The ostree-repo-in-container model is simple to implement and easy to explain, but it can also be quite opaque to people, requiring anyone looking at to be an expert in both containers and ostree and RPM.

One thing we could do would be to do something "rojig" like - make the oscontainer just look like a regular container (perhaps with tweaks), and add the extra data into the container JSON - flatpak's OCI bits do something like this.

My main concern here is around SELinux and xattrs - while container images support this, since there's no other use case for shipping labels in container images, they may get corrupted/lost? But OTOH the whole Docker/OCI ecosystem relies utterly on shipping container images "pristine" because the checksum is over compressed data.

In theory this would let us support people doing in a Dockerfile:

FROM quay.io/openshift/machine-os-content
COPY /path/to/crio.rpm /tmp
RUN rpm -Uvh /tmp/crio.rpm

We'd just need to have rpm-ostree perform labeling for any unlabeled files...i.e. rather than having pivot/MCD pass the content of the filesystem to something more like ostree commit rather than just doing a pull.