F37: CHANGE: Enable read only /sysroot for Fedora Silverblue & Kinoite

[dustymabe]

For the proposed Fedora 37 changes we decided to discuss further the following change:

• Enable read only /sysroot for Fedora Silverblue & Kinoite
  • This change is about enabling an opt-in ostree feature that re-mounts /sysroot as read only to avoid accidental changes.
  • Tracking bug: #2060976
  • NOTES: LB: we did this in FCOS early on, but we never migrated older instances

[dustymabe]

as noted by jlebon in #1222 (comment):

A similar issue exists in FCOS BTW: the first official FCOS stable release was January 11, 2020. It did not ship with read-only sysroot. That came in May/June 2020. So we have potentially really old FCOS stable nodes provisioned in those first 5-6 months (and of course testing too, which started even earlier) which today still don't have read-only sysroot.

It'd be nice to have some stats to know how many such nodes exist, but it likely isn't worth the effort/risk to try migrating them. Maybe instead we can add a CLHM dropin which suggests reprovisioning if read-only sysroot isn't active?

[dustymabe]

👍 for CLHM helper.

[travier]

The PR for Silverblue & Kinoite is in https://pagure.io/workstation-ostree-config/pull-request/277 (reviews are appreciated). We can re-use code or commands to write a CLHM helper or do something else.

[travier]

Moved to coreos/console-login-helper-messages#118. Closing this one.