how intentional is the added continue? Should we not create /boot if it doesn't exist? Or is that an error? How about /sysroot?

I was trying to avoid introducing a new failure if somehow the image didn't have /sysroot. Now that I look more closely it seems the code is trying to make it optional here:
https://github.com/containers/composefs-rs/blob/78d9ec3e78ee1f8d83bab79c09e60cbcf85937f3/crates/composefs-setup-root/src/main.rs#L254

The only rationale I can think of for not making it mandatory is to support having it be somewhere else (say /run/physical-root or something), but I think someone would have to have some decent motivation for that.

So I can change both here and the mount code to make it mandatory?

And then it makes sense in the code to have /boot be mandatory too.

That said, there is I think a rationale for having that be configurable; the spec argues for mounting the ESP at /efi, not /boot/efi.

Last I heard you're supposed to put the ESP at /boot unless there's also an xloader or whatever partition. So /boot is always mandatory, imho.

I agree that /sysroot could be optional and we do indeed go out of our way to support not mounting it if the mountpoint is missing. On the other hand, Repository (and cfsctl) assume that /sysroot/composefs/ is the location of the "system" repository. Moving that around is just causing ourselves grief for no good reason.

If we did want another (fixed) spot for this under /run I'd consider that to be interesting, but it would complicate things: the distro expects to mount its own tmpfs for /run (or move the one from the initramfs environment?) after (or before?) /sbin/init is started... the fact that I don't know the answer to either of those questions is an indication that we might not want to rely on this...

Also: everyone knows what /sysroot is. Maybe the ship has sailed on moving this one.

But: if someone wants it to be optional to avoid having that mount by default, I think that's legit...

Last I heard you're supposed to put the ESP at /boot unless there's also an xloader or whatever partition.

Yeah you're right, see https://uapi-group.org/specifications/specs/boot_loader_specification/#mount-points

But that's mostly talking about the client state which is different from the container image state. Eh I think we can just require /boot/efi in the container image, not the end of the world. (But of course this touches on our debate about masking all of /boot vs just very surgically targeting /usr/lib/modules/$UNAME/*.efi but...yes)

OK so...I updated things to make both required and empty both.

I think we'll never have /boot/efi in the root filesystem, though, right? /boot will come from the boot partition (either xbootldr or efi) and efi may be a subdirectory of that (but even that is deprecated, from what I understand)... So we'd certainly never demand for /boot/efi to be part of the container image...