Hadron Layers

How to consume these layers and system extensions

As a layer in a Hadron image

Copy the layer into your own image. The layer is FROM scratch and holds only runtime binaries and shared libraries, so the whole filesystem goes in at the root.

FROM ghcr.io/kairos-io/hadron:VERSION
COPY --from=ghcr.io/kairos-io/hadron-layers/git:latest / /

Use the digest-pinned reference from a layer card below instead of a tag when you want a reproducible build.

As a system extension on a running Kairos node

Every compatible layer also publishes a .sysext.raw system extension. This page's releases.json is the catalog Kairos searches by default, so a bare name is enough:

kairos-agent sysext install fwupd
kairos-agent sysext enable --active --now fwupd
kairos-agent sysext list

Pass --version for an exact version or a semver constraint, or install a digest-pinned artifact directly with the oci:// reference each card shows:

kairos-agent sysext install --version ">= 2.1, < 3" fwupd

At install time, from a cloud config

install.extensions takes the same names, versions and references, and installs them onto the node the installer writes.

#cloud-config
install:
  extensions:
    - fwupd
    - gpg@2.4.9
extensions:
  ignore_signatures: true

These artifacts are unsigned: they are built for any deployment, and Trusted Boot signatures belong to yours. A default Kairos node refuses to merge an extension systemd cannot verify, so it is downloaded, enabled and then silently not active. Set extensions.ignore_signatures: true to accept them, or re-sign the raw image with your own keys, which is the only option under Trusted Boot.

To resolve names against your own index instead, list it under extensions.catalogs (or pass --catalog); the catalogs are searched in order and the first one publishing the name wins.