rocinante

Custom Bluefin / Aurora image with 1Password, Homebrew, Incus, Ghostty, and YubiKey support.

Built using the finpilot pattern. Available in GNOME (Bluefin), GNOME + NVIDIA, and KDE Plasma (Aurora) variants.

Installation

# GNOME (Bluefin)
sudo bootc switch ghcr.io/allardvdb/rocinante

# GNOME + NVIDIA
sudo bootc switch ghcr.io/allardvdb/rocinante-nvidia

# KDE Plasma (Aurora)
sudo bootc switch ghcr.io/allardvdb/rocinante-aurora

Release Streams

Images are published in three release streams:

Stream	Tag	Purpose
stable	:stable	Daily drivers — manually promoted via GitHub Release
testing	:testing	Pre-release soak — promoted via GitHub pre-release
latest	:latest	Bleeding edge — every push to main and daily cron

Each stream also has date-pinned tags (e.g., :stable.20260311) for rollback.

Switching streams

ujust switch-stream

Or manually:

sudo bootc switch ghcr.io/allardvdb/rocinante:stable --enforce-container-sigpolicy

Image references

ghcr.io/allardvdb/rocinante:stable
ghcr.io/allardvdb/rocinante-nvidia:stable
ghcr.io/allardvdb/rocinante-aurora:stable

Replace :stable with :testing or :latest as needed.

First-Time Setup

ujust first-run

Individual recipes:

• ujust switch-stream — Switch between stable/testing/latest release streams
• ujust setup-1password-browser — Flatpak browser integration
• ujust setup-yubikey-ssh — YubiKey SSH authentication
• ujust enable-yubikey-gpg — Prepare shell for GPG operations with YubiKey 5
• ujust toggle-suspend — Disable suspend for remote access
• ujust setup-gpu-passthrough — IOMMU + Incus GPU passthrough
• ujust configure-yubikey-pam — YubiKey PAM authentication
• ujust setup-borgmatic — Borgmatic backups to BorgBase
• ujust set-default-terminal-ghostty — Make Ghostty the default terminal + deploy OSC 52 clipboard config

What's included on top of vanilla Bluefin / Aurora

Software	Notes
1Password	Desktop + CLI + Flatpak browser integration
Homebrew	Via @ublue-os/brew (auto-setup and update timers)
Ghostty	GPU-accelerated terminal with OSC 52 (remote clipboard over SSH for zellij/Codespaces); ujust set-default-terminal-ghostty
Incus	VM/container manager with QEMU, SPICE, OVMF, VFIO
virt-viewer	SPICE client for incus console --type=vga
ROCm	AMD GPU compute stack
nvidia-container-toolkit	NVIDIA variant only
Custom ujust recipes	YubiKey, 1Password, GPU passthrough, borgmatic, and more

Project Structure

.
├── build/                    # Numbered build scripts (run during image build)
│   ├── 10-build.sh          # Main orchestrator
│   ├── 20-1password.sh      # 1Password installation
│   ├── 30-incus.sh          # Incus + QEMU/SPICE/VFIO
│   ├── 40-rocm.sh           # AMD ROCm compute stack
│   ├── 50-ghostty.sh        # Ghostty terminal (COPR) + OSC 52 config
│   └── copr-helpers.sh      # COPR helper functions
├── custom/                   # Custom files copied into the image
│   ├── brew/                 # Brewfiles for Homebrew packages
│   │   └── default.Brewfile
│   ├── ghostty/              # Ghostty skeleton config (→ /etc/skel)
│   │   └── config
│   └── ujust/                # Custom ujust recipes (→ 60-custom.just)
│       └── rocinante.just
├── Containerfile             # Container build definition (ctx-stage pattern)
└── .github/workflows/        # CI: build, validate, clean

Docs

• 1Password + Flatpak Browsers
• YubiKey + Fingerprint Auth

Building

just build                        # Build image (default: rocinante)
just build rocinante-aurora       # Build Aurora (KDE) variant
just build-iso                    # Create GNOME installer ISO
just build-iso-nvidia             # Create GNOME + NVIDIA installer ISO

Links

• Universal Blue
• Bluefin
• finpilot — upstream template