* Misc + ========================================================================== */ + +/** + * Add the correct display in IE 10+. + */ + +template { + display: none; +} + +/** + * Add the correct display in IE 10. + */ + +[hidden] { + display: none; +} diff --git a/robots.txt b/robots.txt new file mode 100644 index 0000000..be20be0 --- /dev/null +++ b/robots.txt @@ -0,0 +1,4 @@ +User-agent: * +Disallow: +Allow: / +Sitemap: https://bootc.dev/sitemap.xml diff --git a/rss.xml b/rss.xml new file mode 100644 index 0000000..9692d3f --- /dev/null +++ b/rss.xml @@ -0,0 +1,1219 @@ + + + + bootc + https://bootc.dev + A tool to build operating systems like we build containers + Zola + en + + Tue, 07 Jul 2026 00:00:00 +0000 + + bootc ecosystem at DevConf.CZ and Flock to Fedora 2026 + Tue, 07 Jul 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/ + https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/ + <h1 id="bootc-ecosystem-at-devconf-cz-and-flock-to-fedora-2026">bootc ecosystem at DevConf.CZ and Flock to Fedora 2026</h1> +<p>June was a busy month for the bootc community, with back-to-back +conferences in the Czech Republic: <a class="external" rel="noopener noreferrer external" target="_blank" href="https://fedoraproject.org/flock/2026/">Flock to +Fedora</a> (June 14-16, Prague) +and <a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.devconf.info/cz/">DevConf.CZ</a> (June 18-19, Brno). +Both featured a strong presence of talks covering bootc, image-mode +systems, and the broader ecosystem. Here's a roundup of the +recordings and resources.</p> +<h2 id="devconf-cz-2026">DevConf.CZ 2026</h2> +<p>The <a class="external" rel="noopener noreferrer external" target="_blank" href="https://pretalx.devconf.info/devconf-cz-2026/schedule/">full DevConf.CZ 2026 schedule</a> +(including slides) is available on pretalx. Individual talk recordings +are on the <a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/channel/UCmYAQDZIQGm_kPvemBc_qwg">DevConf YouTube channel</a>.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/watch?v=voB5oUDQ3FE"><strong>Hardening OS Distribution: Verifiable and sealed OS with bootc and composefs</strong></a> +(Colin Walters, 35 min) — Covers the shift toward OCI-native OS +delivery using bootc and composefs, including a demo of deploying a +sealed UKI composefs-backed system on RHEL 10.2. Related to the +<a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">sealed images blog series</a> +here on bootc.dev.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/watch?v=zfXQViQpS3s"><strong>These bootc are made for mailin'</strong></a> +(Michael Scherer, 36 min) — A practical walkthrough of combining bootc +and Fedora Image Mode with the Stalwart mail server for a low-maintenance, +self-hosted email stack running on the cheapest possible VM.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/watch?v=0eNZOVVTkEI"><strong>Local package layering on bootc systems with DNF5</strong></a> +(Evan Goode, 26 min) — Explores the challenge of making <code>dnf install</code> +work on immutable bootc systems, introducing <code>dnf rebuild</code>, a new DNF5 +plugin that reconciles imperative package management with declarative +container workflows.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/watch?v=2MIor88lO8M"><strong>Foreman, Katello and bootable containers</strong></a> +(Adam Růžička, 35 min) — How Foreman and Katello enable fleet +management across both traditional package-mode and the new image-mode +approach, from image building through operational management.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/watch?v=htpPxxaHeXY"><strong>Applying CI/CD Patterns to Image Mode for RHEL</strong></a> +(Alessandro Rossi, 27 min) — Practical examples of applying CI/CD +practices to Image Mode for RHEL using Tekton, GitHub Actions, GitLab +CI, Jenkins, and Ansible Automation Platform.</p> +<h2 id="flock-to-fedora-2026">Flock to Fedora 2026</h2> +<p>Flock sessions were recorded as room-level livestreams on the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.youtube.com/@fedora">Fedora Project YouTube channel</a>. +Individual talk pages on the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://cfp.fedoraproject.org/flock-to-fedora-2026/schedule/">Flock schedule</a> +link to slides and other resources.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://cfp.fedoraproject.org/flock-to-fedora-2026/talk/M87M8M/"><strong>The Future of Fedora Atomic: Unifying on Bootc and Shared Infrastructure</strong></a> +(Hristo Marinov, BoF, 1h40) — A collaborative session discussing the +roadmap for migrating Fedora Atomic deliverables (Silverblue, CoreOS, +etc.) to a bootc-based workflow, covering architectural shifts and +build infrastructure changes.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://cfp.fedoraproject.org/flock-to-fedora-2026/talk/3PHYFQ/"><strong>Fedora bootc: Building and Operating Image-Based Systems</strong></a> +(Gursewak Mangat, 25 min; +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://fedoraproject.org/w/uploads/f/f6/BootcInFedoraSlides.pdf">slides</a>) +— A practical introduction to bootc for Fedora contributors, +demonstrating how bootc's container-native approach makes it easy to +test OS images in CI using standard container tooling (BCVK) before +deploying to production.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://cfp.fedoraproject.org/flock-to-fedora-2026/talk/GMFYQH/"><strong>From Compliance to Containers: Managing Fedora Fleets in the Atomic Era</strong></a> +(Adam Baali and Jonathan Billings, 55 min) — Bridging compliance +requirements with immutable image-based systems like Silverblue, +Kinoite, and bootc, demonstrating transparent tooling for NIST +controls.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://cfp.fedoraproject.org/flock-to-fedora-2026/talk/JLKXBS/"><strong>What's new in Fedora CoreOS in 2026?</strong></a> +(Jean-Baptiste Trystram and Joel Capitao, 25 min) — Highlights from +the past year of Fedora CoreOS development, including OCI distribution +migration, bootc integration progress, and the move to +bootc-image-builder.</p> + + + + Video: sealed bootc with transient /etc and /var + Fri, 05 Jun 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/ + https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/ + <h1 id="video-sealed-bootc-with-transient-etc-and-var">Video: sealed bootc with transient /etc and /var</h1> +<p>I recorded a short demo of the new composefs mount configuration +support that landed in <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/pull/2201">bootc#2201</a>.</p> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://youtu.be/VJYLtUOCqgA"><img src="https://img.youtube.com/vi/VJYLtUOCqgA/0.jpg" alt="Video: sealed bootc with transient /etc and /var" /></a></p> +<p>The PR adds a <code>/usr/lib/bootc/setup-root-conf.toml</code> file that image +authors can ship in their container image to control how the +composefs-backed root filesystem is mounted at boot:</p> +<ul> +<li><code>[root] transient = true</code> wraps the composefs lower in a tmpfs +overlay, so all writes to <code>/</code> are discarded on reboot.</li> +<li><code>[etc] mount = "transient"|"overlay"|"bind"|"none"</code> controls how +<code>/etc</code> is mounted from the deployment state directory.</li> +<li><code>[var] mount = "none"|"bind"</code> controls whether <code>/var</code> is +bind-mounted from persistent state. When set to <code>none</code>, <code>/var</code> is left as an +empty composefs directory, and <code>systemd.volatile=state</code> on the +kernel command line causes bootc to automatically skip the bind-mount +so systemd can place a fresh tmpfs there.</li> +</ul> +<p>This builds directly on the +<a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">sealed images series</a>: +with a transient root and <code>/etc</code>, each boot starts from a clean, +verified image with no persistent mutation to the OS layer.</p> + + + + Sealed images: deploying and verifying a sealed image + Thu, 07 May 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-may-07-sealed-images-deploying/ + https://bootc.dev/blog/2026-may-07-sealed-images-deploying/ + <h1 id="sealed-images-deploying-and-verifying-a-sealed-image">Sealed images: deploying and verifying a sealed image</h1> +<p>In the <a href="https://bootc.dev/blog/2026-may-06-sealed-images-building/">previous post</a> +we built a sealed, signed container image. Now it's time to deploy +it to a virtual machine and verify that the full security chain is +active.</p> +<h2 id="bcvk-a-tool-for-running-bootc-vms">bcvk: a tool for running bootc VMs</h2> +<p><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bcvk">bcvk</a> (bootc virtualization kit) +is a tool that makes it easy to run bootc container images as virtual +machines. Under the hood, it calls <code>bootc install to-disk</code> to create +a bootable disk image, then manages the VM lifecycle via libvirt. +For sealed images, bcvk also handles Secure Boot key enrollment into +the VM's UEFI firmware automatically using +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://gitlab.com/kraxel/virt-firmware">virt-firmware</a>.</p> +<p>bcvk is available as a package on Fedora and EPEL:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ dnf install bcvk</span></span></code></pre><h2 id="deploying-the-image">Deploying the image</h2> +<p>With the sealed image built from the previous post and keys generated +from the key management post, deploying is a single command:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ bcvk libvirt run \</span></span> +<span class="giallo-l"><span> --ssh-wait \</span></span> +<span class="giallo-l"><span> --name sealed-demo \</span></span> +<span class="giallo-l"><span> --filesystem=ext4 \</span></span> +<span class="giallo-l"><span> --secure-boot-keys target/keys \</span></span> +<span class="giallo-l"><span> localhost/sealed-host:latest</span></span></code></pre> +<p>Let's break down what's happening here:</p> +<ul> +<li><code>--filesystem=ext4</code> tells <code>bootc install</code> to use ext4 for the root +filesystem. The default root filesystem may be XFS, which does not +support fs-verity, so we explicitly select ext4 here. (fs-verity +is supported on ext4 and btrfs.)</li> +<li><code>--secure-boot-keys target/keys</code> points bcvk to the directory +containing our PK, KEK, and db certificates. bcvk uses +<code>virt-fw-vars</code> to enroll these keys into a copy of the OVMF +firmware variable store, so the VM boots with Secure Boot enabled +and configured to trust our signing key.</li> +<li><code>--ssh-wait</code> tells bcvk to wait until SSH is available before +returning, so we know the system has fully booted.</li> +</ul> +<p>If you're using the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples/tree/main/sealing">examples repository</a>, +this is wrapped up in a convenient <code>just</code> recipe:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ just bcvk-ssh</span></span></code></pre> +<p>This builds the image, boots the VM, waits for it to reach +<code>multi-user.target</code>, and opens an interactive SSH session.</p> +<h2 id="verifying-the-seal">Verifying the seal</h2> +<p>Once the system is booted and we have an SSH session, we can verify +that the full security chain is active.</p> +<h3 id="check-the-kernel-command-line">Check the kernel command line</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ cat /proc/cmdline</span></span> +<span class="giallo-l"><span>composefs=3a7f... (128-character SHA-512 hex digest) rw</span></span></code></pre> +<p>The presence of <code>composefs=&lt;digest&gt;</code> in the kernel command line +confirms that the initramfs received the composefs digest from the +signed UKI. This is the digest that was computed during the build +and embedded in the UKI's command line section.</p> +<h3 id="check-the-root-mount">Check the root mount</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ findmnt -t overlay /</span></span> +<span class="giallo-l"><span>TARGET SOURCE FSTYPE OPTIONS</span></span> +<span class="giallo-l"><span>/ overlay[/sysroot/state..] overlay ro,relatime,...,verity=require,...</span></span></code></pre> +<p>The key thing to look for is <code>verity=require</code> in the mount options. +This confirms that the kernel is enforcing fs-verity verification +on every file access through the composefs mount. Any file in the +operating system whose content doesn't match its expected fs-verity +digest will produce an I/O error when read.</p> +<h3 id="check-secure-boot-status">Check Secure Boot status</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ mokutil --sb-state</span></span> +<span class="giallo-l"><span>SecureBoot enabled</span></span></code></pre> +<p>This confirms that the firmware verified the bootloader and UKI +signatures before allowing them to execute.</p> +<h3 id="what-this-tells-us">What this tells us</h3> +<p>These three checks together confirm the full chain from the +<a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">first post</a>:</p> +<ol> +<li>Secure Boot verified the bootloader and UKI (<code>mokutil --sb-state</code>)</li> +<li>The UKI delivered the composefs digest to the initramfs +(<code>/proc/cmdline</code>)</li> +<li>The kernel is enforcing per-file verification against that digest +(<code>verity=require</code>)</li> +</ol> +<h2 id="what-happens-if-something-is-tampered-with">What happens if something is tampered with?</h2> +<p>It's worth understanding why tampering with a sealed system is +difficult in practice.</p> +<p>The operating system files are stored in a content-addressed object +store on disk. Each object has fs-verity enabled, which means the +kernel has recorded a cryptographic hash of its contents. The files +are immutable: you cannot write to an fs-verity protected file. Any +attempt to open a verity-protected file for writing will fail.</p> +<p>Even if an attacker were to bypass the filesystem and corrupt data +directly on the underlying block device, the kernel would detect +the corruption. When a process attempts to read the tampered file, +the kernel verifies the data against the stored hash before +returning it. If the data doesn't match, the read fails with +<code>EIO</code>. The corrupted data is never served to any process.</p> +<p>This is a meaningful distinction from a system where tampered files +are silently served. On a sealed system, corruption doesn't go +unnoticed -- it causes an immediate, visible failure.</p> +<h2 id="conclusion">Conclusion</h2> +<p>Over the course of this series, we've walked through the complete +lifecycle of a sealed image:</p> +<ol> +<li><a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">The security chain</a> +from firmware to filesystem that makes sealed images possible</li> +<li><a href="https://bootc.dev/blog/2026-may-05-sealed-images-key-management/">Key management</a> +for generating and enrolling Secure Boot keys</li> +<li><a href="https://bootc.dev/blog/2026-may-06-sealed-images-building/">Building a sealed image</a> +with a multi-stage container build</li> +<li>Deploying and verifying the seal (this post)</li> +</ol> +<p>The complete working example is available in the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples">rhel-bootc-examples</a> +repository under the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples/tree/main/sealing">sealing</a> +directory.</p> + + + + Sealed images: building a sealed image + Wed, 06 May 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-may-06-sealed-images-building/ + https://bootc.dev/blog/2026-may-06-sealed-images-building/ + <h1 id="sealed-images-building-a-sealed-image">Sealed images: building a sealed image</h1> +<p>In the <a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">first post</a> +we covered the security chain behind sealed images, and in the +<a href="https://bootc.dev/blog/2026-may-05-sealed-images-key-management/">second post</a> we +generated the Secure Boot keys needed to sign our boot artifacts. +Now it's time to put it all together and build a sealed image.</p> +<p>A complete working example is available in the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples">rhel-bootc-examples</a> +repository under the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples/tree/main/sealing">sealing</a> +directory. This post walks through the key concepts behind that +example and explains why the build is structured the way it is.</p> +<h2 id="the-chicken-and-egg-problem">The chicken-and-egg problem</h2> +<p>Building a sealed image has a complication that isn't immediately +obvious. Recall from the first post that the composefs digest is +embedded in the UKI's kernel command line, and the UKI lives in the +image under <code>/boot</code>. So we have a dependency cycle: we need the +filesystem to compute the composefs digest, but we need the digest +to produce the UKI, and we need the UKI to finalize the filesystem.</p> +<p>The solution is a multi-stage container build. We build the base +filesystem first, without any UKI. Then in a separate stage, we +compute the composefs digest from that filesystem, generate and +sign the UKI, and finally layer the UKI back on top of the base. +The UKI lives under <code>/boot</code>, which is not part of the composefs- +managed root filesystem, so adding it doesn't change the digest.</p> +<h2 id="the-containerfile">The Containerfile</h2> +<p>The +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples/blob/main/sealing/Containerfile">Containerfile</a> +in the examples repository uses four stages. Let's walk through +each one.</p> +<h3 id="stage-1-rootfs-builder">Stage 1: rootfs-builder</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="docker"><span class="giallo-l"><span style="color: #D73A49;">FROM</span><span> quay.io/centos-bootc/centos-bootc:stream10 </span><span style="color: #D73A49;">AS</span><span> rootfs-builder</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span style="color: #D73A49;">RUN</span><span> dnf install -y \</span></span> +<span class="giallo-l"><span> epel-release \</span></span> +<span class="giallo-l"><span> systemd-boot-unsigned \</span></span> +<span class="giallo-l"><span> systemd-ukify \</span></span> +<span class="giallo-l"><span> sbsigntools</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span style="color: #D73A49;">RUN</span><span> dnf remove -y bootupd</span></span></code></pre> +<p>This starts from a CentOS Stream 10 bootc base image and installs +the tooling we need: <code>systemd-ukify</code> to build the UKI, +<code>sbsigntools</code> to sign it, and <code>systemd-boot-unsigned</code> to provide +the bootloader binary. We remove <code>bootupd</code> because this example +uses systemd-boot rather than bootupd + GRUB.</p> +<p>This stage also signs systemd-boot with our db key:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="docker"><span class="giallo-l"><span style="color: #D73A49;">RUN</span><span> --mount=type=secret,id=secureboot_key \</span></span> +<span class="giallo-l"><span> --mount=type=secret,id=secureboot_cert &lt;&lt;EOF</span></span> +<span class="giallo-l"><span>sbsign --key /run/secrets/secureboot_key \</span></span> +<span class="giallo-l"><span> --cert /run/secrets/secureboot_cert \</span></span> +<span class="giallo-l"><span> --output /tmp/systemd-bootx64.efi \</span></span> +<span class="giallo-l"><span> /usr/lib/systemd/boot/efi/systemd-bootx64.efi</span></span> +<span class="giallo-l"><span>install -m 0644 /tmp/systemd-bootx64.efi \</span></span> +<span class="giallo-l"><span> /usr/lib/systemd/boot/efi/systemd-bootx64.efi</span></span> +<span class="giallo-l"><span>EOF</span></span></code></pre> +<p>Note the use of <code>--mount=type=secret</code>. The private key is mounted +into the build step but is never copied into any image layer. This +is how we keep key material out of the final image.</p> +<h3 id="stage-2-flatten-to-a-single-layer">Stage 2: flatten to a single layer</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="docker"><span class="giallo-l"><span style="color: #D73A49;">FROM</span><span> scratch </span><span style="color: #D73A49;">AS</span><span> base</span></span> +<span class="giallo-l"><span style="color: #D73A49;">COPY</span><span> --from=rootfs-builder / /</span></span> +<span class="giallo-l"><span style="color: #D73A49;">LABEL</span><span> containers.bootc 1</span></span> +<span class="giallo-l"><span style="color: #D73A49;">LABEL</span><span> ostree.bootable 1</span></span></code></pre> +<p>This stage copies the entire filesystem from stage 1 into a <code>FROM scratch</code> image, which flattens everything into a single layer. +This is important because the composefs digest is computed over +the complete filesystem tree. If the image had multiple layers, +the digest would depend on how those layers happened to be stacked, +which could vary depending on the container runtime and storage +driver. (For more on why multi-layer images can produce +non-deterministic results, see the earlier post on +<a href="https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/">pitfalls of incomplete tar archives</a>.) +Flattening eliminates that variable.</p> +<h3 id="stage-3-generate-and-sign-the-uki">Stage 3: generate and sign the UKI</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="docker"><span class="giallo-l"><span style="color: #D73A49;">FROM</span><span> base </span><span style="color: #D73A49;">AS</span><span> kernel</span></span> +<span class="giallo-l"><span style="color: #D73A49;">RUN</span><span> --mount=type=bind,from=base,target=/target \</span></span> +<span class="giallo-l"><span> --mount=type=secret,id=secureboot_key \</span></span> +<span class="giallo-l"><span> --mount=type=secret,id=secureboot_cert &lt;&lt;EOF</span></span> +<span class="giallo-l"><span>bootc container ukify --rootfs /target \</span></span> +<span class="giallo-l"><span> -- \</span></span> +<span class="giallo-l"><span> --signtool sbsign \</span></span> +<span class="giallo-l"><span> --secureboot-private-key /run/secrets/secureboot_key \</span></span> +<span class="giallo-l"><span> --secureboot-certificate /run/secrets/secureboot_cert \</span></span> +<span class="giallo-l"><span> --output /out/uki.efi</span></span> +<span class="giallo-l"><span>EOF</span></span> +<span class="giallo-l"><span style="color: #D73A49;">RUN</span><span> kver=$(bootc container inspect --json | jq -r </span><span style="color: #032F62;">&#39;.kernel.version&#39;</span><span>) &amp;&amp; \</span></span> +<span class="giallo-l"><span> mkdir -p /boot/EFI/Linux &amp;&amp; \</span></span> +<span class="giallo-l"><span> mv /out/uki.efi </span><span style="color: #032F62;">&quot;/boot/EFI/Linux/${kver}.efi&quot;</span></span></code></pre> +<p>This is where the magic happens. <code>bootc container ukify</code> does +several things in one step:</p> +<ol> +<li>Reads the filesystem at <code>/target</code> (the flattened base from +stage 2, mounted via <code>--mount=type=bind</code>).</li> +<li>Computes the composefs digest (a SHA-512 hash of the EROFS +image that describes the complete filesystem).</li> +<li>Discovers the kernel and initramfs from the filesystem.</li> +<li>Assembles a UKI containing the kernel, initramfs, and a +command line that includes <code>composefs=&lt;digest&gt;</code>.</li> +<li>Signs the UKI with the db key via <code>sbsign</code>.</li> +</ol> +<p>The result is a single <code>.efi</code> file that embeds a cryptographic +commitment to the exact filesystem it was built from, signed by +a key we control.</p> +<p>A second <code>RUN</code> step then discovers the kernel version and places +the UKI at the expected path under <code>/boot/EFI/Linux/</code>.</p> +<h3 id="stage-4-the-final-image">Stage 4: the final image</h3> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="docker"><span class="giallo-l"><span style="color: #D73A49;">FROM</span><span> base</span></span> +<span class="giallo-l"><span style="color: #D73A49;">COPY</span><span> --from=kernel /boot /boot</span></span></code></pre> +<p>The final image takes the flattened base and overlays the <code>/boot</code> +directory from the kernel stage. This gives us a complete image: +the sealed root filesystem plus the signed UKI that references it.</p> +<h2 id="building-the-image">Building the image</h2> +<p>With the Containerfile and keys in place, building the image is a +single <code>podman build</code> command:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ podman build \</span></span> +<span class="giallo-l"><span> --secret id=secureboot_key,src=target/keys/sb-db.key \</span></span> +<span class="giallo-l"><span> --secret id=secureboot_cert,src=target/keys/sb-db.crt \</span></span> +<span class="giallo-l"><span> -t localhost/sealed-host:latest \</span></span> +<span class="giallo-l"><span> .</span></span></code></pre> +<p>The two <code>--secret</code> flags make the db private key and certificate +available to the build stages that need them, without ever +persisting them in the image.</p> +<p>If you're using the examples repository, the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/redhat-cop/rhel-bootc-examples/blob/main/sealing/Justfile">Justfile</a> +wraps this for convenience:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ just keygen # generate keys (one-time)</span></span> +<span class="giallo-l"><span>$ just build # build the sealed image</span></span></code></pre><h2 id="secret-handling-in-ci">Secret handling in CI</h2> +<p>The examples repository includes a GitHub Actions workflow +that demonstrates how to handle key material in CI. The db private +key is stored as a GitHub Actions secret and written to a temporary +file during the build.</p> +<p>For pull request builds, where the secret is not available, the +workflow generates an ephemeral key pair on the fly. This allows +PRs to validate that the build works without requiring access to +production key material.</p> +<h2 id="what-s-next">What's next</h2> +<p>At this point we have a sealed, signed container image. The UKI +inside is signed with our Secure Boot key and embeds a composefs +digest that covers every file in the operating system. In the +next post, we'll deploy this image to a system and verify the +seal is active.</p> + + + + Sealed images: key management for Secure Boot + Tue, 05 May 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-may-05-sealed-images-key-management/ + https://bootc.dev/blog/2026-may-05-sealed-images-key-management/ + <h1 id="sealed-images-key-management-for-secure-boot">Sealed images: key management for Secure Boot</h1> +<p>In the <a href="https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/">previous post</a>, +we walked through the security chain that sealed images provide, from +firmware through runtime file verification. That chain depends on +cryptographic keys at every step. In this post, we'll cover the keys +involved, how to generate them, and how they get enrolled into your +system's firmware.</p> +<h2 id="the-uefi-secure-boot-key-hierarchy">The UEFI Secure Boot key hierarchy</h2> +<p>UEFI Secure Boot uses a hierarchy of three key types, each serving a +distinct role:</p> +<p><strong>Platform Key (PK)</strong> -- The root of the Secure Boot trust hierarchy. +There is exactly one PK. The PK controls who can modify the Secure +Boot key databases. It is used to sign updates to the KEK database. +When the PK is enrolled, the firmware transitions from Setup Mode to +User Mode, enabling Secure Boot enforcement.</p> +<p><strong>Key Exchange Key (KEK)</strong> -- One or more KEKs can be enrolled. A KEK +is authorized to sign updates to the signature database (db). The +KEK exists to allow delegation: the PK owner can authorize other +parties to manage the set of trusted signing keys without giving them +full control over the Secure Boot configuration.</p> +<p><strong>Signature Database (db)</strong> -- The db contains the keys or hashes +that the firmware uses to verify boot binaries. When the firmware +loads a bootloader or UKI, it checks the binary's signature against +the keys in the db. If the signature matches a db entry, the binary +is allowed to execute.</p> +<p>In practice, many organizations will only need to generate a single +set of these keys. The db key is the one that does the day-to-day +work: it signs your UKIs and bootloader. The PK and KEK exist +primarily to control who can modify the db.</p> +<p>If you already have Secure Boot keys provisioned in your +infrastructure, you don't need to generate new ones. You only need +access to a db key (or the ability to add your signing key to the +existing db) in order to sign your UKIs. The rest of this post +assumes you're starting from scratch, but the signing steps apply +regardless of where your keys came from.</p> +<h2 id="generating-keys">Generating keys</h2> +<p>The following commands generate a complete set of Secure Boot keys. +These examples use <code>openssl</code> directly, but you should use whatever +key management practices are appropriate for your organization. +Hardware security modules (HSMs), vault systems, or other key +management infrastructure may be more appropriate for production +use.</p> +<p>First, generate a GUID to identify the key owner. This is embedded +in the key enrollment data and can be any unique identifier:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ uuidgen --random &gt; GUID.txt</span></span></code></pre> +<p>Generate the Platform Key:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ openssl req -newkey rsa:2048 -nodes -keyout PK.key \</span></span> +<span class="giallo-l"><span> -new -x509 -sha256 -days 3650 \</span></span> +<span class="giallo-l"><span> -subj &#39;/CN=My Platform Key/&#39; -out PK.crt</span></span> +<span class="giallo-l"><span>$ openssl x509 -outform DER -in PK.crt -out PK.cer</span></span></code></pre> +<p>Generate the Key Exchange Key:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ openssl req -newkey rsa:2048 -nodes -keyout KEK.key \</span></span> +<span class="giallo-l"><span> -new -x509 -sha256 -days 3650 \</span></span> +<span class="giallo-l"><span> -subj &#39;/CN=My Key Exchange Key/&#39; -out KEK.crt</span></span> +<span class="giallo-l"><span>$ openssl x509 -outform DER -in KEK.crt -out KEK.cer</span></span></code></pre> +<p>Generate the Signature Database key:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ openssl req -newkey rsa:2048 -nodes -keyout db.key \</span></span> +<span class="giallo-l"><span> -new -x509 -sha256 -days 3650 \</span></span> +<span class="giallo-l"><span> -subj &#39;/CN=My Signature Database Key/&#39; -out db.crt</span></span> +<span class="giallo-l"><span>$ openssl x509 -outform DER -in db.crt -out db.cer</span></span></code></pre> +<p>Each command produces three files: a private key (<code>.key</code>), a PEM +certificate (<code>.crt</code>), and a DER-encoded certificate (<code>.cer</code>). The +private keys are what you need to protect. The certificates are +public and are what gets enrolled into the firmware.</p> +<h2 id="signing-boot-artifacts">Signing boot artifacts</h2> +<p>With a db key in hand, you can sign the two boot binaries that need +Secure Boot verification: the bootloader (systemd-boot) and the +Unified Kernel Image.</p> +<p>Signing systemd-boot:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ sbsign --key db.key --cert db.crt \</span></span> +<span class="giallo-l"><span> --output systemd-bootx64.efi.signed \</span></span> +<span class="giallo-l"><span> /usr/lib/systemd/boot/efi/systemd-bootx64.efi</span></span></code></pre> +<p>The UKI signing process is more involved because the UKI embeds the +composefs digest, which must be computed from the filesystem first. +We'll cover building sealed images (including UKI generation and +signing) in detail in the next post. For now, the important thing +to know is that <code>ukify</code> (the tool that assembles UKIs) accepts the +same <code>--secureboot-private-key</code> and <code>--secureboot-certificate</code> +options and uses <code>sbsign</code> under the hood to sign the final EFI +binary.</p> +<h2 id="enrolling-keys-into-firmware">Enrolling keys into firmware</h2> +<p>The keys need to be enrolled into the UEFI firmware's Secure Boot +database before the firmware will use them for verification. There +are several ways to do this depending on your environment.</p> +<h3 id="manual-enrollment-via-firmware-setup">Manual enrollment via firmware setup</h3> +<p>Most UEFI firmware implementations provide a setup menu (accessed +during early boot, typically via a key like F2 or Del) where Secure +Boot keys can be managed. The DER-encoded certificates (<code>.cer</code> +files) can be enrolled from a USB drive or the EFI System Partition. +This is straightforward for individual systems but does not scale +well.</p> +<h3 id="programmatic-enrollment-for-virtual-machines">Programmatic enrollment for virtual machines</h3> +<p>For virtual machines using OVMF (the open source UEFI firmware for +QEMU/KVM), keys can be enrolled directly into the firmware variable +store using the <code>virt-fw-vars</code> tool from the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://gitlab.com/kraxel/virt-firmware">virt-firmware</a> project:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ GUID=$(cat GUID.txt)</span></span> +<span class="giallo-l"><span>$ virt-fw-vars \</span></span> +<span class="giallo-l"><span> --input /usr/share/edk2/ovmf/OVMF_VARS.fd \</span></span> +<span class="giallo-l"><span> --secure-boot \</span></span> +<span class="giallo-l"><span> --set-pk $GUID PK.crt \</span></span> +<span class="giallo-l"><span> --add-kek $GUID KEK.crt \</span></span> +<span class="giallo-l"><span> --add-db $GUID db.crt \</span></span> +<span class="giallo-l"><span> -o OVMF_VARS_ENROLLED.fd</span></span></code></pre> +<p>This produces a firmware variable store with your keys pre-enrolled. +When QEMU starts with this variable store, Secure Boot is active and +will only accept binaries signed with your db key. This is +particularly useful for testing and for VM-based deployments where +you control the firmware image.</p> +<h3 id="auto-enrollment-via-systemd-boot">Auto-enrollment via systemd-boot</h3> +<p>systemd-boot supports automatic key enrollment when the firmware is +in Setup Mode (no Platform Key enrolled). This works by placing +signed UEFI authenticated variable files (<code>.auth</code> files) on the EFI +System Partition.</p> +<p>Creating <code>.auth</code> files requires converting your certificates into +UEFI signature lists and signing them with the appropriate parent +key:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>$ GUID=$(cat GUID.txt)</span></span> +<span class="giallo-l"><span>$ attr=NON_VOLATILE,RUNTIME_ACCESS,BOOTSERVICE_ACCESS,TIME_BASED_AUTHENTICATED_WRITE_ACCESS</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span># Create EFI signature lists</span></span> +<span class="giallo-l"><span>$ sbsiglist --owner $GUID --type x509 --output PK.esl PK.cer</span></span> +<span class="giallo-l"><span>$ sbsiglist --owner $GUID --type x509 --output KEK.esl KEK.cer</span></span> +<span class="giallo-l"><span>$ sbsiglist --owner $GUID --type x509 --output db.esl db.cer</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span># Sign the variables (PK and KEK signed by PK, db signed by KEK)</span></span> +<span class="giallo-l"><span>$ sbvarsign --attr $attr --key PK.key --cert PK.crt --output PK.auth PK PK.esl</span></span> +<span class="giallo-l"><span>$ sbvarsign --attr $attr --key PK.key --cert PK.crt --output KEK.auth KEK KEK.esl</span></span> +<span class="giallo-l"><span>$ sbvarsign --attr $attr --key KEK.key --cert KEK.crt --output db.auth db db.esl</span></span></code></pre> +<p>These <code>.auth</code> files can then be placed on the ESP where systemd-boot +expects them. bootc can automate this: if you place the <code>.auth</code> +files in your container image at +<code>/usr/lib/bootc/install/secureboot-keys/&lt;name&gt;/</code>, bootc will copy +them to the ESP during installation. On the next boot, systemd-boot +can enroll them into the firmware.</p> +<p>The enrollment behavior is controlled by the <code>secure-boot-enroll</code> +setting in <code>loader.conf</code>. See the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://www.freedesktop.org/software/systemd/man/latest/loader.conf.html">systemd-boot documentation</a> +for details on the available modes.</p> +<h2 id="key-security-considerations">Key security considerations</h2> +<p>A few things worth keeping in mind:</p> +<p><strong>Protect your private keys.</strong> The <code>.key</code> files are what allow +signing boot artifacts. Anyone with access to your db private key +can sign binaries that your firmware will trust. Store private keys +with appropriate access controls, and consider using an HSM or key +management system for production deployments.</p> +<p><strong>Key rotation.</strong> The examples above use 10-year expiry (<code>-days 3650</code>), which is generous. Plan for key rotation before your +certificates expire. The UEFI key hierarchy makes this manageable: +you can use your KEK to authorize a new db key without needing to +re-enroll the PK.</p> +<p><strong>Separation of concerns.</strong> In a CI/CD pipeline, the signing step +should ideally be isolated from the build step. The build process +produces an unsigned UKI, and a separate signing service (with access +to the private key) signs it. This limits the blast radius if the +build environment is compromised.</p> +<h2 id="what-s-next">What's next</h2> +<p>With keys generated and an understanding of how they fit into the +trust chain, the next post will walk through building a sealed image +end-to-end: writing a Containerfile, computing the composefs digest, +generating and signing the UKI, and producing a deployable container +image.</p> + + + + Sealed images: the security chain from firmware to filesystem + Mon, 04 May 2026 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/ + https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/ + <h1 id="sealed-images-the-security-chain-from-firmware-to-filesystem">Sealed images: the security chain from firmware to filesystem</h1> +<p>This is the first in a series of posts about bootc sealed images. In +this post we'll take a tour through the full security chain that makes +sealed images work, from the moment your system powers on through +every file read at runtime. Future posts will cover key management, +building sealed images, and deploying them to various environments.</p> +<h2 id="the-gap">The gap</h2> +<p>Typically a default Linux install comes "unlocked", allowing you to be +root and make persistent changes. While many distributions support +Secure Boot, it's typically only the kernel that's signed. The +cryptographic chain of trust from firmware doesn't cover the root +filesystem or applications - i.e. effectively everything you care +about.</p> +<p>Sealed images help close this gap by extending cryptographic +verification from the firmware all the way through every file in the +operating system. Not as a one-time check at boot, but continuously, +at every file read, for the entire lifetime of the system.</p> +<p>Let's walk through how each piece fits together.</p> +<h2 id="secure-boot">Secure Boot</h2> +<p>Secure Boot is the foundation of the chain. It's a UEFI firmware +feature that ensures only signed code runs during the boot process.</p> +<p>The firmware maintains a database of trusted keys. When the system +powers on, the firmware loads the bootloader and checks its signature +against those keys. If the signature is valid, the bootloader runs. +If not, the system refuses to boot.</p> +<p>This is well-established technology and not new to sealed images. +What matters for our purposes is that Secure Boot gives us a root of +trust: a guarantee that the first piece of software to execute after +the firmware is something we explicitly chose to trust.</p> +<h2 id="unified-kernel-images">Unified Kernel Images</h2> +<p>Traditionally, the boot chain after Secure Boot looks something like +this: the signed bootloader loads a kernel, an initramfs, and a kernel +command line, often from separate files on a boot partition. The +bootloader may verify the kernel's signature, but the initramfs and +command line are typically not covered by any signature.</p> +<p>A <a class="external" rel="noopener noreferrer external" target="_blank" href="https://uapi-group.org/specifications/specs/unified_kernel_image/">Unified Kernel Image (UKI)</a> +changes this by bundling the kernel, the initramfs, and the kernel +command line into a single EFI binary. The entire bundle is signed +as one unit. This means the firmware (or a signed bootloader like +systemd-boot) can verify the whole thing in one step.</p> +<p>This is important for sealed images because the kernel command line +is no longer an unverified input. Anything embedded in the command +line is covered by the same signature that covers the kernel itself. +As we'll see next, this is where the composefs digest lives.</p> +<h2 id="composefs-erofs-overlayfs-fs-verity">composefs: EROFS + overlayfs + fs-verity</h2> +<p>Here's where things get interesting. composefs brings together +three kernel technologies to provide cryptographic verification of +the entire filesystem.</p> +<p>When a sealed image is built, the operating system filesystem is +processed into an +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/erofs.html">EROFS</a> metadata +image. This image describes every file, directory, symlink, and +permission in the tree, but it does not contain the actual file +contents. Instead, each file entry in the EROFS image records the +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/fsverity.html">fs-verity</a> +digest of that file's contents. The actual file data is stored +separately in a content-addressed object store, where each file has +fs-verity enabled by the kernel.</p> +<p>At mount time, the kernel stitches these pieces together using +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/overlayfs.html">overlayfs</a>. +The EROFS image serves as a metadata layer, and the object store +provides the file data. The overlayfs <code>verity=require</code> mount option +tells the kernel to enforce that every file served through the mount +has an fs-verity digest matching what the EROFS metadata expects.</p> +<p>fs-verity itself is a kernel feature that provides per-file integrity +verification. When fs-verity is enabled on a file, the kernel +computes a cryptographic hash of the file's contents and stores a +hash tree alongside the file on disk. From that point on, every +read is verified at the block level -- the kernel checks only the +blocks being read, not the entire file, and caches the results so +repeated reads don't pay the cost again.</p> +<p>A key behavior to understand is what happens when verification +fails: the kernel returns an I/O error. The corrupted or tampered +data is never served to any process. The <code>open()</code> call on the file +succeeds (the file exists, after all), but <code>read()</code> on the corrupted +portion returns <code>EIO</code>. The data is simply unreadable.</p> +<p>The EROFS metadata image itself also has an fs-verity digest: a +single cryptographic hash that covers the complete filesystem +description. This is the composefs digest. It is embedded in the +UKI's kernel command line:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>composefs=abc123def456... (128-character SHA-512 hex digest)</span></span></code></pre> +<p>Because the UKI is signed, this digest is now part of the verified +boot chain. The firmware verifies the UKI signature, and the UKI +carries within it a cryptographic commitment to the exact filesystem +that should be mounted as the operating system.</p> +<h2 id="putting-it-all-together">Putting it all together</h2> +<p>The full chain looks like this. Each step must succeed before the +next can proceed:</p> +<ol> +<li>The firmware verifies the signed bootloader.</li> +<li>The bootloader verifies the signed Unified Kernel Image (UKI).</li> +<li>The initramfs (inside the verified UKI) reads the composefs +digest from the kernel command line (also inside the verified UKI).</li> +<li>The initramfs mounts the composefs image and verifies the EROFS +image's fs-verity digest matches the digest from the command line.</li> +<li>Every subsequent file read from the operating system is +individually verified by the kernel against the fs-verity digest +recorded in the EROFS metadata.</li> +</ol> +<p>There is no point after firmware where unverified code executes or +unverified data is served. The chain is continuous.</p> +<h2 id="what-sealed-images-cover">What sealed images cover</h2> +<p>It's worth being precise about scope. The seal covers every file in +the immutable operating system image: the base OS, any packages you +added, your monitoring agents, security tools, application binaries. +Everything that was part of the image when it was built is sealed.</p> +<p>By default, <code>/etc</code> and <code>/var</code> are mutable and persistent. It is +possible to make <code>/etc</code> transient today, and this is a good idea if +it matches your use case. More suggestions on this will be in the +documentation.</p> +<h2 id="what-s-next">What's next</h2> +<p>This post covered the architecture. In the next posts, we'll get +hands-on:</p> +<ul> +<li><strong>Key management</strong>: generating Secure Boot keys, enrolling them, +and understanding the signing chain</li> +<li><strong>Building sealed images</strong>: writing a Containerfile, producing a +signed UKI, and verifying the result</li> +<li><strong>Deploying sealed images</strong>: installing to bare metal, virtual +machines, and cloud environments</li> +</ul> +<p>The signing chain is fully under your control. You generate the keys, +you sign the images, you decide what your systems trust. The next +post will show you how.</p> + + + + Containers: pitfalls of incomplete tar archives + Mon, 15 Dec 2025 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/ + https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/ + <h1 id="containers-pitfalls-of-incomplete-tar-archives">Containers: pitfalls of incomplete tar archives</h1> +<p>As <a class="external" rel="noopener noreferrer external" target="_blank" href="https://blog.verbum.org/">Colin Walters</a> likes to say, containers +are just tarballs wrapped in JSON. We'll mostly ignore the JSON part +here, but there's a lot to unpack (pun and foreshadowing intended) +with regards to tar and how it interacts with the various pieces that +work in conjunction to make containers a reality.</p> +<h2 id="a-refresher-on-tar">A refresher on <code>tar</code></h2> +<p>Let's explore a key quirk of tar from which everything else we'll +discuss follows.</p> +<p>First, let's create a basic tar archive, which contains a directory +with a file inside of the directory:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ mkdir foo</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ touch foo/bar</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ tar cf foo.tar foo/</span></span></code></pre> +<p>Now let's list the contents of the tar archive:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ tar tvf foo.tar</span></span> +<span class="giallo-l"><span>drwxr-xr-x jeckersb/jeckersb 0 2025-12-10 11:09 foo/</span></span> +<span class="giallo-l"><span>-rw-r--r-- jeckersb/jeckersb 0 2025-12-10 11:09 foo/bar</span></span></code></pre> +<p>Ok, that makes sense. We see the directory and the file we added to +the archive.</p> +<p>But here's the key bit: What happens if you add <em>only</em> the file to the archive?</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ tar cf incomplete.tar foo/bar</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ tar tvf incomplete.tar</span></span> +<span class="giallo-l"><span>-rw-r--r-- jeckersb/jeckersb 0 2025-12-10 11:09 foo/bar</span></span></code></pre> +<p>Now the archive has metadata <em>only</em> for the file. You can deduce from +the path <code>foo/bar</code> that there is a directory <code>foo</code> involved, but you +can't definitively know how <code>foo</code> is supposed to look. What are the +permissions, owner, group, mtime? We don't know. So what happens if +you extract this tar archive?</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ mkdir incomplete-unpacked &amp;&amp; tar xf incomplete.tar -C incomplete-unpacked</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked/</span></span> +<span class="giallo-l"><span>total 0</span></span> +<span class="giallo-l"><span>drwxr-xr-x. 2 jeckersb jeckersb 60 Dec 10 11:19 foo</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked/foo/</span></span> +<span class="giallo-l"><span>total 0</span></span> +<span class="giallo-l"><span>-rw-r--r--. 1 jeckersb jeckersb 0 Dec 10 11:09 bar</span></span></code></pre> +<p>It implicitly creates the directory <code>foo</code> in order to put <code>bar</code> at the +correct path. This makes sense. But notice <code>foo</code> gets created with +metadata that is dependent on the environment in which the unpacking +of the archive happened. In the above example, you can see that the +timestamp on the directory is 10 minutes later than the timestamp of +the <code>bar</code> file inside. This is because it took me 10 minutes of +writing and editing this post before I did the unpack operation. I +can set my umask to something else and extract it a second time, and +now we'll see a different timestamp <em>and</em> different permissions:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ umask 0077</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ mkdir incomplete-unpacked-with-umask &amp;&amp; tar xf incomplete.tar -C incomplete-unpacked-with-umask</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked-with-umask/</span></span> +<span class="giallo-l"><span>total 0</span></span> +<span class="giallo-l"><span>drwx------. 2 jeckersb jeckersb 60 Dec 10 11:25 foo</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx tmp]$ ls -l incomplete-unpacked-with-umask/foo/</span></span> +<span class="giallo-l"><span>total 0</span></span> +<span class="giallo-l"><span>-rw-------. 1 jeckersb jeckersb 0 Dec 10 11:09 bar</span></span></code></pre><h2 id="oci-image-spec">OCI image spec</h2> +<p>OCI container images are serialized as a <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/opencontainers/image-spec/blob/main/layer.md">series of +tarballs</a> +that are applied on top of each other to create the complete +filesystem. We'll get back to the specifics of that operation a bit +later.</p> +<p>The entire layer specification is worth reading, but we'll focus on +two parts. First, how to determine changes:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>When two directories are compared, the relative root is the top-level directory.</span></span> +<span class="giallo-l"><span>The directories are compared, looking for files that have been [added, modified, or removed](#change-types).</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>For this example, `rootfs-c9d-v1/` and `rootfs-c9d-v1.s1/` are recursively compared, each as relative root path.</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>The following changeset is found:</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>Added: /etc/my-app.d/</span></span> +<span class="giallo-l"><span>Added: /etc/my-app.d/default.cfg</span></span> +<span class="giallo-l"><span>Modified: /bin/my-app-tools</span></span> +<span class="giallo-l"><span>Deleted: /etc/my-app-config</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>This reflects the removal of `/etc/my-app-config` and creation of a file and directory at `/etc/my-app.d/default.cfg`.</span></span> +<span class="giallo-l"><span>`/bin/my-app-tools` has also been replaced with an updated version.</span></span></code></pre> +<p>And then the following section on representing changes:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>A [tar archive][tar-archive] is then created which contains _only_ this changeset:</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>- Added and modified files and directories in their entirety</span></span> +<span class="giallo-l"><span>- Deleted files or directories marked with a [whiteout file](#whiteouts)</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>The resulting tar archive for `rootfs-c9d-v1.s1` has the following entries:</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>./etc/my-app.d/</span></span> +<span class="giallo-l"><span>./etc/my-app.d/default.cfg</span></span> +<span class="giallo-l"><span>./bin/my-app-tools</span></span> +<span class="giallo-l"><span>./etc/.wh.my-app-config</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>To signify that the resource `./etc/my-app-config` MUST be removed when the changeset is applied, the basename of the entry is prefixed with `.wh.`.</span></span></code></pre> +<p>But note that the changeset says nothing about the directories higher +in the filesystem. So in the above example, it would be perfectly +valid (and more correct) to generate changeset tar archives which are +incomplete in the same manner we described above. Most notably, these +changesets would <em>not</em> contain tar entries for the directories <code>/etc</code> +and <code>/bin</code>.</p> +<p>This oversight in the specification is not new or surprising. There +is an <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/opencontainers/image-spec/issues/737">open issue from +2017</a> which +describes exactly this problem. There is a linked <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/opencontainers/image-spec/pull/970">pull +request</a> which +has been open since late 2022 with intermittent discussion, but no +consensus or resolution has been reached yet.</p> +<p>This has led to some projects implementing their own workarounds to +deal with this behavior. The <code>containerd</code> project as an example +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/containerd/containerd/issues/1723">noted this +issue</a> in 2017 +and <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/containerd/containerd/pull/1925">worked around +it</a> by creating +explicit archive directory entries for parents.</p> +<h2 id="rechunking-in-bootc-rpm-ostree">Rechunking in bootc / rpm-ostree</h2> +<p>Base images used via <code>bootc</code> are typically post-processed and +finalized via the <a class="external" rel="noopener noreferrer external" target="_blank" href="https://coreos.github.io/rpm-ostree/build-chunked-oci/">rpm-ostree +rechunker</a>. +The general idea (oversimplifying a bit for brevity) is that the tool +can inspect the RPM database and map each file in the container to its +associated RPM. It then "rechunks" the container by creating a new +layer for each RPM, where the layer contains the files for that RPM +and only that RPM. This ensures that when a new version of an RPM is +released in the future, when it is integrated into a new base image, +only the layer associated with that RPM will need to be re-downloaded +by the end user.</p> +<p>However, consider a directory like <code>/usr</code>. This is owned by the +<code>filesystem</code> package which contains all of the shared base directories +in the system. This directory will be included in the layer +associated with the <code>filesystem</code> package with all of its related +metadata.</p> +<p>Now, almost every other package in the system is going to have some +amount of content that is shipped under the <code>/usr</code> hierarchy. +Originally, the <code>rpm-ostree</code> rechunker would omit the archive entry +for <code>/usr</code> in each package layer.</p> +<p>This however would cause the behavior of indeterminate tar archives +discussed above to be manifest in the final container. For example, +it was noted in <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/containers/composefs-rs/issues/132">this composefs-rs +issue</a>.</p> +<p>We worked around this issue by <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/coreos/rpm-ostree/pull/5421">creating a new +format-version</a> for +the <code>rpm-ostree</code> rechunker, which creates all of the parent +directories in each tar layer. This is similar to the fix implemented +as noted above by the <code>containerd</code> project. This works, but it's not +ideal. It means that all of the parent directories and their +respective metadata have to be duplicated across every layer in the +image. This is an unnecessary waste of disk space and bandwidth.</p> +<h2 id="why-isn-t-this-a-more-widespread-problem">Why isn't this a more widespread problem?</h2> +<p>When I first realized what was going on here, I thought I could +trigger this behavior with a <code>Containerfile</code> like this:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>FROM quay.io/fedora/fedora:43</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>RUN &lt;&lt;EORUN</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span># Create two levels of directories, because adding a file to a</span></span> +<span class="giallo-l"><span># directory alters the directory mtime. This means adding a file</span></span> +<span class="giallo-l"><span># under /foo/bar in the next layer will cause the mtime for /foo/bar</span></span> +<span class="giallo-l"><span># to change, but /foo will remain unchanged.</span></span> +<span class="giallo-l"><span>mkdir -p /foo/bar</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span># zero the mtime on foo</span></span> +<span class="giallo-l"><span>touch -d @0 /foo</span></span> +<span class="giallo-l"><span>EORUN</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span># Add a file in a derived layer</span></span> +<span class="giallo-l"><span>#</span></span> +<span class="giallo-l"><span># In theory, this layer would not contain an entry for /foo, since it</span></span> +<span class="giallo-l"><span># is unchanged.</span></span> +<span class="giallo-l"><span>#</span></span> +<span class="giallo-l"><span># In practice... not so much.</span></span> +<span class="giallo-l"><span>RUN touch /foo/bar/baz</span></span></code></pre> +<p>But alas:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx example]$ podman build -f Containerfile -t localhost/example</span></span> +<span class="giallo-l"><span>STEP 1/3: FROM quay.io/fedora/fedora:43</span></span> +<span class="giallo-l"><span>STEP 2/3: RUN &lt;&lt;EORUN (# Create two levels of directories, because adding a file to a...)</span></span> +<span class="giallo-l"><span>--&gt; d3f72d4d7b90</span></span> +<span class="giallo-l"><span>STEP 3/3: RUN touch /foo/bar/baz</span></span> +<span class="giallo-l"><span>COMMIT localhost/example</span></span> +<span class="giallo-l"><span>--&gt; b730a7409a5a</span></span> +<span class="giallo-l"><span>Successfully tagged localhost/example:latest</span></span> +<span class="giallo-l"><span>b730a7409a5a5b5450f4f1d142415043aeac48f6ac0d1ac2a632d75071668a60</span></span> +<span class="giallo-l"><span>⬢ [jeckersb@toolbx example]$ podman run --rm -it localhost/example stat /foo</span></span> +<span class="giallo-l"><span> File: /foo</span></span> +<span class="giallo-l"><span> Size: 6 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,93 Inode: 64851509 Links: 1</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Access: 2025-12-10 21:31:11.973931592 +0000</span></span> +<span class="giallo-l"><span>Modify: 1970-01-01 00:00:00.000000000 +0000</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 21:31:11.973678196 +0000</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 21:31:11.973031361 +0000</span></span></code></pre> +<p>But wait... the directory mtime is (correctly) still zeroed from the +first layer. So... everything up until now is a lie?</p> +<p>No! If we pull apart the last tar layer, we'll see that it actually +<em>does</em> contain a directory entry for /foo, even though it's not +modified in any way during the last <code>RUN</code> invocation. I'll skip the +part where I re-exported the image to an oci-dir just to make it +easier to look through the layers. Just trust me when I say this is +the tarball that gets generated for the last layer:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>⬢ [jeckersb@toolbx sha256]$ tar tvf 9402e1d4a1daea10ff057116f7fc6858be340fd82204eb17db566bfec547a911.tar</span></span> +<span class="giallo-l"><span>drwxr-xr-x 0/0 0 1969-12-31 19:00 foo/</span></span> +<span class="giallo-l"><span>drwxr-xr-x 0/0 0 2025-12-10 16:31 foo/bar/</span></span> +<span class="giallo-l"><span>-rw-r--r-- 0/0 0 2025-12-10 16:31 foo/bar/baz</span></span></code></pre> +<p>Ok, so <code>/foo</code> is there. But... why? We didn't modify it. Deeper +down the rabbit hole we go.</p> +<h2 id="overlayfs">Overlayfs</h2> +<p>Spoiler: the answer is +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/overlayfs.html">overlayfs</a>.</p> +<p>The OCI spec defines the image format, but notably it does <em>not</em> +specify any particular implementation details on how to store, manage, +and stitch together the final container image from its individual +layers.</p> +<p>In reality, container runtimes such as podman (via +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/containers/container-libs/tree/main/storage">containers-libs</a>, +formerly containers-storage) use the kernel filesystem overlayfs to +stitch together the layers into the final realized view of the world.</p> +<p>A <code>RUN</code> invocation in a <code>Containerfile</code> is in a nutshell this series +of steps:</p> +<ol> +<li>Mount the previous layer (and recursively, layers prior to that) +as a <code>lowerdir</code> in an overlayfs filesystem.</li> +<li>Perform the <code>RUN</code> invocation in the mounted filesystem.</li> +<li>Collect the contents of the resulting <code>upperdir</code> directory. This +becomes the tarball for that layer.</li> +</ol> +<p>This process is how we end up with our <code>/foo</code> directory duplicated +into the final layer, even though we did not modify it. We can mock +this out just using an overlay mount and basic commands.</p> +<p>First, mock our lower layer, and set the mtime:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@burd tmp]# mkdir lower upper work merged</span></span> +<span class="giallo-l"><span>[root@burd tmp]# mkdir -p lower/foo/bar</span></span> +<span class="giallo-l"><span>[root@burd tmp]# touch -d @0 lower/foo</span></span> +<span class="giallo-l"><span>[root@burd tmp]# stat lower/foo</span></span> +<span class="giallo-l"><span> File: lower/foo</span></span> +<span class="giallo-l"><span> Size: 60 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,45 Inode: 46858 Links: 3</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Context: unconfined_u:object_r:user_tmp_t:s0</span></span> +<span class="giallo-l"><span>Access: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Modify: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 16:53:27.174443520 -0500</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 16:53:20.544455919 -0500</span></span></code></pre> +<p>Next, mount it via overlayfs:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@burd tmp]# mount -t overlay overlay -o lowerdir=lower,upperdir=upper,workdir=work merged</span></span> +<span class="giallo-l"><span>[root@burd tmp]# cd merged</span></span> +<span class="giallo-l"><span>[root@burd merged]# stat foo</span></span> +<span class="giallo-l"><span> File: foo</span></span> +<span class="giallo-l"><span> Size: 60 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,90 Inode: 46858 Links: 3</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Context: unconfined_u:object_r:user_tmp_t:s0</span></span> +<span class="giallo-l"><span>Access: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Modify: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 16:53:27.174443520 -0500</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 16:53:20.544455919 -0500</span></span></code></pre> +<p>Now we simulate creating the new layer:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@burd merged]# touch foo/bar/baz</span></span></code></pre> +<p>Finally we can unmount the overlayfs mount and observe the contents of +the <code>upper</code> dir:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@burd merged]# cd ..</span></span> +<span class="giallo-l"><span>[root@burd tmp]# umount merged</span></span> +<span class="giallo-l"><span>[root@burd tmp]# find upper/</span></span> +<span class="giallo-l"><span>upper/</span></span> +<span class="giallo-l"><span>upper/foo</span></span> +<span class="giallo-l"><span>upper/foo/bar</span></span> +<span class="giallo-l"><span>upper/foo/bar/baz</span></span> +<span class="giallo-l"><span>[root@burd tmp]# stat upper/foo</span></span> +<span class="giallo-l"><span> File: upper/foo</span></span> +<span class="giallo-l"><span> Size: 60 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,45 Inode: 46870 Links: 3</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Context: unconfined_u:object_r:user_tmp_t:s0</span></span> +<span class="giallo-l"><span>Access: 2025-12-10 16:57:20.828001765 -0500</span></span> +<span class="giallo-l"><span>Modify: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 16:56:16.746593313 -0500</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 16:56:16.745126092 -0500</span></span></code></pre> +<p>So that's where our <code>/foo</code> entry comes from. This behavior is +explained in the <a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/overlayfs.html#non-directories">overlayfs +documentation</a>:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>Objects that are not directories (files, symlinks, device-special</span></span> +<span class="giallo-l"><span>files etc.) are presented either from the upper or lower filesystem as</span></span> +<span class="giallo-l"><span>appropriate. When a file in the lower filesystem is accessed in a way</span></span> +<span class="giallo-l"><span>that requires write-access, such as opening for write access, changing</span></span> +<span class="giallo-l"><span>some metadata etc., the file is first copied from the lower filesystem</span></span> +<span class="giallo-l"><span>to the upper filesystem (copy_up). Note that creating a hard-link also</span></span> +<span class="giallo-l"><span>requires copy_up, though of course creation of a symlink does not.</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>The copy_up may turn out to be unnecessary, for example if the file is</span></span> +<span class="giallo-l"><span>opened for read-write but the data is not modified.</span></span> +<span class="giallo-l"></span> +<span class="giallo-l"><span>The copy_up process first makes sure that the containing directory</span></span> +<span class="giallo-l"><span>exists in the upper filesystem - creating it and any parents as</span></span> +<span class="giallo-l"><span>necessary. It then creates the object with the same metadata (owner,</span></span> +<span class="giallo-l"><span>mode, mtime, symlink-target etc.) and then if the object is a file,</span></span> +<span class="giallo-l"><span>the data is copied from the lower to the upper filesystem. Finally any</span></span> +<span class="giallo-l"><span>extended attributes are copied up.</span></span></code></pre> +<p>Since the content of the layer tarball is taken directly from the +<code>upper</code>, we end up getting a copy of <code>/foo</code> via this process.</p> +<h2 id="where-do-we-go-from-here">Where do we go from here?</h2> +<p>Hopefully I have explained the situation adequately and this all makes +sense. I have achieved some amount of inner peace that comes with +reaching understanding.</p> +<p>However... I still don't like it. I think we can do better.</p> +<p>Here's the thing for <code>bootc</code>: in our rechunked images, I don't want to +include the same directories over and over again in every single +layer. It shouldn't be necessary, and by strict reading of the OCI +spec we <em>shouldn't</em> do that if the directories are unchanged (which +they aren't).</p> +<p>But in the current state of the world, if we <em>don't</em> duplicate those +entries into every layer, we end up with non-deterministic directory +metadata when our OCI image is mounted and viewed through the lens of +overlayfs. This is fundamentally broken as we move bootc into a +future where +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/issues/1190">composefs</a> and +<a class="external" rel="noopener noreferrer external" target="_blank" href="https://docs.kernel.org/filesystems/fsverity.html">fsverity</a> are used +to harden and validate images. Ideally a container image should be +able to measure its own fsverity hash in a reproducible manner. Today +that is not possible.</p> +<p>So the following is what I've done as a proof-of-concept (a huge +motivation for writing this post in the first place was to +exhaustively explain my justification for why this is needed). I've +written and tested a patch (still needs refining before submitting) +for overlayfs which does the following:</p> +<ul> +<li>Adds a new feature <code>passthrough</code> (naming bikeshedable) which +functions similarly to the <code>metacopy</code> feature.</li> +<li>Uses the <code>trusted.overlay.passthrough</code> to flag directories as +"structural-only".</li> +<li>When encountering a directory with the xattr, searches through the +lowerdirs until it finds a directory which does not have the xattr +set. The metadata for this layer is used. (If no unflagged +lowerdir is found, it falls back to the current behavior of using +non-deterministic local metadata)</li> +</ul> +<p>Here's an example. This is similar to our manual overlayfs example +above, except this uses two lower layers to show how unpacking a tar +layer with incomplete directory information might look.</p> +<p>First, create our base layer again:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@fedora ~]# mkdir upper merged work</span></span> +<span class="giallo-l"><span>[root@fedora ~]# mkdir -p base_layer/foo/bar</span></span> +<span class="giallo-l"><span>[root@fedora ~]# touch -d @0 base_layer/foo</span></span></code></pre> +<p>Then, in our second layer we create the <code>baz</code> file. This time we set +the <code>passthrough</code> xattr on <code>/foo</code>, which is how I envision this all +working when a container storage engine unpacks a <code>tar</code> archive with +incomplete parent directory information. Ideally this layer should +include a tar entry for <code>foo/bar/baz</code> and (arguably) <code>foo/bar</code> since +the directory metadata for <code>bar</code> should be updated to reflect the +addition of <code>bar</code>. But it definitely should <em>not</em> include an entry +for <code>foo/</code>:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@fedora ~]# mkdir -p second_layer/foo/bar</span></span> +<span class="giallo-l"><span>[root@fedora ~]# touch second_layer/foo/bar/baz</span></span> +<span class="giallo-l"><span>[root@fedora ~]# setfattr -n trusted.overlay.passthrough second_layer/foo</span></span></code></pre> +<p>Now let's mount it with the patched overlayfs. First, we'll specify +<code>passthrough=off</code> to show the existing behavior:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@fedora ~]# mount -t overlay overlay -o upperdir=upper,lowerdir=second_layer:base_layer,workdir=work,passthrough=off merged</span></span> +<span class="giallo-l"><span>[root@fedora ~]# stat merged/foo</span></span> +<span class="giallo-l"><span> File: merged/foo</span></span> +<span class="giallo-l"><span> Size: 6 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,59 Inode: 365132 Links: 1</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Context: unconfined_u:object_r:admin_home_t:s0</span></span> +<span class="giallo-l"><span>Access: 2025-12-10 17:33:32.787147889 -0500</span></span> +<span class="giallo-l"><span>Modify: 2025-12-10 17:33:32.787147889 -0500</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 17:34:01.701054010 -0500</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 17:33:32.787147889 -0500</span></span></code></pre> +<p>Here the <code>foo</code> directory has whatever metadata we created for it when +we "unpacked" it with the command <code>mkdir -p second_layer/foo/bar</code> +above. This is what we're trying to avoid.</p> +<p>Now let's unmount and remount with <code>passthrough=on</code>:</p> +<pre class="giallo" style="color: #24292E; background-color: #FFFFFF;"><code data-lang="plain"><span class="giallo-l"><span>[root@fedora ~]# umount merged</span></span> +<span class="giallo-l"><span>[root@fedora ~]# mount -t overlay overlay -o upperdir=upper,lowerdir=second_layer:base_layer,workdir=work,passthrough=on merged</span></span> +<span class="giallo-l"><span>[root@fedora ~]# stat merged/foo</span></span> +<span class="giallo-l"><span> File: merged/foo</span></span> +<span class="giallo-l"><span> Size: 6 Blocks: 0 IO Block: 4096 directory</span></span> +<span class="giallo-l"><span>Device: 0,59 Inode: 365129 Links: 1</span></span> +<span class="giallo-l"><span>Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)</span></span> +<span class="giallo-l"><span>Context: unconfined_u:object_r:admin_home_t:s0</span></span> +<span class="giallo-l"><span>Access: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Modify: 1969-12-31 19:00:00.000000000 -0500</span></span> +<span class="giallo-l"><span>Change: 2025-12-10 17:28:12.268740241 -0500</span></span> +<span class="giallo-l"><span> Birth: 2025-12-10 17:27:39.158847877 -0500</span></span></code></pre> +<p>Now we have the metadata for <code>foo</code> being passed through the second +layer and retrieved from the base layer, which is the behavior we +want.</p> +<h2 id="conclusion">Conclusion</h2> +<p>Ensuring that OCI image layers are able to only ship content that +they've modified will aid reproducibility and help unlock +optimizations by avoiding having derived layers always need to inherit +metadata from their parent. At the current time, however, tooling +creating OCI images should include their parent information in order +to maximize compatibility. We are looking forward to a future where +that's not necessary though!</p> + + + + Bootc Community Meeting Notes - 18 July 2025 + Fri, 18 Jul 2025 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2025-july-18-community-meeting/ + https://bootc.dev/blog/2025-july-18-community-meeting/ + <h3 id="attendees">Attendees:</h3> +<ul> +<li>Laura Santamaria (she/her; Red Hat)</li> +<li>Hristo Marinov</li> +<li>Fernando Lozano</li> +<li>Colin Walters (he/him; Red Hat)</li> +<li>Joseph Marrero Corchado (Red Hat, Inc.)</li> +<li>Matteo Piccinini (n/a)</li> +<li>Robert Sturla (Tesco Bank)</li> +<li>Dusty Mabe</li> +<li>Chris Kyrouac</li> +<li>Gursewak Mangat</li> +<li>John Eckersberg (Red Hat, Inc.)</li> +</ul> +<h3 id="agenda">Agenda:</h3> +<ul> +<li><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/pull/1422">Release 1.5.1</a> +<ul> +<li>Thanks @robert!</li> +</ul> +</li> +<li>[Laura] project pavilion update? +<ul> +<li>Request form due Monday, shouldn't block on travel</li> +<li>Let's do it live</li> +<li>✅</li> +</ul> +</li> +<li>[Laura] Static site generation for landing page +<ul> +<li>Review!</li> +<li><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc-dev.github.io/pull/3">bootc-dev/bootc-dev.github.io#3</a></li> +<li>adding logos as examples: <a class="external" rel="noopener noreferrer external" target="_blank" href="https://fedoraproject.org/coreos/">CoreOS site</a>; <a class="external" rel="noopener noreferrer external" target="_blank" href="https://projectbluefin.io/">BluefinOS</a></li> +</ul> +</li> +<li>[Colin] QMU banned contributions from AI. Want to talk about it. Contribution policy? +<ul> +<li>Thoughts?</li> +<li>Require use of <code>&lt;Assisted-by&gt;</code> tag to identify model/tool</li> +<li>Errant AI comment contributed to recent bug</li> +<li>[John] +1 on attribution</li> +<li>[Dusty] do we want to limit, or allow? +<ul> +<li>[Colin] has a pretty big impact, so want to know what folks think</li> +</ul> +</li> +<li>[Joseph] note in readme or contributing section makes sense. Maybe have a bot that highlights that on PR? People probably won't say anything because part of workflow</li> +<li>[Dusty] Can't prevent, but policy. Any examples of wasted time on clearly generated by AI PR +<ul> +<li>[Colin] Can tell 90% of the time. Most modern foundational models love bulleted lists, so it's obvious. Kinda wacky to put md doc in top level of repo for PR</li> +<li>[Laura] gave overview from OSPO and the other container group discussion</li> +</ul> +</li> +<li>[Colin] Will open a discussion</li> +</ul> +</li> +</ul> +<h3 id="todo">TODO:</h3> +<ul> +<li><input disabled="" type="checkbox"/> +Laura to explore adding logos to PR.</li> +<li><input disabled="" type="checkbox"/> +Laura to add GitHub Actions for publication</li> +<li><input disabled="" type="checkbox"/> +Look for info on domain handling for static site</li> +<li><input disabled="" type="checkbox"/> +Colin to open a discussion about the AI assisted PRs</li> +<li><input disabled="" type="checkbox" checked=""/> +Laura to find and share the public Containers Cabal recording</li> +</ul> + + + + Bootc Community Meeting Notes - 11 July 2025 + Fri, 11 Jul 2025 00:00:00 +0000 + Unknown + https://bootc.dev/blog/2025-july-11-community-meeting/ + https://bootc.dev/blog/2025-july-11-community-meeting/ + <h3 id="attendees">Attendees:</h3> +<ul> +<li>Joseph Marrero Corchado (Red Hat, Inc.)</li> +<li>Colin Walters</li> +<li>Robert Sturla (Tesco Bank/Universal Blue)</li> +<li>Laura Santamaria (she/her)</li> +<li>Hristo Marinov</li> +<li>John Eckersberg (Red Hat, Inc.)</li> +<li>Dusty (he/him)</li> +<li>Antheas Kapenekakis (Bazzite)</li> +<li>Mohan</li> +<li>Chris Kyrouac</li> +<li>Gursewak Mangat</li> +</ul> +<h3 id="agenda">Agenda:</h3> +<ul> +<li>New release status: <a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/issues/1390">bootc-dev/bootc#1390</a> +<ul> +<li>folks agreed on this</li> +</ul> +</li> +<li>[Laura] <a class="external" rel="noopener noreferrer external" target="_blank" href="https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/">KubeCon NA 2025</a> <a class="external" rel="noopener noreferrer external" target="_blank" href="https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/features-add-ons/project-opportunities/#description-of-opportunities">Project Pavilion application</a> +<ul> +<li>November 10-13 - Atlanta, Georgia</li> +<li>Who is going to KubeCon NA 2025 already? +<ul> +<li>Laura</li> +</ul> +</li> +<li>We'll get a project pavilion submission scheduled (probably from Joseph or Colin who already submitted a talk)</li> +</ul> +</li> +<li>Ublue - Collaboration +<ul> +<li>Folks are joining :)</li> +<li>Robert, Antheas from the Ublue community</li> +<li>Colin would like to do 1:1s +<ul> +<li>dustymabe: an office hours like set time could help facilitate this (+1 - Laura)</li> +</ul> +</li> +</ul> +</li> +<li><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/hhd-dev/rechunk">rechunker alignment</a></li> +<li><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/issues/1016">progress-fd</a></li> +<li><a class="external" rel="noopener noreferrer external" target="_blank" href="https://github.com/bootc-dev/bootc/issues/7">systemd-sysext frontend</a> +<ul> +<li>Motivated by combinatorial explosion of gnome|kde * nvidia|amd * surface|framework|lenovo</li> +<li>discussion of downsides of systemd-sysext as defined today, vs</li> +</ul> +</li> +</ul> +<h3 id="todo">TODO:</h3> +<ul> +<li><input disabled="" type="checkbox" checked=""/> +Put project pavilion application</li> +<li><input disabled="" type="checkbox" checked=""/> +Keep smaller, more focused meetings</li> +</ul> + + + + diff --git a/search_index.en.js b/search_index.en.js new file mode 100644 index 0000000..b6c5f35 --- /dev/null +++ b/search_index.en.js @@ -0,0 +1 @@ +window.searchIndex = {"fields":["title","body"],"pipeline":["trimmer","stopWordFilter","stemmer"],"ref":"id","version":"0.9.5","index":{"body":{"root":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":3,".":{"docs":{},"df":0,"2":{"docs":{},"df":0,".":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"5":{"docs":{},"df":0,".":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}},"0":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4,".":{"docs":{},"df":0,"2":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"1":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1},"3":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1},"4":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"5":{"docs":{},"df":0,":":{"docs":{},"df":0,"3":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"6":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"8":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2},"9":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},":":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}},"h":{"docs":{},"df":0,"4":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"2":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":1,"0":{"docs":{},"df":0,"1":{"docs":{},"df":0,"7":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"2":{"docs":{},"df":0,"2":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"5":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2},"6":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.449489742783178}},"df":1}}},"5":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1},"6":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"7":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"3":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1,"5":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1},"6":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"5":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"4":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1},"5":{"docs":{},"df":0,"1":{"docs":{},"df":0,"2":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}},"5":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"9":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}},"o":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"c":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}},"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}},"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":3}},"v":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}},"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":3}}}}},"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4,"a":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}},"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}}},"e":{"docs":{},"df":0,"q":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}}},"o":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/about/adopters/":{"tf":1.0}},"df":3,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"s":{"docs":{},"df":0,".":{"docs":{},"df":0,"m":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}}}}}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}}}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.0}},"df":1,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"m":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}}},"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}},"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}}},"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"m":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"w":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951}},"df":1}}}},"y":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1},"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4,"c":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":3}}},"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"p":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":1}}}}}}},"r":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}}}},"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"g":{"docs":{},"df":0,"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}}},"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}},"u":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"y":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":1}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":1}}},"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}}},"u":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":1,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772}},"df":2}}},"o":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}}}},"v":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":4}}},"o":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4}},"d":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"n":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"d":{"docs":{},"df":0,"w":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"k":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"/":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}}},"p":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0}},"df":1,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.23606797749979}},"df":6},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":2}}},"z":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"z":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"v":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.6457513110645907}},"df":2}}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":2,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":5}}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}}}},"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":1}}}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"t":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3},"y":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"d":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951}},"df":1}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}},"g":{"docs":{"https://bootc.dev/blog/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}},"u":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1,"f":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}}},"o":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":5.291502622129181},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.1622776601683795}},"df":6,"/":{"docs":{},"df":0,"e":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{},"df":0,"/":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"u":{"docs":{},"df":0,"x":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}}}}}}},"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"c":{"docs":{"https://bootc.dev/":{"tf":2.8284271247461903},"https://bootc.dev/about/about/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":4.123105625617661},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.449489742783178}},"df":11,"#":{"docs":{},"df":0,"2":{"docs":{},"df":0,"2":{"docs":{},"df":0,"0":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}},"'":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},".":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":4}}}},"u":{"docs":{},"df":0,"p":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":1}}}}},"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"h":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"n":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":4.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":6,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}}},"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1}}},"s":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"y":{"docs":{},"df":0,"&":{"docs":{},"df":0,"g":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}},"c":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"m":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}},"p":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1},"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"u":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.3166247903554},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":4}},"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5,"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/about/changelog/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}}},"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":2}}}},"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":4}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}},"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":2,"/":{"docs":{},"df":0,"c":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1},"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"u":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/":{"tf":2.0}},"df":1}}},"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":2}},"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":4}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"m":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":6}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"u":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":4}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6}},"i":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"c":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":7,"s":{"docs":{},"df":0,"=":{"docs":{},"df":0,"&":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{},"df":0,";":{"docs":{},"df":0,"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"&":{"docs":{},"df":0,"g":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}}}}}}}}}}}}}}}}},"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}}},"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"l":{"docs":{},"df":0,"u":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}},"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}}}},"f":{"docs":{},"df":0,".":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}},"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}},"r":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":1}}}},"j":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":2.23606797749979},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":4.358898943540674},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":9,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.4142135623730951}},"df":1,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1},"f":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":4}}}}}}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3}}},"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/about/contributing/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.0}},"df":3,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}},"o":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":6}}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"p":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}},"r":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}},"e":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":2}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":2}}}}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":4}}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,".":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"y":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"g":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}}}}}}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":2}}}}},"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/about/about/":{"tf":1.7320508075688772}},"df":1}}}}},"y":{"docs":{},"df":0,"c":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"z":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":3,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.449489742783178}},"df":3}}}}},"y":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772}},"df":1}},"b":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"f":{"docs":{},"df":0,"a":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}},"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":2,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"e":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"i":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}}}},"m":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":2,"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":3}}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.449489742783178}},"df":6}}}},"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1,"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"c":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3},"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":3}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"r":{"docs":{},"df":0,"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}}}}},"v":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1,".":{"docs":{},"df":0,"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,".":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"#":{"docs":{},"df":0,"3":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}}}}},"/":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"#":{"docs":{},"df":0,"1":{"docs":{},"df":0,"3":{"docs":{},"df":0,"9":{"docs":{},"df":0,"0":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}}}},"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,".":{"docs":{},"df":0,"c":{"docs":{},"df":0,"z":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.23606797749979}},"df":1}}}}}}},"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"f":{"docs":{},"df":0,"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":2}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}}},"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.1622776601683795},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.23606797749979}},"df":4}}}},"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":5.291502622129181},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5}}}}}}},"s":{"docs":{},"df":0,"c":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":1}},"u":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/":{"tf":2.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":5}}}},"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}}}}}}},"n":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1,"5":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"o":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2,"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4}}}}}},"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3}}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"w":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}},"u":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}},"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}},"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.7320508075688772}},"df":2},"y":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}},"e":{"docs":{},"df":0,".":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":7}},"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}},"s":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"s":{"docs":{},"df":0,"b":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}}}}},"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"y":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":1}}}}}}}},"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"f":{"docs":{},"df":0,"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"g":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"b":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":2,"e":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}},"p":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":4}}},"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1},"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"d":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":3},"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}}}},"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":4.358898943540674},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3}}},"s":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":3}}},"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"o":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}},"s":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}}}},"t":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":4}},"v":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2},"r":{"docs":{},"df":0,"y":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}}}}},"x":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":7}}}},"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}}}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"u":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772}},"df":4}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}},"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}}}},"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3},"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"4":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":1},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}},"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"f":{"docs":{},"df":0,"2":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":3}}}},"d":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2,"/":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}}}}}},"r":{"docs":{},"df":0,"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}},"w":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":4.358898943540674},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.0}},"df":7,"'":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1},"s":{"docs":{},"df":0,"y":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.4641016151377544},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":6,"=":{"docs":{},"df":0,"e":{"docs":{},"df":0,"x":{"docs":{},"df":0,"t":{"docs":{},"df":0,"4":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}}}}}}}}},"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.23606797749979}},"df":3}},"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"r":{"docs":{},"df":0,"m":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.4641016151377544},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":4.242640687119285},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.23606797749979}},"df":3,"e":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2},"x":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2},"t":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.23606797749979}},"df":1}}}}},"e":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1},"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.449489742783178}},"df":1}}}},"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"l":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}}},"o":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.605551275463989}},"df":1,"/":{"docs":{},"df":0,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"/":{"docs":{},"df":0,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"z":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}},"s":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"m":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":2}},"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}},"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}}},"r":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.449489742783178}},"df":2,"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}}}},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":4,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}},"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":4}}}},"w":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6}}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}},"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"u":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":4}}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}},"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"|":{"docs":{},"df":0,"k":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}},"o":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3,"o":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/about/governance/":{"tf":1.0}},"df":3}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}},"u":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}},"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}},"r":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}}}}}}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{},"df":0,"m":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"p":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":4}}}},"r":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}},"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"s":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5}},"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.0}},"df":2},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"/":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"l":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}},"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3,"'":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}}},"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":2}}}}}}},"g":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}}}}}},"o":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"f":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}},"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}}}}},"s":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}},"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"'":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},".":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1},"/":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}},"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}}}}}},"g":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/about/about/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":3.3166247903554},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":4.898979485566356},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":4.795831523312719},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.7416573867739413}},"df":9,"e":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0}},"df":1}}}},"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"d":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}},"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}}}},"n":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":2,"l":{"docs":{},"df":0,"u":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":5}}},"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}}},"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"i":{"docs":{},"df":0,"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4}}}}}},"f":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"r":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":2}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}}}}}}}}}},"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}}}}}},"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"p":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"g":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}},"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}},"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}},"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}},"v":{"docs":{},"df":0,"o":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1},"l":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}}}},"s":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}},"o":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"s":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0}},"df":1}}},"t":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772}},"df":2}}}}}},"j":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"k":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"h":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":2}},"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":2}}}}},"s":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"n":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":1}},"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"k":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"k":{"docs":{},"df":0,"a":{"docs":{},"df":0,"k":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}}}}},"e":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"k":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2},"r":{"docs":{},"df":0,"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":4.58257569495584},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.6457513110645907}},"df":7,"'":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"y":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":7.483314773547883},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.0}},"df":5,"s":{"docs":{},"df":0,"/":{"docs":{},"df":0,"&":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{},"df":0,";":{"docs":{},"df":0,"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"&":{"docs":{},"df":0,"g":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}},"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}},"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951}},"df":1}}}}}},"y":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}}}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":2}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}},"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":2.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.6457513110645907}},"df":2}}},"y":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":5.744562646538029},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.6457513110645907}},"df":6}}}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/about/":{"tf":1.0}},"df":2}}},"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"f":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}},"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"t":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}}},"i":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"y":{"docs":{},"df":0,"c":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":1}}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"k":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"n":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":4},"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2},"u":{"docs":{},"df":0,"x":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4}},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":4,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}}}},"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,".":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}}}},"c":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}},"g":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":1}},"n":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"o":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"w":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":2,"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}}}},"z":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,";":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}}}},"d":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/about/maintainers/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}},"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"k":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":7}},"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":6}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}}},"i":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3,"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}},"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}},"t":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3}},"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":1}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"x":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"x":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"y":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"d":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}},"s":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":3}},"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"u":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"p":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.3166247903554},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979}},"df":2}}}},"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"g":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}}},"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.8284271247461903}},"df":1,"d":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}},"k":{"docs":{},"df":0,"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"d":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":2,"l":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2,"/":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}},"u":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}},"k":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}},"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":8}},"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":3}}},"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":5,"=":{"docs":{},"df":0,"t":{"docs":{},"df":0,"y":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"=":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}},"v":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2,"p":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}},"n":{"docs":{},"df":0,"/":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951}},"df":1,"m":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":2}}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}}}},"e":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.449489742783178}},"df":3}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":6},"x":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":4}}},"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"e":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1,"\"":{"docs":{},"df":0,"|":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}},"e":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5},"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}},"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}},"u":{"docs":{},"df":0,"m":{"docs":{},"df":0,"b":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"s":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"a":{"docs":{},"df":0,"|":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}}},"o":{"docs":{},"df":0,"b":{"docs":{},"df":0,"j":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}},"c":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":2,"/":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}}}}}}},"f":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}},"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1},"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":3,"c":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"r":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/about/about/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":7}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}}},"r":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}}},"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":2}}}}},"s":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":4,"p":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0}},"df":1}}}},"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0}},"df":1}}}},"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.3166247903554},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772}},"df":2}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}},"m":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}},"w":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}}}},"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}},"g":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}},"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"c":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":2,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":2}}}},"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"=":{"docs":{},"df":0,"o":{"docs":{},"df":0,"f":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}}}}},"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}}},"y":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"m":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"o":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2,"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}}}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}}}},"d":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772}},"df":2}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"t":{"docs":{},"df":0,"f":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}},"k":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":6}},"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"t":{"docs":{},"df":0,"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772}},"df":2}}}}}},"u":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1,"g":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":1}}}},"r":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.23606797749979}},"df":5}},"w":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":2}}}},"r":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}},"g":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"e":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"x":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3,"s":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"i":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}},"o":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":2}},"v":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":2}}}},"o":{"docs":{},"df":0,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"c":{"docs":{},"df":0,"/":{"docs":{},"df":0,"c":{"docs":{},"df":0,"m":{"docs":{},"df":0,"d":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}}},"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5}}}},"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}}},"g":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}}},"j":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":2.6457513110645907},"https://bootc.dev/about/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":7}}}},"o":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3},"s":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"r":{"docs":{},"df":0,"p":{"docs":{},"df":0,"o":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5}}},"q":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"/":{"docs":{},"df":0,"k":{"docs":{},"df":0,"v":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}},"m":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"u":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":4,"m":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"z":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}},"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":2}}}},"i":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}},"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"d":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":2.0}},"df":2},"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"u":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"g":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}},"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":3}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":4}},"v":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"m":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"v":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"o":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"q":{"docs":{},"df":0,"u":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}},"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4}}}},"s":{"docs":{},"df":0,"o":{"docs":{},"df":0,"l":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":3}}}},"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}},"v":{"docs":{},"df":0,"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}}},"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"o":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"b":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":2}}}},"l":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1},"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":5,"f":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}}},"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}},"p":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":3.3166247903554}},"df":1}},"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"u":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5}}}}},"ů":{"docs":{},"df":0,"ž":{"docs":{},"df":0,"i":{"docs":{},"df":0,"č":{"docs":{},"df":0,"k":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":4}},"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"x":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}}}}}},"b":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}}}}}},"c":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":2}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.3166247903554},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.872983346207417}},"df":6},"m":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}}},"r":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":2,"_":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"/":{"docs":{},"df":0,"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"/":{"docs":{},"df":0,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0}},"df":1}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}},"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/security/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.1622776601683795},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":4.242640687119285},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.0}},"df":5,"e":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":1}}}}}}}},"e":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"f":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}},"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"v":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}}},"t":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":5,"u":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"h":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1,"r":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/about/about/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":4}}},"e":{"docs":{},"df":0,"/":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}},"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}},"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":2}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"d":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}}},"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}},"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.4641016151377544},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":4.69041575982343},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.1622776601683795},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":4,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}}}},"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}}}}}},"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"n":{"docs":{},"df":0,"g":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5}}},"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.7320508075688772}},"df":2},"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"k":{"docs":{},"df":0,"i":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":2}}},"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":1}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}},"o":{"docs":{},"df":0,"f":{"docs":{},"df":0,"t":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}}},"l":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"e":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1,"i":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"o":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"s":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":1}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"g":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.605551275463989},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}},"l":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":2}}}}},"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4}},"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951}},"df":1}},"u":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"e":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":4}},"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}},"t":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":5}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{},"df":0,"t":{"docs":{},"df":0,"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}}}}}}},"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}},"u":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}},"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,"m":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":2}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"q":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1,"s":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"g":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"p":{"docs":{},"df":0,"p":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":4}},"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"r":{"docs":{},"df":0,"f":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"|":{"docs":{},"df":0,"f":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"e":{"docs":{},"df":0,"w":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"k":{"docs":{},"df":0,"|":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"v":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}}}}}},"p":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"s":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"y":{"docs":{},"df":0,"m":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"x":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951}},"df":1}}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":2.6457513110645907},"https://bootc.dev/about/about/":{"tf":2.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":2.449489742783178},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.1622776601683795},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.6457513110645907}},"df":8,"'":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"d":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0}},"df":6,".":{"docs":{},"df":0,"v":{"docs":{},"df":0,"o":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"=":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1},"k":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"l":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772}},"df":3}},"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":2}}}},"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":4.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"b":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979}},"df":1}}},"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2,"/":{"docs":{},"df":0,"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}}}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"n":{"docs":{},"df":0,"i":{"docs":{},"df":0,"q":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951}},"df":1}}}}}}},"k":{"docs":{},"df":0,"t":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3}},"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"t":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}},"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":2}}},"y":{"docs":{},"df":0,"'":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5},"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}},"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}},"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6}}}}}},"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1,"g":{"docs":{},"df":0,"h":{"docs":{},"df":0,"t":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}},"m":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":6,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}}}}}},"l":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951}},"df":1}},"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"f":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951}},"df":1}}},"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}},"o":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}},"o":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":6}},"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3},"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/":{"tf":2.0}},"df":1}}}}},"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}},"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2,"\"":{"docs":{},"df":0,"|":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"o":{"docs":{},"df":0,"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"|":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"b":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"|":{"docs":{},"df":0,"\"":{"docs":{},"df":0,"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}}}}}}}}}}},"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}}},"e":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}},"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1,"g":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"u":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4,"e":{"docs":{},"df":0,"d":{"docs":{},"df":0,".":{"docs":{},"df":0,"o":{"docs":{},"df":0,"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"y":{"docs":{},"df":0,".":{"docs":{},"df":0,"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}}}}}}}}}},"y":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}},"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0}},"df":1}}},"w":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}},"y":{"docs":{},"df":0,"p":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"i":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}}}},"u":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.4142135623730951}},"df":1}}},"e":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"k":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":5,"'":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3},"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":2}}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"s":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}}}}}},"f":{"docs":{},"df":0,"l":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}},"q":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}},"t":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":3}}}},"m":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}}}}},"n":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"s":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}},"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}},"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.449489742783178}},"df":1}}}},"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"g":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}},"t":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":2}}},"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772}},"df":1}}}}}}},"p":{"docs":{"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3,"d":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.4142135623730951},"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951}},"df":5}}},"g":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"p":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1,"d":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{"https://bootc.dev/":{"tf":2.449489742783178},"https://bootc.dev/about/":{"tf":1.0},"https://bootc.dev/about/about/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.8284271247461903},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":3.7416573867739413},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":2.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":10,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}},"b":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1},"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3,".":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{},"df":0,"p":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1,"/":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"/":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{},"df":0,"c":{"docs":{},"df":0,"/":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{},"df":0,"/":{"docs":{},"df":0,"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"b":{"docs":{},"df":0,"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}}}}}}}}}}}}}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}}}}},"m":{"docs":{},"df":0,"o":{"docs":{},"df":0,"d":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}}}}}}},"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"t":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}},"v":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}},"r":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4,"i":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1,"a":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":2.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}}},"o":{"docs":{},"df":0,"u":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":2}}}},"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1,"f":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":2.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":3,"i":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.4641016151377544},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":3.0}},"df":6}},"t":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":3.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.6457513110645907}},"df":2},"y":{"docs":{},"df":0,"=":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"q":{"docs":{},"df":0,"u":{"docs":{},"df":0,"i":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2}}}}}}}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/":{"tf":2.23606797749979},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":3}}}}}},"i":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4},"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.4142135623730951}},"df":1}}},"e":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"r":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":2,"u":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":3}}}}},"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}},"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":2.0}},"df":3,"'":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"s":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1}},"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"i":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.7320508075688772}},"df":2}},"l":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"g":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}}},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":4}}}},"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.7320508075688772}},"df":3}},"s":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}},"y":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":4}},"e":{"docs":{},"df":0,"'":{"docs":{},"df":0,"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.6457513110645907},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.7320508075688772},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":5}},"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1},"v":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"k":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}},"l":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"'":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":5},"e":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}}},"e":{"docs":{},"df":0,"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}},"o":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"s":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"p":{"docs":{},"df":0,"r":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}}},"t":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.7320508075688772}},"df":2}}}}}},"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"'":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":2.23606797749979},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":7,"a":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"f":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"w":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951}},"df":3}}}}},"l":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951}},"df":1}},"t":{"docs":{},"df":0,"h":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}}}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"p":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":4}},"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5},"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":2}}}}}}},"x":{"docs":{},"df":0,"a":{"docs":{},"df":0,"t":{"docs":{},"df":0,"t":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.7320508075688772}},"df":1}}}},"f":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}},"y":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":2}}},"o":{"docs":{},"df":0,"u":{"docs":{},"df":0,"'":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":3}},"t":{"docs":{},"df":0,"u":{"docs":{},"df":0,"b":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.4142135623730951}},"df":1}}}}}},"z":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/":{"tf":1.0}},"df":1}}}}}},"title":{"root":{"docs":{},"df":0,"1":{"docs":{},"df":0,"1":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0}},"df":1},"8":{"docs":{"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":1}},"2":{"docs":{},"df":0,"0":{"docs":{},"df":0,"2":{"docs":{},"df":0,"5":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2},"6":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}},"a":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{},"df":0,"p":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/about/adopters/":{"tf":1.0}},"df":1}}}},"r":{"docs":{},"df":0,"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"i":{"docs":{},"df":0,"v":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}},"b":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/":{"tf":1.0}},"df":1}}},"o":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1,"c":{"docs":{"https://bootc.dev/":{"tf":1.0},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":5}}}},"u":{"docs":{},"df":0,"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"d":{"docs":{"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.0}},"df":1}}}}},"c":{"docs":{},"df":0,"h":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}},"n":{"docs":{},"df":0,"g":{"docs":{},"df":0,"e":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/about/changelog/":{"tf":1.0}},"df":1}}}}}}}},"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"m":{"docs":{},"df":0,"u":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}},"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"b":{"docs":{},"df":0,"u":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/about/contributing/":{"tf":1.0}},"df":1}}}}}}}}},"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}},"v":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"n":{"docs":{},"df":0,"f":{"docs":{},"df":0,".":{"docs":{},"df":0,"c":{"docs":{},"df":0,"z":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}}}}},"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"s":{"docs":{},"df":0,"y":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}}}}},"t":{"docs":{},"df":0,"c":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}},"f":{"docs":{},"df":0,"e":{"docs":{},"df":0,"d":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"a":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"s":{"docs":{},"df":0,"y":{"docs":{},"df":0,"s":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}}}},"r":{"docs":{},"df":0,"m":{"docs":{},"df":0,"w":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0}},"df":1}}}}}},"l":{"docs":{},"df":0,"o":{"docs":{},"df":0,"c":{"docs":{},"df":0,"k":{"docs":{"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"tf":1.0}},"df":1}}}}},"g":{"docs":{},"df":0,"o":{"docs":{},"df":0,"v":{"docs":{},"df":0,"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/about/governance/":{"tf":1.0}},"df":1}}}}}},"i":{"docs":{},"df":0,"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":4}}},"n":{"docs":{},"df":0,"c":{"docs":{},"df":0,"o":{"docs":{},"df":0,"m":{"docs":{},"df":0,"p":{"docs":{},"df":0,"l":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}}}},"f":{"docs":{},"df":0,"o":{"docs":{},"df":0,"r":{"docs":{},"df":0,"m":{"docs":{"https://bootc.dev/about/":{"tf":1.0}},"df":1}}}}}},"j":{"docs":{},"df":0,"u":{"docs":{},"df":0,"l":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"k":{"docs":{},"df":0,"e":{"docs":{},"df":0,"y":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}},"m":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"i":{"docs":{},"df":0,"n":{"docs":{"https://bootc.dev/about/maintainers/":{"tf":1.0}},"df":1}}}}}},"n":{"docs":{},"df":0,"a":{"docs":{},"df":0,"g":{"docs":{"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":1}}}},"e":{"docs":{},"df":0,"e":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"n":{"docs":{},"df":0,"o":{"docs":{},"df":0,"t":{"docs":{},"df":0,"e":{"docs":{"https://bootc.dev/blog/2025-july-11-community-meeting/":{"tf":1.0},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"tf":1.0}},"df":2}}}},"p":{"docs":{},"df":0,"i":{"docs":{},"df":0,"t":{"docs":{},"df":0,"f":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}}}}},"r":{"docs":{},"df":0,"o":{"docs":{},"df":0,"j":{"docs":{},"df":0,"e":{"docs":{},"df":0,"c":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/about/":{"tf":1.0}},"df":1}}}}}}},"s":{"docs":{},"df":0,"e":{"docs":{},"df":0,"a":{"docs":{},"df":0,"l":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"tf":1.4142135623730951},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.4142135623730951}},"df":5}},"c":{"docs":{},"df":0,"u":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/about/security/":{"tf":1.0},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"tf":1.0},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"tf":1.0}},"df":3}}}}},"t":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"tf":1.0}},"df":1}},"r":{"docs":{},"df":0,"a":{"docs":{},"df":0,"n":{"docs":{},"df":0,"s":{"docs":{},"df":0,"i":{"docs":{},"df":0,"e":{"docs":{},"df":0,"n":{"docs":{},"df":0,"t":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}}},"v":{"docs":{},"df":0,"a":{"docs":{},"df":0,"r":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}},"e":{"docs":{},"df":0,"r":{"docs":{},"df":0,"i":{"docs":{},"df":0,"f":{"docs":{},"df":0,"i":{"docs":{"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"tf":1.0}},"df":1}}}}},"i":{"docs":{},"df":0,"d":{"docs":{},"df":0,"e":{"docs":{},"df":0,"o":{"docs":{"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"tf":1.0}},"df":1}}}}}}}},"documentStore":{"save":true,"docs":{"https://bootc.dev/":{"body":"Transactional, in-place operating system updates using OCI/Docker container images.\nMotivation\nThe original Docker container model of using \"layers\" to model applications has been extremely successful. This project aims to apply the same technique for bootable host systems - using standard OCI/Docker containers as a transport and delivery format for base operating system updates.\nThe container image includes a Linux kernel (in e.g. /usr/lib/modules), which is used to boot. At runtime on a target system, the base userspace is not itself running in a \"container\" by default. For example, assuming systemd is in use, systemd acts as pid1 as usual---there's no \"outer\" process. More about this in the docs; see below.\nStatus\nThe CLI and API are considered stable. We will ensure that every existing system can be upgraded in place seamlessly across any future changes.\nDocumentation\nThe project documentation is hosted on a different site: Docs\nVersioning\nAlthough bootc is not released to crates.io as a library, version numbers are expected to follow semantic versioning standards. This practice began with the release of version 1.2.0; versions prior may not adhere strictly to semver standards.\nAdopters (base and end-user images)\nThe bootc CLI is just a client system; it is not tied to any particular operating system or Linux distribution. You very likely want to actually start by looking at ADOPTERS.md.\nCommunity discussion\nGithub discussion forum for async discussion\n#bootc-dev on CNCF Slack for live chat\nRecurring live meeting hosted on CNCF Zoom each Friday at 15:30 UTC.\nMeeting notes on HackMD\nThis project is also currently tightly related to the previously mentioned Fedora/CentOS bootc project, and many developers monitor the relevant discussion forums there. In particular, there's a Matrix channel and a weekly chat meeting; learn more.\nDeveloping bootc\nAre you interested in working on bootc? Great! Reference our contribution guide.\nThere is also a list of Maintainers.\nGovernance\nReference Governance for project governance details.\nBadges\nCode of Conduct\nThe bootc project is a Cloud Native Computing Foundation (CNCF) Sandbox project and adheres to the CNCF Community Code of Conduct.\nThe Linux Foundation® (TLF) has registered trademarks and uses trademarks. For a list of TLF trademarks, see Trademark Usage.","id":"https://bootc.dev/","title":"bootc"},"https://bootc.dev/about/":{"body":"Use these pages to learn more about the project, our governance, and adopters.","id":"https://bootc.dev/about/","title":"Project information"},"https://bootc.dev/about/about/":{"body":"So what is bootc?\nImagine the ability to set up your operating system using a file you can check into source control. bootc basically turns your operating system into a containerized system, complete with in-place updates, custom configurations and pre-installed software and drivers, and more. You can share your custom containerized operating system image with others, too.\nUnlock the power of bootc with shared custom OS images.","id":"https://bootc.dev/about/about/","title":"About"},"https://bootc.dev/about/adopters/":{"body":"","id":"https://bootc.dev/about/adopters/","title":"Adopters"},"https://bootc.dev/about/changelog/":{"body":"","id":"https://bootc.dev/about/changelog/","title":"Changelog"},"https://bootc.dev/about/contributing/":{"body":"","id":"https://bootc.dev/about/contributing/","title":"Contributing"},"https://bootc.dev/about/governance/":{"body":"","id":"https://bootc.dev/about/governance/","title":"Governance"},"https://bootc.dev/about/maintainers/":{"body":"","id":"https://bootc.dev/about/maintainers/","title":"Maintainers"},"https://bootc.dev/about/security/":{"body":"","id":"https://bootc.dev/about/security/","title":"Security"},"https://bootc.dev/blog/":{"body":"","id":"https://bootc.dev/blog/","title":"Blog"},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"body":"Containers: pitfalls of incomplete tar archives\nAs Colin Walters likes to say, containers\nare just tarballs wrapped in JSON. We'll mostly ignore the JSON part\nhere, but there's a lot to unpack (pun and foreshadowing intended)\nwith regards to tar and how it interacts with the various pieces that\nwork in conjunction to make containers a reality.\nA refresher on tar\nLet's explore a key quirk of tar from which everything else we'll\ndiscuss follows.\nFirst, let's create a basic tar archive, which contains a directory\nwith a file inside of the directory:\nNow let's list the contents of the tar archive:\nOk, that makes sense. We see the directory and the file we added to\nthe archive.\nBut here's the key bit: What happens if you add only the file to the archive?\nNow the archive has metadata only for the file. You can deduce from\nthe path foo/bar that there is a directory foo involved, but you\ncan't definitively know how foo is supposed to look. What are the\npermissions, owner, group, mtime? We don't know. So what happens if\nyou extract this tar archive?\nIt implicitly creates the directory foo in order to put bar at the\ncorrect path. This makes sense. But notice foo gets created with\nmetadata that is dependent on the environment in which the unpacking\nof the archive happened. In the above example, you can see that the\ntimestamp on the directory is 10 minutes later than the timestamp of\nthe bar file inside. This is because it took me 10 minutes of\nwriting and editing this post before I did the unpack operation. I\ncan set my umask to something else and extract it a second time, and\nnow we'll see a different timestamp and different permissions:\nOCI image spec\nOCI container images are serialized as a series of\ntarballs\nthat are applied on top of each other to create the complete\nfilesystem. We'll get back to the specifics of that operation a bit\nlater.\nThe entire layer specification is worth reading, but we'll focus on\ntwo parts. First, how to determine changes:\nAnd then the following section on representing changes:\nBut note that the changeset says nothing about the directories higher\nin the filesystem. So in the above example, it would be perfectly\nvalid (and more correct) to generate changeset tar archives which are\nincomplete in the same manner we described above. Most notably, these\nchangesets would not contain tar entries for the directories /etc\nand /bin.\nThis oversight in the specification is not new or surprising. There\nis an open issue from\n2017 which\ndescribes exactly this problem. There is a linked pull\nrequest which\nhas been open since late 2022 with intermittent discussion, but no\nconsensus or resolution has been reached yet.\nThis has led to some projects implementing their own workarounds to\ndeal with this behavior. The containerd project as an example\nnoted this\nissue in 2017\nand worked around\nit by creating\nexplicit archive directory entries for parents.\nRechunking in bootc / rpm-ostree\nBase images used via bootc are typically post-processed and\nfinalized via the rpm-ostree\nrechunker.\nThe general idea (oversimplifying a bit for brevity) is that the tool\ncan inspect the RPM database and map each file in the container to its\nassociated RPM. It then \"rechunks\" the container by creating a new\nlayer for each RPM, where the layer contains the files for that RPM\nand only that RPM. This ensures that when a new version of an RPM is\nreleased in the future, when it is integrated into a new base image,\nonly the layer associated with that RPM will need to be re-downloaded\nby the end user.\nHowever, consider a directory like /usr. This is owned by the\nfilesystem package which contains all of the shared base directories\nin the system. This directory will be included in the layer\nassociated with the filesystem package with all of its related\nmetadata.\nNow, almost every other package in the system is going to have some\namount of content that is shipped under the /usr hierarchy.\nOriginally, the rpm-ostree rechunker would omit the archive entry\nfor /usr in each package layer.\nThis however would cause the behavior of indeterminate tar archives\ndiscussed above to be manifest in the final container. For example,\nit was noted in this composefs-rs\nissue.\nWe worked around this issue by creating a new\nformat-version for\nthe rpm-ostree rechunker, which creates all of the parent\ndirectories in each tar layer. This is similar to the fix implemented\nas noted above by the containerd project. This works, but it's not\nideal. It means that all of the parent directories and their\nrespective metadata have to be duplicated across every layer in the\nimage. This is an unnecessary waste of disk space and bandwidth.\nWhy isn't this a more widespread problem?\nWhen I first realized what was going on here, I thought I could\ntrigger this behavior with a Containerfile like this:\nBut alas:\nBut wait... the directory mtime is (correctly) still zeroed from the\nfirst layer. So... everything up until now is a lie?\nNo! If we pull apart the last tar layer, we'll see that it actually\ndoes contain a directory entry for /foo, even though it's not\nmodified in any way during the last RUN invocation. I'll skip the\npart where I re-exported the image to an oci-dir just to make it\neasier to look through the layers. Just trust me when I say this is\nthe tarball that gets generated for the last layer:\nOk, so /foo is there. But... why? We didn't modify it. Deeper\ndown the rabbit hole we go.\nOverlayfs\nSpoiler: the answer is\noverlayfs.\nThe OCI spec defines the image format, but notably it does not\nspecify any particular implementation details on how to store, manage,\nand stitch together the final container image from its individual\nlayers.\nIn reality, container runtimes such as podman (via\ncontainers-libs,\nformerly containers-storage) use the kernel filesystem overlayfs to\nstitch together the layers into the final realized view of the world.\nA RUN invocation in a Containerfile is in a nutshell this series\nof steps:\nMount the previous layer (and recursively, layers prior to that)\nas a lowerdir in an overlayfs filesystem.\nPerform the RUN invocation in the mounted filesystem.\nCollect the contents of the resulting upperdir directory. This\nbecomes the tarball for that layer.\nThis process is how we end up with our /foo directory duplicated\ninto the final layer, even though we did not modify it. We can mock\nthis out just using an overlay mount and basic commands.\nFirst, mock our lower layer, and set the mtime:\nNext, mount it via overlayfs:\nNow we simulate creating the new layer:\nFinally we can unmount the overlayfs mount and observe the contents of\nthe upper dir:\nSo that's where our /foo entry comes from. This behavior is\nexplained in the overlayfs\ndocumentation:\nSince the content of the layer tarball is taken directly from the\nupper, we end up getting a copy of /foo via this process.\nWhere do we go from here?\nHopefully I have explained the situation adequately and this all makes\nsense. I have achieved some amount of inner peace that comes with\nreaching understanding.\nHowever... I still don't like it. I think we can do better.\nHere's the thing for bootc: in our rechunked images, I don't want to\ninclude the same directories over and over again in every single\nlayer. It shouldn't be necessary, and by strict reading of the OCI\nspec we shouldn't do that if the directories are unchanged (which\nthey aren't).\nBut in the current state of the world, if we don't duplicate those\nentries into every layer, we end up with non-deterministic directory\nmetadata when our OCI image is mounted and viewed through the lens of\noverlayfs. This is fundamentally broken as we move bootc into a\nfuture where\ncomposefs and\nfsverity are used\nto harden and validate images. Ideally a container image should be\nable to measure its own fsverity hash in a reproducible manner. Today\nthat is not possible.\nSo the following is what I've done as a proof-of-concept (a huge\nmotivation for writing this post in the first place was to\nexhaustively explain my justification for why this is needed). I've\nwritten and tested a patch (still needs refining before submitting)\nfor overlayfs which does the following:\nAdds a new feature passthrough (naming bikeshedable) which\nfunctions similarly to the metacopy feature.\nUses the trusted.overlay.passthrough to flag directories as\n\"structural-only\".\nWhen encountering a directory with the xattr, searches through the\nlowerdirs until it finds a directory which does not have the xattr\nset. The metadata for this layer is used. (If no unflagged\nlowerdir is found, it falls back to the current behavior of using\nnon-deterministic local metadata)\nHere's an example. This is similar to our manual overlayfs example\nabove, except this uses two lower layers to show how unpacking a tar\nlayer with incomplete directory information might look.\nFirst, create our base layer again:\nThen, in our second layer we create the baz file. This time we set\nthe passthrough xattr on /foo, which is how I envision this all\nworking when a container storage engine unpacks a tar archive with\nincomplete parent directory information. Ideally this layer should\ninclude a tar entry for foo/bar/baz and (arguably) foo/bar since\nthe directory metadata for bar should be updated to reflect the\naddition of bar. But it definitely should not include an entry\nfor foo/:\nNow let's mount it with the patched overlayfs. First, we'll specify\npassthrough=off to show the existing behavior:\nHere the foo directory has whatever metadata we created for it when\nwe \"unpacked\" it with the command mkdir -p second_layer/foo/bar\nabove. This is what we're trying to avoid.\nNow let's unmount and remount with passthrough=on:\nNow we have the metadata for foo being passed through the second\nlayer and retrieved from the base layer, which is the behavior we\nwant.\nConclusion\nEnsuring that OCI image layers are able to only ship content that\nthey've modified will aid reproducibility and help unlock\noptimizations by avoiding having derived layers always need to inherit\nmetadata from their parent. At the current time, however, tooling\ncreating OCI images should include their parent information in order\nto maximize compatibility. We are looking forward to a future where\nthat's not necessary though!","id":"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/","title":"Containers: pitfalls of incomplete tar archives"},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"body":"Attendees:\nJoseph Marrero Corchado (Red Hat, Inc.)\nColin Walters\nRobert Sturla (Tesco Bank/Universal Blue)\nLaura Santamaria (she/her)\nHristo Marinov\nJohn Eckersberg (Red Hat, Inc.)\nDusty (he/him)\nAntheas Kapenekakis (Bazzite)\nMohan\nChris Kyrouac\nGursewak Mangat\nAgenda:\nNew release status: bootc-dev/bootc#1390\nfolks agreed on this\n[Laura] KubeCon NA 2025 Project Pavilion application\nNovember 10-13 - Atlanta, Georgia\nWho is going to KubeCon NA 2025 already?\nLaura\nWe'll get a project pavilion submission scheduled (probably from Joseph or Colin who already submitted a talk)\nUblue - Collaboration\nFolks are joining :)\nRobert, Antheas from the Ublue community\nColin would like to do 1:1s\ndustymabe: an office hours like set time could help facilitate this (+1 - Laura)\nrechunker alignment\nprogress-fd\nsystemd-sysext frontend\nMotivated by combinatorial explosion of gnome|kde * nvidia|amd * surface|framework|lenovo\ndiscussion of downsides of systemd-sysext as defined today, vs\nTODO:\nPut project pavilion application\nKeep smaller, more focused meetings","id":"https://bootc.dev/blog/2025-july-11-community-meeting/","title":"Bootc Community Meeting Notes - 11 July 2025"},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"body":"Attendees:\nLaura Santamaria (she/her; Red Hat)\nHristo Marinov\nFernando Lozano\nColin Walters (he/him; Red Hat)\nJoseph Marrero Corchado (Red Hat, Inc.)\nMatteo Piccinini (n/a)\nRobert Sturla (Tesco Bank)\nDusty Mabe\nChris Kyrouac\nGursewak Mangat\nJohn Eckersberg (Red Hat, Inc.)\nAgenda:\nRelease 1.5.1\nThanks @robert!\n[Laura] project pavilion update?\nRequest form due Monday, shouldn't block on travel\nLet's do it live\n✅\n[Laura] Static site generation for landing page\nReview!\nbootc-dev/bootc-dev.github.io#3\nadding logos as examples: CoreOS site; BluefinOS\n[Colin] QMU banned contributions from AI. Want to talk about it. Contribution policy?\nThoughts?\nRequire use of <Assisted-by> tag to identify model/tool\nErrant AI comment contributed to recent bug\n[John] +1 on attribution\n[Dusty] do we want to limit, or allow?\n[Colin] has a pretty big impact, so want to know what folks think\n[Joseph] note in readme or contributing section makes sense. Maybe have a bot that highlights that on PR? People probably won't say anything because part of workflow\n[Dusty] Can't prevent, but policy. Any examples of wasted time on clearly generated by AI PR\n[Colin] Can tell 90% of the time. Most modern foundational models love bulleted lists, so it's obvious. Kinda wacky to put md doc in top level of repo for PR\n[Laura] gave overview from OSPO and the other container group discussion\n[Colin] Will open a discussion\nTODO:\nLaura to explore adding logos to PR.\nLaura to add GitHub Actions for publication\nLook for info on domain handling for static site\nColin to open a discussion about the AI assisted PRs\nLaura to find and share the public Containers Cabal recording","id":"https://bootc.dev/blog/2025-july-18-community-meeting/","title":"Bootc Community Meeting Notes - 18 July 2025"},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"body":"bootc ecosystem at DevConf.CZ and Flock to Fedora 2026\nJune was a busy month for the bootc community, with back-to-back\nconferences in the Czech Republic: Flock to\nFedora (June 14-16, Prague)\nand DevConf.CZ (June 18-19, Brno).\nBoth featured a strong presence of talks covering bootc, image-mode\nsystems, and the broader ecosystem. Here's a roundup of the\nrecordings and resources.\nDevConf.CZ 2026\nThe full DevConf.CZ 2026 schedule\n(including slides) is available on pretalx. Individual talk recordings\nare on the DevConf YouTube channel.\nHardening OS Distribution: Verifiable and sealed OS with bootc and composefs\n(Colin Walters, 35 min) — Covers the shift toward OCI-native OS\ndelivery using bootc and composefs, including a demo of deploying a\nsealed UKI composefs-backed system on RHEL 10.2. Related to the\nsealed images blog series\nhere on bootc.dev.\nThese bootc are made for mailin'\n(Michael Scherer, 36 min) — A practical walkthrough of combining bootc\nand Fedora Image Mode with the Stalwart mail server for a low-maintenance,\nself-hosted email stack running on the cheapest possible VM.\nLocal package layering on bootc systems with DNF5\n(Evan Goode, 26 min) — Explores the challenge of making dnf install\nwork on immutable bootc systems, introducing dnf rebuild, a new DNF5\nplugin that reconciles imperative package management with declarative\ncontainer workflows.\nForeman, Katello and bootable containers\n(Adam Růžička, 35 min) — How Foreman and Katello enable fleet\nmanagement across both traditional package-mode and the new image-mode\napproach, from image building through operational management.\nApplying CI/CD Patterns to Image Mode for RHEL\n(Alessandro Rossi, 27 min) — Practical examples of applying CI/CD\npractices to Image Mode for RHEL using Tekton, GitHub Actions, GitLab\nCI, Jenkins, and Ansible Automation Platform.\nFlock to Fedora 2026\nFlock sessions were recorded as room-level livestreams on the\nFedora Project YouTube channel.\nIndividual talk pages on the\nFlock schedule\nlink to slides and other resources.\nThe Future of Fedora Atomic: Unifying on Bootc and Shared Infrastructure\n(Hristo Marinov, BoF, 1h40) — A collaborative session discussing the\nroadmap for migrating Fedora Atomic deliverables (Silverblue, CoreOS,\netc.) to a bootc-based workflow, covering architectural shifts and\nbuild infrastructure changes.\nFedora bootc: Building and Operating Image-Based Systems\n(Gursewak Mangat, 25 min;\nslides)\n— A practical introduction to bootc for Fedora contributors,\ndemonstrating how bootc's container-native approach makes it easy to\ntest OS images in CI using standard container tooling (BCVK) before\ndeploying to production.\nFrom Compliance to Containers: Managing Fedora Fleets in the Atomic Era\n(Adam Baali and Jonathan Billings, 55 min) — Bridging compliance\nrequirements with immutable image-based systems like Silverblue,\nKinoite, and bootc, demonstrating transparent tooling for NIST\ncontrols.\nWhat's new in Fedora CoreOS in 2026?\n(Jean-Baptiste Trystram and Joel Capitao, 25 min) — Highlights from\nthe past year of Fedora CoreOS development, including OCI distribution\nmigration, bootc integration progress, and the move to\nbootc-image-builder.","id":"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/","title":"bootc ecosystem at DevConf.CZ and Flock to Fedora 2026"},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"body":"Video: sealed bootc with transient /etc and /var\nI recorded a short demo of the new composefs mount configuration\nsupport that landed in bootc#2201.\nThe PR adds a /usr/lib/bootc/setup-root-conf.toml file that image\nauthors can ship in their container image to control how the\ncomposefs-backed root filesystem is mounted at boot:\n[root] transient = true wraps the composefs lower in a tmpfs\noverlay, so all writes to / are discarded on reboot.\n[etc] mount = \"transient\"|\"overlay\"|\"bind\"|\"none\" controls how\n/etc is mounted from the deployment state directory.\n[var] mount = \"none\"|\"bind\" controls whether /var is\nbind-mounted from persistent state. When set to none, /var is left as an\nempty composefs directory, and systemd.volatile=state on the\nkernel command line causes bootc to automatically skip the bind-mount\nso systemd can place a fresh tmpfs there.\nThis builds directly on the\nsealed images series:\nwith a transient root and /etc, each boot starts from a clean,\nverified image with no persistent mutation to the OS layer.","id":"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/","title":"Video: sealed bootc with transient /etc and /var"},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"body":"Sealed images: the security chain from firmware to filesystem\nThis is the first in a series of posts about bootc sealed images. In\nthis post we'll take a tour through the full security chain that makes\nsealed images work, from the moment your system powers on through\nevery file read at runtime. Future posts will cover key management,\nbuilding sealed images, and deploying them to various environments.\nThe gap\nTypically a default Linux install comes \"unlocked\", allowing you to be\nroot and make persistent changes. While many distributions support\nSecure Boot, it's typically only the kernel that's signed. The\ncryptographic chain of trust from firmware doesn't cover the root\nfilesystem or applications - i.e. effectively everything you care\nabout.\nSealed images help close this gap by extending cryptographic\nverification from the firmware all the way through every file in the\noperating system. Not as a one-time check at boot, but continuously,\nat every file read, for the entire lifetime of the system.\nLet's walk through how each piece fits together.\nSecure Boot\nSecure Boot is the foundation of the chain. It's a UEFI firmware\nfeature that ensures only signed code runs during the boot process.\nThe firmware maintains a database of trusted keys. When the system\npowers on, the firmware loads the bootloader and checks its signature\nagainst those keys. If the signature is valid, the bootloader runs.\nIf not, the system refuses to boot.\nThis is well-established technology and not new to sealed images.\nWhat matters for our purposes is that Secure Boot gives us a root of\ntrust: a guarantee that the first piece of software to execute after\nthe firmware is something we explicitly chose to trust.\nUnified Kernel Images\nTraditionally, the boot chain after Secure Boot looks something like\nthis: the signed bootloader loads a kernel, an initramfs, and a kernel\ncommand line, often from separate files on a boot partition. The\nbootloader may verify the kernel's signature, but the initramfs and\ncommand line are typically not covered by any signature.\nA Unified Kernel Image (UKI)\nchanges this by bundling the kernel, the initramfs, and the kernel\ncommand line into a single EFI binary. The entire bundle is signed\nas one unit. This means the firmware (or a signed bootloader like\nsystemd-boot) can verify the whole thing in one step.\nThis is important for sealed images because the kernel command line\nis no longer an unverified input. Anything embedded in the command\nline is covered by the same signature that covers the kernel itself.\nAs we'll see next, this is where the composefs digest lives.\ncomposefs: EROFS + overlayfs + fs-verity\nHere's where things get interesting. composefs brings together\nthree kernel technologies to provide cryptographic verification of\nthe entire filesystem.\nWhen a sealed image is built, the operating system filesystem is\nprocessed into an\nEROFS metadata\nimage. This image describes every file, directory, symlink, and\npermission in the tree, but it does not contain the actual file\ncontents. Instead, each file entry in the EROFS image records the\nfs-verity\ndigest of that file's contents. The actual file data is stored\nseparately in a content-addressed object store, where each file has\nfs-verity enabled by the kernel.\nAt mount time, the kernel stitches these pieces together using\noverlayfs.\nThe EROFS image serves as a metadata layer, and the object store\nprovides the file data. The overlayfs verity=require mount option\ntells the kernel to enforce that every file served through the mount\nhas an fs-verity digest matching what the EROFS metadata expects.\nfs-verity itself is a kernel feature that provides per-file integrity\nverification. When fs-verity is enabled on a file, the kernel\ncomputes a cryptographic hash of the file's contents and stores a\nhash tree alongside the file on disk. From that point on, every\nread is verified at the block level -- the kernel checks only the\nblocks being read, not the entire file, and caches the results so\nrepeated reads don't pay the cost again.\nA key behavior to understand is what happens when verification\nfails: the kernel returns an I/O error. The corrupted or tampered\ndata is never served to any process. The open() call on the file\nsucceeds (the file exists, after all), but read() on the corrupted\nportion returns EIO. The data is simply unreadable.\nThe EROFS metadata image itself also has an fs-verity digest: a\nsingle cryptographic hash that covers the complete filesystem\ndescription. This is the composefs digest. It is embedded in the\nUKI's kernel command line:\nBecause the UKI is signed, this digest is now part of the verified\nboot chain. The firmware verifies the UKI signature, and the UKI\ncarries within it a cryptographic commitment to the exact filesystem\nthat should be mounted as the operating system.\nPutting it all together\nThe full chain looks like this. Each step must succeed before the\nnext can proceed:\nThe firmware verifies the signed bootloader.\nThe bootloader verifies the signed Unified Kernel Image (UKI).\nThe initramfs (inside the verified UKI) reads the composefs\ndigest from the kernel command line (also inside the verified UKI).\nThe initramfs mounts the composefs image and verifies the EROFS\nimage's fs-verity digest matches the digest from the command line.\nEvery subsequent file read from the operating system is\nindividually verified by the kernel against the fs-verity digest\nrecorded in the EROFS metadata.\nThere is no point after firmware where unverified code executes or\nunverified data is served. The chain is continuous.\nWhat sealed images cover\nIt's worth being precise about scope. The seal covers every file in\nthe immutable operating system image: the base OS, any packages you\nadded, your monitoring agents, security tools, application binaries.\nEverything that was part of the image when it was built is sealed.\nBy default, /etc and /var are mutable and persistent. It is\npossible to make /etc transient today, and this is a good idea if\nit matches your use case. More suggestions on this will be in the\ndocumentation.\nWhat's next\nThis post covered the architecture. In the next posts, we'll get\nhands-on:\nKey management: generating Secure Boot keys, enrolling them,\nand understanding the signing chain\nBuilding sealed images: writing a Containerfile, producing a\nsigned UKI, and verifying the result\nDeploying sealed images: installing to bare metal, virtual\nmachines, and cloud environments\nThe signing chain is fully under your control. You generate the keys,\nyou sign the images, you decide what your systems trust. The next\npost will show you how.","id":"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/","title":"Sealed images: the security chain from firmware to filesystem"},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"body":"Sealed images: key management for Secure Boot\nIn the previous post,\nwe walked through the security chain that sealed images provide, from\nfirmware through runtime file verification. That chain depends on\ncryptographic keys at every step. In this post, we'll cover the keys\ninvolved, how to generate them, and how they get enrolled into your\nsystem's firmware.\nThe UEFI Secure Boot key hierarchy\nUEFI Secure Boot uses a hierarchy of three key types, each serving a\ndistinct role:\nPlatform Key (PK) -- The root of the Secure Boot trust hierarchy.\nThere is exactly one PK. The PK controls who can modify the Secure\nBoot key databases. It is used to sign updates to the KEK database.\nWhen the PK is enrolled, the firmware transitions from Setup Mode to\nUser Mode, enabling Secure Boot enforcement.\nKey Exchange Key (KEK) -- One or more KEKs can be enrolled. A KEK\nis authorized to sign updates to the signature database (db). The\nKEK exists to allow delegation: the PK owner can authorize other\nparties to manage the set of trusted signing keys without giving them\nfull control over the Secure Boot configuration.\nSignature Database (db) -- The db contains the keys or hashes\nthat the firmware uses to verify boot binaries. When the firmware\nloads a bootloader or UKI, it checks the binary's signature against\nthe keys in the db. If the signature matches a db entry, the binary\nis allowed to execute.\nIn practice, many organizations will only need to generate a single\nset of these keys. The db key is the one that does the day-to-day\nwork: it signs your UKIs and bootloader. The PK and KEK exist\nprimarily to control who can modify the db.\nIf you already have Secure Boot keys provisioned in your\ninfrastructure, you don't need to generate new ones. You only need\naccess to a db key (or the ability to add your signing key to the\nexisting db) in order to sign your UKIs. The rest of this post\nassumes you're starting from scratch, but the signing steps apply\nregardless of where your keys came from.\nGenerating keys\nThe following commands generate a complete set of Secure Boot keys.\nThese examples use openssl directly, but you should use whatever\nkey management practices are appropriate for your organization.\nHardware security modules (HSMs), vault systems, or other key\nmanagement infrastructure may be more appropriate for production\nuse.\nFirst, generate a GUID to identify the key owner. This is embedded\nin the key enrollment data and can be any unique identifier:\nGenerate the Platform Key:\nGenerate the Key Exchange Key:\nGenerate the Signature Database key:\nEach command produces three files: a private key (.key), a PEM\ncertificate (.crt), and a DER-encoded certificate (.cer). The\nprivate keys are what you need to protect. The certificates are\npublic and are what gets enrolled into the firmware.\nSigning boot artifacts\nWith a db key in hand, you can sign the two boot binaries that need\nSecure Boot verification: the bootloader (systemd-boot) and the\nUnified Kernel Image.\nSigning systemd-boot:\nThe UKI signing process is more involved because the UKI embeds the\ncomposefs digest, which must be computed from the filesystem first.\nWe'll cover building sealed images (including UKI generation and\nsigning) in detail in the next post. For now, the important thing\nto know is that ukify (the tool that assembles UKIs) accepts the\nsame --secureboot-private-key and --secureboot-certificate\noptions and uses sbsign under the hood to sign the final EFI\nbinary.\nEnrolling keys into firmware\nThe keys need to be enrolled into the UEFI firmware's Secure Boot\ndatabase before the firmware will use them for verification. There\nare several ways to do this depending on your environment.\nManual enrollment via firmware setup\nMost UEFI firmware implementations provide a setup menu (accessed\nduring early boot, typically via a key like F2 or Del) where Secure\nBoot keys can be managed. The DER-encoded certificates (.cer\nfiles) can be enrolled from a USB drive or the EFI System Partition.\nThis is straightforward for individual systems but does not scale\nwell.\nProgrammatic enrollment for virtual machines\nFor virtual machines using OVMF (the open source UEFI firmware for\nQEMU/KVM), keys can be enrolled directly into the firmware variable\nstore using the virt-fw-vars tool from the\nvirt-firmware project:\nThis produces a firmware variable store with your keys pre-enrolled.\nWhen QEMU starts with this variable store, Secure Boot is active and\nwill only accept binaries signed with your db key. This is\nparticularly useful for testing and for VM-based deployments where\nyou control the firmware image.\nAuto-enrollment via systemd-boot\nsystemd-boot supports automatic key enrollment when the firmware is\nin Setup Mode (no Platform Key enrolled). This works by placing\nsigned UEFI authenticated variable files (.auth files) on the EFI\nSystem Partition.\nCreating .auth files requires converting your certificates into\nUEFI signature lists and signing them with the appropriate parent\nkey:\nThese .auth files can then be placed on the ESP where systemd-boot\nexpects them. bootc can automate this: if you place the .auth\nfiles in your container image at\n/usr/lib/bootc/install/secureboot-keys/<name>/, bootc will copy\nthem to the ESP during installation. On the next boot, systemd-boot\ncan enroll them into the firmware.\nThe enrollment behavior is controlled by the secure-boot-enroll\nsetting in loader.conf. See the\nsystemd-boot documentation\nfor details on the available modes.\nKey security considerations\nA few things worth keeping in mind:\nProtect your private keys. The .key files are what allow\nsigning boot artifacts. Anyone with access to your db private key\ncan sign binaries that your firmware will trust. Store private keys\nwith appropriate access controls, and consider using an HSM or key\nmanagement system for production deployments.\nKey rotation. The examples above use 10-year expiry (-days 3650), which is generous. Plan for key rotation before your\ncertificates expire. The UEFI key hierarchy makes this manageable:\nyou can use your KEK to authorize a new db key without needing to\nre-enroll the PK.\nSeparation of concerns. In a CI/CD pipeline, the signing step\nshould ideally be isolated from the build step. The build process\nproduces an unsigned UKI, and a separate signing service (with access\nto the private key) signs it. This limits the blast radius if the\nbuild environment is compromised.\nWhat's next\nWith keys generated and an understanding of how they fit into the\ntrust chain, the next post will walk through building a sealed image\nend-to-end: writing a Containerfile, computing the composefs digest,\ngenerating and signing the UKI, and producing a deployable container\nimage.","id":"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/","title":"Sealed images: key management for Secure Boot"},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"body":"Sealed images: building a sealed image\nIn the first post\nwe covered the security chain behind sealed images, and in the\nsecond post we\ngenerated the Secure Boot keys needed to sign our boot artifacts.\nNow it's time to put it all together and build a sealed image.\nA complete working example is available in the\nrhel-bootc-examples\nrepository under the\nsealing\ndirectory. This post walks through the key concepts behind that\nexample and explains why the build is structured the way it is.\nThe chicken-and-egg problem\nBuilding a sealed image has a complication that isn't immediately\nobvious. Recall from the first post that the composefs digest is\nembedded in the UKI's kernel command line, and the UKI lives in the\nimage under /boot. So we have a dependency cycle: we need the\nfilesystem to compute the composefs digest, but we need the digest\nto produce the UKI, and we need the UKI to finalize the filesystem.\nThe solution is a multi-stage container build. We build the base\nfilesystem first, without any UKI. Then in a separate stage, we\ncompute the composefs digest from that filesystem, generate and\nsign the UKI, and finally layer the UKI back on top of the base.\nThe UKI lives under /boot, which is not part of the composefs-\nmanaged root filesystem, so adding it doesn't change the digest.\nThe Containerfile\nThe\nContainerfile\nin the examples repository uses four stages. Let's walk through\neach one.\nStage 1: rootfs-builder\nThis starts from a CentOS Stream 10 bootc base image and installs\nthe tooling we need: systemd-ukify to build the UKI,\nsbsigntools to sign it, and systemd-boot-unsigned to provide\nthe bootloader binary. We remove bootupd because this example\nuses systemd-boot rather than bootupd + GRUB.\nThis stage also signs systemd-boot with our db key:\nNote the use of --mount=type=secret. The private key is mounted\ninto the build step but is never copied into any image layer. This\nis how we keep key material out of the final image.\nStage 2: flatten to a single layer\nThis stage copies the entire filesystem from stage 1 into a FROM scratch image, which flattens everything into a single layer.\nThis is important because the composefs digest is computed over\nthe complete filesystem tree. If the image had multiple layers,\nthe digest would depend on how those layers happened to be stacked,\nwhich could vary depending on the container runtime and storage\ndriver. (For more on why multi-layer images can produce\nnon-deterministic results, see the earlier post on\npitfalls of incomplete tar archives.)\nFlattening eliminates that variable.\nStage 3: generate and sign the UKI\nThis is where the magic happens. bootc container ukify does\nseveral things in one step:\nReads the filesystem at /target (the flattened base from\nstage 2, mounted via --mount=type=bind).\nComputes the composefs digest (a SHA-512 hash of the EROFS\nimage that describes the complete filesystem).\nDiscovers the kernel and initramfs from the filesystem.\nAssembles a UKI containing the kernel, initramfs, and a\ncommand line that includes composefs=<digest>.\nSigns the UKI with the db key via sbsign.\nThe result is a single .efi file that embeds a cryptographic\ncommitment to the exact filesystem it was built from, signed by\na key we control.\nA second RUN step then discovers the kernel version and places\nthe UKI at the expected path under /boot/EFI/Linux/.\nStage 4: the final image\nThe final image takes the flattened base and overlays the /boot\ndirectory from the kernel stage. This gives us a complete image:\nthe sealed root filesystem plus the signed UKI that references it.\nBuilding the image\nWith the Containerfile and keys in place, building the image is a\nsingle podman build command:\nThe two --secret flags make the db private key and certificate\navailable to the build stages that need them, without ever\npersisting them in the image.\nIf you're using the examples repository, the\nJustfile\nwraps this for convenience:\nSecret handling in CI\nThe examples repository includes a GitHub Actions workflow\nthat demonstrates how to handle key material in CI. The db private\nkey is stored as a GitHub Actions secret and written to a temporary\nfile during the build.\nFor pull request builds, where the secret is not available, the\nworkflow generates an ephemeral key pair on the fly. This allows\nPRs to validate that the build works without requiring access to\nproduction key material.\nWhat's next\nAt this point we have a sealed, signed container image. The UKI\ninside is signed with our Secure Boot key and embeds a composefs\ndigest that covers every file in the operating system. In the\nnext post, we'll deploy this image to a system and verify the\nseal is active.","id":"https://bootc.dev/blog/2026-may-06-sealed-images-building/","title":"Sealed images: building a sealed image"},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"body":"Sealed images: deploying and verifying a sealed image\nIn the previous post\nwe built a sealed, signed container image. Now it's time to deploy\nit to a virtual machine and verify that the full security chain is\nactive.\nbcvk: a tool for running bootc VMs\nbcvk (bootc virtualization kit)\nis a tool that makes it easy to run bootc container images as virtual\nmachines. Under the hood, it calls bootc install to-disk to create\na bootable disk image, then manages the VM lifecycle via libvirt.\nFor sealed images, bcvk also handles Secure Boot key enrollment into\nthe VM's UEFI firmware automatically using\nvirt-firmware.\nbcvk is available as a package on Fedora and EPEL:\nDeploying the image\nWith the sealed image built from the previous post and keys generated\nfrom the key management post, deploying is a single command:\nLet's break down what's happening here:\n--filesystem=ext4 tells bootc install to use ext4 for the root\nfilesystem. The default root filesystem may be XFS, which does not\nsupport fs-verity, so we explicitly select ext4 here. (fs-verity\nis supported on ext4 and btrfs.)\n--secure-boot-keys target/keys points bcvk to the directory\ncontaining our PK, KEK, and db certificates. bcvk uses\nvirt-fw-vars to enroll these keys into a copy of the OVMF\nfirmware variable store, so the VM boots with Secure Boot enabled\nand configured to trust our signing key.\n--ssh-wait tells bcvk to wait until SSH is available before\nreturning, so we know the system has fully booted.\nIf you're using the\nexamples repository,\nthis is wrapped up in a convenient just recipe:\nThis builds the image, boots the VM, waits for it to reach\nmulti-user.target, and opens an interactive SSH session.\nVerifying the seal\nOnce the system is booted and we have an SSH session, we can verify\nthat the full security chain is active.\nCheck the kernel command line\nThe presence of composefs=<digest> in the kernel command line\nconfirms that the initramfs received the composefs digest from the\nsigned UKI. This is the digest that was computed during the build\nand embedded in the UKI's command line section.\nCheck the root mount\nThe key thing to look for is verity=require in the mount options.\nThis confirms that the kernel is enforcing fs-verity verification\non every file access through the composefs mount. Any file in the\noperating system whose content doesn't match its expected fs-verity\ndigest will produce an I/O error when read.\nCheck Secure Boot status\nThis confirms that the firmware verified the bootloader and UKI\nsignatures before allowing them to execute.\nWhat this tells us\nThese three checks together confirm the full chain from the\nfirst post:\nSecure Boot verified the bootloader and UKI (mokutil --sb-state)\nThe UKI delivered the composefs digest to the initramfs\n(/proc/cmdline)\nThe kernel is enforcing per-file verification against that digest\n(verity=require)\nWhat happens if something is tampered with?\nIt's worth understanding why tampering with a sealed system is\ndifficult in practice.\nThe operating system files are stored in a content-addressed object\nstore on disk. Each object has fs-verity enabled, which means the\nkernel has recorded a cryptographic hash of its contents. The files\nare immutable: you cannot write to an fs-verity protected file. Any\nattempt to open a verity-protected file for writing will fail.\nEven if an attacker were to bypass the filesystem and corrupt data\ndirectly on the underlying block device, the kernel would detect\nthe corruption. When a process attempts to read the tampered file,\nthe kernel verifies the data against the stored hash before\nreturning it. If the data doesn't match, the read fails with\nEIO. The corrupted data is never served to any process.\nThis is a meaningful distinction from a system where tampered files\nare silently served. On a sealed system, corruption doesn't go\nunnoticed -- it causes an immediate, visible failure.\nConclusion\nOver the course of this series, we've walked through the complete\nlifecycle of a sealed image:\nThe security chain\nfrom firmware to filesystem that makes sealed images possible\nKey management\nfor generating and enrolling Secure Boot keys\nBuilding a sealed image\nwith a multi-stage container build\nDeploying and verifying the seal (this post)\nThe complete working example is available in the\nrhel-bootc-examples\nrepository under the\nsealing\ndirectory.","id":"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/","title":"Sealed images: deploying and verifying a sealed image"}},"docInfo":{"https://bootc.dev/":{"body":234,"title":1},"https://bootc.dev/about/":{"body":7,"title":2},"https://bootc.dev/about/about/":{"body":43,"title":0},"https://bootc.dev/about/adopters/":{"body":0,"title":1},"https://bootc.dev/about/changelog/":{"body":0,"title":1},"https://bootc.dev/about/contributing/":{"body":0,"title":1},"https://bootc.dev/about/governance/":{"body":0,"title":1},"https://bootc.dev/about/maintainers/":{"body":0,"title":1},"https://bootc.dev/about/security/":{"body":0,"title":1},"https://bootc.dev/blog/":{"body":0,"title":1},"https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/":{"body":936,"title":5},"https://bootc.dev/blog/2025-july-11-community-meeting/":{"body":120,"title":7},"https://bootc.dev/blog/2025-july-18-community-meeting/":{"body":200,"title":7},"https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/":{"body":356,"title":6},"https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/":{"body":103,"title":6},"https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/":{"body":655,"title":6},"https://bootc.dev/blog/2026-may-05-sealed-images-key-management/":{"body":691,"title":6},"https://bootc.dev/blog/2026-may-06-sealed-images-building/":{"body":473,"title":5},"https://bootc.dev/blog/2026-may-07-sealed-images-deploying/":{"body":452,"title":6}},"length":19},"lang":"English"} \ No newline at end of file diff --git a/sitemap.xml b/sitemap.xml new file mode 100644 index 0000000..f72cbf3 --- /dev/null +++ b/sitemap.xml @@ -0,0 +1,69 @@ + + + + https://bootc.dev/ + + + https://bootc.dev/about/ + + + https://bootc.dev/about/about/ + + + https://bootc.dev/about/adopters/ + + + https://bootc.dev/about/changelog/ + + + https://bootc.dev/about/contributing/ + + + https://bootc.dev/about/governance/ + + + https://bootc.dev/about/maintainers/ + + + https://bootc.dev/about/security/ + + + https://bootc.dev/blog/ + + + https://bootc.dev/blog/2025-dec-15-blog-containers-pitfalls-of-incomplete-tar-archives/ + 2025-12-15 + + + https://bootc.dev/blog/2025-july-11-community-meeting/ + 2025-07-11 + + + https://bootc.dev/blog/2025-july-18-community-meeting/ + 2025-07-18 + + + https://bootc.dev/blog/2026-jul-07-conference-talks-devconf-flock-2026/ + 2026-07-07 + + + https://bootc.dev/blog/2026-jun-05-transient-root-etc-var/ + 2026-06-05 + + + https://bootc.dev/blog/2026-may-04-sealed-images-security-chain/ + 2026-05-04 + + + https://bootc.dev/blog/2026-may-05-sealed-images-key-management/ + 2026-05-05 + + + https://bootc.dev/blog/2026-may-06-sealed-images-building/ + 2026-05-06 + + + https://bootc.dev/blog/2026-may-07-sealed-images-deploying/ + 2026-05-07 + +