Discuss enabling rpm-ostree cliwrap

[bgilbert]

This is a pointer issue for coreos/fedora-coreos-config#830 to raise visibility. That PR proposes to replace the dracut, grubby, and rpm commands with wrappers that don't allow modifying the system.

I'm locking this issue; please discuss in the above-linked PR.

[jlebon]

(Cross-posting)

This was discussed in the community meeting:

AGREED: We will turn on cliwrap in the FCOS next stream to gain feedback. We will document it, and send an email to coreos-status. We will file an f35 Change before turning it on on all streams (as well as possibly other rpm-ostree variants like FSB and IoT).

[prestist]

We talked about his in the meeting today:
AGREED: Enable cliwrap with f40 rebase; Additionally communicate this to our users by updating https://github.com/coreos/fedora-coreos-tracker/issues/1655 (@spresti:fedora.im, 17:09:05)

[jlebon]

Note coreos/fedora-coreos-config#2887 changes the proposal so that we only wrap dnf since that's the one we care most about (and kernel-install, until coreos/rpm-ostree#4726 is fixed). As previously discussed, wrapping other commands that already exist in the OS is confusing and can cause (and already has caused) issues.

[jlebon]

Instead of this, I now propose #1687.

[jlebon]

Instead of this, I now propose #1687.

Another reason why the cliwrap path is not great that became more obvious as I dug into it is that the CLI is far from parity. dnf install works, but for replacing existing packages, you'd still have to do rpm-ostree override replace (i.e. rpm-ostree still tries to maintain the distinction it makes client-side between layering and overriding -- this information would be nice to maintain in the derivation flow, but a nicer way to do that is at the container image layer level instead). We could fix that of course, but if we agree to ship dnf anyway eventually then it doesn't seem like the best use of our time.

[jlebon]

Closing in favour of #1687.