Simple solution to create a non-root partition image?

Simple solution to create a non-root partition image?

[Michael Opdenacker]

Greetings,

For an ongoing project with a read-only root filesystem, I'd like to 
create an image for a non-root partition.

To give you some context, this partition would contain data and scripts 
to be used at first boot to do per device provisioning work. Some of 
these would be removed after provisioning, as they could tip attackers 
about how secrets are stored if they get their hands on devices that 
haven't been provisioned yet. Hence, these cannot be in the read-only 
root filesystem.

To create such an image, I tried to create a new image recipe inheriting 
the "image" class, and then install some packages into the image with a 
"local" IMAGE_INSTALL list.

This seems it could work, but I'm struggling with removing dependencies 
(bootloader, kernel, etc) that are only relevant for a root filesystem 
image.

Would there be a simpler way to create a non root partition image?

Thanks in advance
Cheers
Michael.


-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

Re: [yocto] Simple solution to create a non-root partition image?

[Quentin Schulz]

Hi Michael,

On 5/3/26 10:40 PM, Michael Opdenacker via lists.yoctoproject.org wrote:
> Greetings,
> 
> For an ongoing project with a read-only root filesystem, I'd like to 
> create an image for a non-root partition.
> 
> To give you some context, this partition would contain data and scripts 
> to be used at first boot to do per device provisioning work. Some of 
> these would be removed after provisioning, as they could tip attackers 
> about how secrets are stored if they get their hands on devices that 
> haven't been provisioned yet. Hence, these cannot be in the read-only 
> root filesystem.
> 
> To create such an image, I tried to create a new image recipe inheriting 
> the "image" class, and then install some packages into the image with a 
> "local" IMAGE_INSTALL list.
> 
> This seems it could work, but I'm struggling with removing dependencies 
> (bootloader, kernel, etc) that are only relevant for a root filesystem 
> image.
> 
> Would there be a simpler way to create a non root partition image?
> 

Do you need to generate an image for that partition or can you simply 
have what will be part of that partition be generated along with the 
"root partition" image?

As far as I remember, wic can split files/directories into a separate 
partition from the rootfs, so that would be an option that doesn't 
require hacking things around.

Cheers,
Quentin

Re: [yocto] Simple solution to create a non-root partition image?

[Michael Opdenacker]

Hi Quentin,

Thanks a lot for the tip!

On 5/4/26 10:47 AM, Quentin Schulz wrote:
> Do you need to generate an image for that partition or can you simply 
> have what will be part of that partition be generated along with the 
> "root partition" image?
>
> As far as I remember, wic can split files/directories into a separate 
> partition from the rootfs, so that would be an option that doesn't 
> require hacking things around.
Interesting! Unfortunately, I'm not using Wic but Toradex Easy Installer 
on this project. Therefore I do need to generate a partition image 
beforehand.
Thanks anyway! I good to know for another time.
Cheers
Michael.--

Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

Re: [yocto] Simple solution to create a non-root partition image?

[Quentin Schulz]

Hi Michael,

On 5/4/26 3:08 PM, Michael Opdenacker wrote:
> Hi Quentin,
> 
> Thanks a lot for the tip!
> 
> On 5/4/26 10:47 AM, Quentin Schulz wrote:
>> Do you need to generate an image for that partition or can you simply 
>> have what will be part of that partition be generated along with the 
>> "root partition" image?
>>
>> As far as I remember, wic can split files/directories into a separate 
>> partition from the rootfs, so that would be an option that doesn't 
>> require hacking things around.
> Interesting! Unfortunately, I'm not using Wic but Toradex Easy Installer 
> on this project. Therefore I do need to generate a partition image 
> beforehand.

I am not familiar with Toradex Easy Installer but I'm not sure it's 
relevant here? Isn't that simply a glorified dd/bmaptool/balena-etcher?

wic will generate an ISO file if you will. It'll have a partition table 
and possibly multiple partitions within that ISO file. When you flash a 
.wic file, you'll flash the partition table and everything else. See in 
meta-rockchip, we use this Wic KickStart file 
https://git.yoctoproject.org/meta-rockchip/tree/files/wic/rockchip.wks

You can see we declare *many* different partitions, with different 
context (the example is mostly for flashing specific binaries at 
specific offset).

If wic doesn't already install the filesystem it generates for the 
partition, I'm assuming you could extract it from the final image if 
this is really something you need extracted.

Cheers,
Quentin

Re: [yocto] Simple solution to create a non-root partition image?

[Cleiton Bueno]

[-- Attachment #1: Type: text/plain, Size: 1826 bytes --]

Wouldn't enabling the TEZI_DATA_ENABLED variable and using this extra
partition work?

https://git.toradex.com/meta-toradex-bsp-common.git/tree/classes/image_type_tezi.bbclass?h=scarthgap-7.x.y#n37

I already needed to create a class for a client with 2 additional
partitions and I made a copy of image_type_tezi.bbclass and customized it
for my client.

And create an .ext4 file and put it in this partition?

Em seg., 4 de mai. de 2026 às 10:08, Michael Opdenacker via
lists.yoctoproject.org <michael.opdenacker=
rootcommit.com@lists.yoctoproject.org> escreveu:

> Hi Quentin,
>
> Thanks a lot for the tip!
>
> On 5/4/26 10:47 AM, Quentin Schulz wrote:
> > Do you need to generate an image for that partition or can you simply
> > have what will be part of that partition be generated along with the
> > "root partition" image?
> >
> > As far as I remember, wic can split files/directories into a separate
> > partition from the rootfs, so that would be an option that doesn't
> > require hacking things around.
> Interesting! Unfortunately, I'm not using Wic but Toradex Easy Installer
> on this project. Therefore I do need to generate a partition image
> beforehand.
> Thanks anyway! I good to know for another time.
> Cheers
> Michael.--
>
> Root Commit
> Embedded Linux Training and Consulting
> https://rootcommit.com
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#66470):
> https://lists.yoctoproject.org/g/yocto/message/66470
> Mute This Topic: https://lists.yoctoproject.org/mt/119133286/10388955
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [
> cleiton.bueno@b2open.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>

-- 
Cleiton Bueno
B2Open Systems

[-- Attachment #2: Type: text/html, Size: 3093 bytes --]

Re: [yocto] Simple solution to create a non-root partition image?

[Michael Opdenacker]

Hi Cleiton

On 5/4/26 3:39 PM, Cleiton Bueno wrote:
> Wouldn't enabling the TEZI_DATA_ENABLED variable and using this extra 
> partition work?
>
> https://git.toradex.com/meta-toradex-bsp-common.git/tree/classes/image_type_tezi.bbclass?h=scarthgap-7.x.y#n37
>
> I already needed to create a class for a client with 2 additional 
> partitions and I made a copy of image_type_tezi.bbclass and customized 
> it for my client.
>
> And create an .ext4 file and put it in this partition?

Absolutely! That's exactly what I intend to do.
I've also tweaked image_type_tezi.bbclass to fit my project needs (a 
boot partition, two rootfilesystems and two extra partitions).
Thanks for contributing to this discussion!
Cheers
Michael.

-- 

Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

Re: [yocto] Simple solution to create a non-root partition image?

[Michael Opdenacker]

Hi Cleiton

On 5/4/26 3:39 PM, Cleiton Bueno via lists.yoctoproject.org wrote:
> Wouldn't enabling the TEZI_DATA_ENABLED variable and using this extra 
> partition work?
>
> https://git.toradex.com/meta-toradex-bsp-common.git/tree/classes/image_type_tezi.bbclass?h=scarthgap-7.x.y#n37
>
> I already needed to create a class for a client with 2 additional 
> partitions and I made a copy of image_type_tezi.bbclass and customized 
> it for my client.
That's exactly what I did to have extra partitions :)
>
> And create an .ext4 file and put it in this partition?
Well, ultimately, it was easier to create a tar archive and set 
TEZI_DATA_FILES to this new archive.
This is more flexible than setting a fixed size ext4 image. I let Tezi 
format the partition with ext4 and extra the archive into it, just like 
what is done for the root filesystem.

Thanks for your contribution to this thread!
Cheers
Michael.

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

Re: [yocto] Simple solution to create a non-root partition image?

[Michael Opdenacker]

[-- Attachment #1: Type: text/plain, Size: 1063 bytes --]

Hi Ming

On 5/4/26 3:14 PM, Iain Menzies-Runciman wrote:
> Hi Michael,
>
> If it is any use I have just created an article based on this concept, 
> as I have had to do similar for one of my clients:
>
> Populating a Partition 
> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
> siliconbladeconsultants.com 
> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
> 	favicon.ico 
> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/> 
>
>
> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
>
> In essence, I create an ext4 image in my recipe and then you can do 
> whatever you need with it (such as for me - write it to my wic file)

What a nice coincidence... You just wrote that article!
This sounds like a very simple and elegant solution for my needs. I 
Actually just have a few files and scripts to drop in this filesystem.

Thanks a lot!
Cheers
Michael.

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

[-- Attachment #2.1: Type: text/html, Size: 5515 bytes --]

[-- Attachment #2.2: favicon.ico --]
[-- Type: image/x-icon, Size: 1768 bytes --]

Re: [yocto] Simple solution to create a non-root partition image?

[Francesco Cervigni]

[-- Attachment #1: Type: text/plain, Size: 1620 bytes --]

Hi Michael,

Would a non-yocto process, so non-wic, approach might still be relevant as generic inspiration ?
There is a part of the script of Photonicat2 router image creation (Rockchip rk3568, Debian, not my code) that I have looked at often.

In a pretty readable and straightforward sequence of lines it assembles the disk with the use of sfdisk + manual adiddtions via dd . (that whole small repo is very explicit and simple in what it does, good read imho)
https://github.com/photonicat/rockchip_rk3568_linux_mainline/blob/master/build-image-custom-rootfs-full.sh#L57

What caught my eyes, also, is that in that case sfdisk is used declaratively, where the partition description is kept separatedly at https://github.com/photonicat/rockchip_rk3568_linux_mainline/blob/master/scripts/photonicat-disk-parts-full.sfdisk allowing for easier extension, as the .wic ones.

Furthermore: In regards to 'moving the files' from folder to the partition, that code uses explicit 'mount' steps. Although via ' guestfish ' from red-hat one could make it with more idiomatic one-liners (it mounts internally via libguestfs, also can explore images interactively, very nice examples are available. Warning: I have used guestfish only for non-roofs partitions, where file rights are simpler.)

I agree that the wic approach is probably the more Yocto-aligned one for the final solution, as it is the tool of choice, adding these examples more as references for CLI image manipulation/debugging.

Have a great day,

Francesco Cervigni
Neoncomputing
Embedded IIoT - Chambery, France
f.cervigni@neoncomputing.com

[-- Attachment #2: Type: text/html, Size: 2282 bytes --]

Re: [yocto] Simple solution to create a non-root partition image?

[Michael Opdenacker]

[-- Attachment #1: Type: text/plain, Size: 1341 bytes --]

Hi Ming

On 5/4/26 3:27 PM, Michael Opdenacker wrote:
>
> Hi Ming
>
> On 5/4/26 3:14 PM, Iain Menzies-Runciman wrote:
>> Hi Michael,
>>
>> If it is any use I have just created an article based on this 
>> concept, as I have had to do similar for one of my clients:
>>
>> Populating a Partition 
>> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
>> siliconbladeconsultants.com 
>> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
>> 	favicon.ico 
>> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/> 
>>
>>
>> <https://www.siliconbladeconsultants.com/articles/20260502-populate-partitions/>
>>
>> In essence, I create an ext4 image in my recipe and then you can do 
>> whatever you need with it (such as for me - write it to my wic file)
>
> What a nice coincidence... You just wrote that article!
> This sounds like a very simple and elegant solution for my needs. I 
> Actually just have a few files and scripts to drop in this filesystem.
>
I eventually used your idea to create a tar archive instead, which I 
then fed to Toradex Easy Installer (that's what the project currently used).
That was a very simple and elegant solution. Thanks again!
Cheers
Michael.

-- 
Root Commit
Embedded Linux Training and Consulting
https://rootcommit.com

[-- Attachment #2.1: Type: text/html, Size: 6232 bytes --]

[-- Attachment #2.2: favicon.ico --]
[-- Type: image/x-icon, Size: 1768 bytes --]

Re: [yocto] Simple solution to create a non-root partition image?

[Francesco Valla]

Hi Michael,

On Sun, May 03, 2026 at 10:40:02PM +0200, Michael Opdenacker wrote:
> Greetings,
> 
> For an ongoing project with a read-only root filesystem, I'd like to create
> an image for a non-root partition.
> 
> To give you some context, this partition would contain data and scripts to
> be used at first boot to do per device provisioning work. Some of these
> would be removed after provisioning, as they could tip attackers about how
> secrets are stored if they get their hands on devices that haven't been
> provisioned yet. Hence, these cannot be in the read-only root filesystem.
> 
> To create such an image, I tried to create a new image recipe inheriting the
> "image" class, and then install some packages into the image with a "local"
> IMAGE_INSTALL list.
> 
> This seems it could work, but I'm struggling with removing dependencies
> (bootloader, kernel, etc) that are only relevant for a root filesystem
> image.
> 

in case you need to have a "full" filesystem, which not only includes
the provisioning tools but e.g. also their dependencies that you don't
want to include in the rootfs, an option might be mimic'ing what is done
for the initramfs [1]:

IMAGE_FEATURES = ""
IMAGE_LINGUAS = ""
PACKAGE_INSTALL = " \
        foo \
        bar \
        baz \
"

PACKAGE_EXCLUDE = "kernel-image-*"

IMAGE_NAME_SUFFIX ?= ""

inherit image


Note there the usage of PACKAGE_INSTALL instead of IMAGE_INSTALL.

[1] https://git.openembedded.org/openembedded-core/tree/meta/recipes-core/images/core-image-initramfs-boot.bb?h=styhead

> Would there be a simpler way to create a non root partition image?
> 
> Thanks in advance
> Cheers
> Michael.

Regards,
Francesco

Re: [yocto] Simple solution to create a non-root partition image?

[Felix Mellmann]

Am 2026-05-03 22:40, schrieb Michael Opdenacker:
> Greetings,
> 
> For an ongoing project with a read-only root filesystem, I'd like to 
> create an image for a non-root partition.
> 

Within my projects I split up the TAR balls by their mounting point and 
then use these archives for further processing.
The main reason for me was to use RAUC with multiple images per slot (a 
customer urged me to split up /var from / ).

Create classes-recipe/foo-image-types.bbclass:

# tar file which only covers /storage
IMAGE_CMD:storage.tar = "${IMAGE_CMD_TAR} --sort=name --format=posix 
--numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}.storage.tar -C 
${IMAGE_ROOTFS}/storage . || [ $? -eq 1 ]"
# tar file which only covers /var
IMAGE_CMD:var.tar = "${IMAGE_CMD_TAR} --sort=name --format=posix 
--numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}.var.tar -C 
${IMAGE_ROOTFS}/var . || [ $? -eq 1 ]"

# tar file which covers the whole root filesystem except of the 
separated archives above
IMAGE_CMD:remaining.tar = "${IMAGE_CMD_TAR} --sort=name --format=posix 
--numeric-owner -cf ${IMGDEPLOYDIR}/${IMAGE_NAME}.remaining.tar -C 
${IMAGE_ROOTFS} --exclude='./storage/*' --exclude='./var/*' . || [ $? 
-eq 1 ]"

Use a custom image recipe, i.e. "foo-image.bb":

SUMMARY = "Foo image"

inherit core-image

IMAGE_CLASSES += "foo-image-types"
IMAGE_FSTYPES = "storage.tar.xz var.tar.xz remaining.tar.xz"

IMAGE_INSTALL:append = " \
     packagegroup-foo \
"

When you build "foo-image" instead of 
"foo-image-foo-machine.rootfs.tar.xz" you'll get 
"foo-image-foo-machine.rootfs.storage.tar.xz", 
"foo-image-foo-machine.rootfs.var.tar.xz" and 
"foo-image-foo-machine.rootfs.remaining.tar.xz" which you can use in 
further stages (i.e. build RAUC bundle). I don't know if those images 
can be integrated within WIC, as I don't use it, but maybe something 
like this work within a custom WKS file:

part / --source rootfs.remaining [...]
part /storage --source rootfs.storage [...]
part /var --source rootfs.var [...]


With such a setup you can do whatever you like with your partitions 
(mount some of them read-only, apply overlay, share them between A/B 
setups, ...) and build your application recipes independent from 
architectural decision and still allow updating system and application 
packages which span multiple partitions within the field by either using 
a package manager or RAUC.

Good luck,
Felix

> To give you some context, this partition would contain data and scripts 
> to be used at first boot to do per device provisioning work. Some of 
> these would be removed after provisioning, as they could tip attackers 
> about how secrets are stored if they get their hands on devices that 
> haven't been provisioned yet. Hence, these cannot be in the read-only 
> root filesystem.
> 
> To create such an image, I tried to create a new image recipe 
> inheriting the "image" class, and then install some packages into the 
> image with a "local" IMAGE_INSTALL list.
> 
> This seems it could work, but I'm struggling with removing dependencies 
> (bootloader, kernel, etc) that are only relevant for a root filesystem 
> image.
> 
> Would there be a simpler way to create a non root partition image?
> 
> Thanks in advance
> Cheers
> Michael.
> 
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#66467): 
> https://lists.yoctoproject.org/g/yocto/message/66467
> Mute This Topic: https://lists.yoctoproject.org/mt/119133286/8090339
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub 
> [flix.yocto@benfm.de]
> -=-=-=-=-=-=-=-=-=-=-=-