diff --git a/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild b/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild
new file mode 100644
index 00000000000..38c270998fe
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/acct-group/core/core-0.ebuild
@@ -0,0 +1,9 @@
+# Copyright 2026 The Flatcar Maintainers.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+inherit acct-group
+
+ACCT_GROUP_ID=500
+ACCT_GROUP_ENFORCE_ID=yes
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/metadata.xml b/sdk_container/src/third_party/coreos-overlay/acct-group/core/metadata.xml
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/metadata.xml
rename to sdk_container/src/third_party/coreos-overlay/acct-group/core/metadata.xml
diff --git a/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild b/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild
new file mode 100644
index 00000000000..bcbca0a4937
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/acct-user/core/core-0.ebuild
@@ -0,0 +1,64 @@
+# Copyright 2026 Flatcar Maintainers
+# Distributed under the terms of the GNU General Public License v2
+
+# Can't be 9 - tmpfiles eclass does not support it yet.
+EAPI=8
+
+TMPFILES_OPTIONAL=yes
+inherit acct-user tmpfiles
+
+ACCT_USER_ID=500
+ACCT_USER_ENFORCE_ID=yes
+ACCT_USER_COMMENT="Flatcar Admin"
+ACCT_USER_HOME="/home/core"
+ACCT_USER_SHELL="/bin/bash"
+ACCT_USER_GROUPS=( core docker wheel systemd-journal portage )
+
+acct-user_add_deps
+
+# coreutils for realpath
+BDEPEND+="
+ sys-apps/coreutils
+"
+
+declare -A CORE_BASH_SYMLINKS
+CORE_BASH_SYMLINKS=(
+ ['.bash_logout']='/usr/share/flatcar/etc/skel/.bash_logout'
+ ['.bash_profile']='/usr/share/flatcar/etc/skel/.bash_profile'
+ ['.bashrc']='/usr/share/flatcar/etc/skel/.bashrc'
+)
+
+src_compile() {
+ # Generate the tmpfiles config file for bash symlinks in
+ # core's home directory.
+ local config config_tmp name target
+ config="${T}/home-core-bash-symlinks.conf"
+ config_tmp="${config}.tmp"
+ truncate --size 0 "${config_tmp}"
+ for name in "${!CORE_BASH_SYMLINKS[@]}"; do
+ target=${CORE_BASH_SYMLINKS["${name}"]}
+ target=$(realpath --relative-to="${ACCT_USER_HOME}" --canonicalize-missing --no-symlinks "${target}")
+ echo "L ${ACCT_USER_HOME}/${name} - core core - ${target}" >>"${config_tmp}"
+ done
+ LC_ALL=C sort "${config_tmp}" >"${config}"
+}
+
+src_install() {
+ acct-user_src_install
+ dotmpfiles "${T}/home-core-bash-symlinks.conf"
+}
+
+pkg_postinst() {
+ acct-user_pkg_postinst
+ local t n i name
+ read t n i <"${EROOT}/usr/lib/sysusers.d/acct-group-core.conf" || die
+ for name in "${!CORE_BASH_SYMLINKS[@]}"; do
+ target=${CORE_BASH_SYMLINKS["${name}"]}
+ link="${ACCT_USER_HOME}/${name}"
+ ln -sfT "${target}" "${EROOT}${link}" || die
+ chown --no-dereference ${ACCT_USER_ID}:${i} "${EROOT}${link}" || die
+ done
+ # we are putting things into the home directory, drop the
+ # keepdir artifact
+ rm -f "${EROOT}${ACCT_USER_HOME}/.keep_acct-user_core-"* || die
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml b/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml
new file mode 100644
index 00000000000..7c900b19e8e
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/acct-user/core/metadata.xml
@@ -0,0 +1,4 @@
+
+
+
+
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
index e7023163305..155746c2533 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos/coreos-0.0.1.ebuild
@@ -114,7 +114,7 @@ RDEPEND="${RDEPEND}
coreos-base/afterburn
coreos-base/coreos-cloudinit
coreos-base/coreos-init
- coreos-base/misc-files
+ coreos-base/old-oem-files
coreos-base/update-ssh-keys
coreos-base/update_engine
coreos-base/ue-rs
@@ -219,9 +219,11 @@ RDEPEND+="
# Group and user packages to eventually replace passwd in baselayout.
RDEPEND="${RDEPEND}
+ acct-group/core
acct-group/floppy
acct-group/man
acct-group/uucp
+ acct-user/core
acct-user/man
"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules
deleted file mode 100644
index f43e62771cc..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/00-clear.rules
+++ /dev/null
@@ -1,3 +0,0 @@
-# First rule - delete all
-# This is to clear out old rules, so we don't append to them.
--D
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules
deleted file mode 100644
index 627b17db3f4..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/80-selinux.rules
+++ /dev/null
@@ -1,4 +0,0 @@
-# Enable all SELinux related events
-# 1400 to 1499 are for kernel SELinux use (see /include/uapi/linux/audit.h)
-
--a exclude,never -F msgtype>=1400 -F msgtype<=1499
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules
deleted file mode 100644
index cc373d84068..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/audit/99-default.rules
+++ /dev/null
@@ -1,5 +0,0 @@
-# Always report changes to the audit subsystem itself.
--a exclude,never -F msgtype=CONFIG_CHANGE
-
-# Ignore everything else.
--a exclude,always -F msgtype>0
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash
deleted file mode 100644
index 15ca68cd81c..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/bash/99-flatcar-bcc.bash
+++ /dev/null
@@ -1,5 +0,0 @@
-for iovisor_bcc_tool in tcpretrans tcpconnect tcpaccept biolatency; do
- alias "iovisor-${iovisor_bcc_tool}=docker run --rm -it -v /lib/modules:/lib/modules -v /sys/kernel/debug:/sys/kernel/debug -v /sys/fs/cgroup:/sys/fs/cgroup -v /sys/fs/bpf:/sys/fs/bpf --privileged --net host --pid host quay.io/iovisor/bcc /usr/share/bcc/tools/${iovisor_bcc_tool}"
-done
-
-unset -v iovisor_bcc_tool
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf
deleted file mode 100644
index f2947d94d1a..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp-environment.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[Service]
-Environment="SERVER=0.flatcar.pool.ntp.org 1.flatcar.pool.ntp.org 2.flatcar.pool.ntp.org 3.flatcar.pool.ntp.org"
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf
deleted file mode 100644
index cc9a441b7be..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntp.conf
+++ /dev/null
@@ -1,68 +0,0 @@
-# NOTES:
-# DHCP clients can append or replace NTP configuration files.
-# You should consult your DHCP client documentation about its
-# default behaviour and how to change it.
-
-# Name of the servers ntpd should sync with
-# Please respect the access policy as stated by the responsible person.
-#server ntp.example.tld iburst
-
-# Common pool for random people
-#server pool.ntp.org
-
-# AWS Time Sync Service.
-server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4
-# AWS Time Sync Service IPv6:
-server fd00:ec2::123 prefer iburst minpoll 4 maxpoll 4
-
-# GCP NTP Service
-server metadata.google.internal prefer iburst
-
-# Pools for Flatcar users
-server 0.flatcar.pool.ntp.org
-server 1.flatcar.pool.ntp.org
-server 2.flatcar.pool.ntp.org
-server 3.flatcar.pool.ntp.org
-
-##
-# A list of available servers can be found here:
-# http://www.pool.ntp.org/
-# http://www.pool.ntp.org/#use
-# A good way to get servers for your machine is:
-# netselect -s 3 pool.ntp.org
-##
-
-# you should not need to modify the following paths
-driftfile /var/lib/ntp/ntp.drift
-
-#server ntplocal.example.com prefer
-#server timeserver.example.org
-
-# Warning: Using default NTP settings will leave your NTP
-# server accessible to all hosts on the Internet.
-
-# If you want to deny all machines (including your own)
-# from accessing the NTP server, uncomment:
-#restrict default ignore
-
-
-# Default configuration:
-# - Allow only time queries, at a limited rate, sending KoD when in excess.
-# - Allow all local queries (IPv4, IPv6)
-# From commit da515112395ea7ce0da7cba7103de65d53fc93c9:
-#
-# net-misc/ntp: add notrap to default restrict config
-#
-# It's a common security hardening option and doesn't seem likely to
-# affect any actual usage.
-restrict default nomodify nopeer noquery notrap limited kod
-restrict 127.0.0.1
-restrict [::1]
-
-
-# To allow machines within your network to synchronize
-# their clocks with your server, but ensure they are
-# not allowed to configure the server or used as peers
-# to synchronize against, uncomment this line.
-#
-#restrict 192.168.0.0 mask 255.255.255.0 nomodify nopeer notrap
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf
deleted file mode 100644
index a73e63da667..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/ntp/ntpd-always-restart.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-[Service]
-# From commit 5e5abb4d7ea48a9238b9baa22941fda6a6bbda8c:
-#
-# ntpd: always restart, required to handle large time jumps.
-#
-# Some VM platforms suspend machines by simply stopping them instead of
-# gracefully suspending them like real hardware would. This means that
-# when the system is resumed the kernel's time will be completely wrong
-# and it doesn't have a way to fix it. Additionally ntp will abort if the
-# clock offset is greater than 1000 seconds (conveniently without logging
-# any error messages). We can tune that in ntp.conf but ntpd has so many
-# knobs related to how it skews the clock and other update strategies that
-# the easiest option is to just restart.
-Restart=always
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf
deleted file mode 100644
index 1a88c1614ca..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-ssh.conf
+++ /dev/null
@@ -1 +0,0 @@
-# Use defaults for ssh client system-wide configuration.
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf
deleted file mode 100644
index bdad9639ad6..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/50-flatcar-sshd.conf
+++ /dev/null
@@ -1,22 +0,0 @@
-# Use most defaults for sshd configuration.
-Subsystem sftp internal-sftp
-ClientAliveInterval 180
-
-# These are either defaults or already set up by config generated by
-# the Gentoo ebuild. But we need to keep them, as the older
-# installations may still use the old symlink from
-# /etc/ssh/sshd_config to /usr/share/ssh/sshd_config.
-#
-# BEGIN SETTINGS KEPT FOR COMPATIBILITY
-UseDNS no
-UsePAM yes
-# handled by PAM
-PrintLastLog no
-# handled by PAM
-PrintMotd no
-# END SETTINGS KEPT FOR COMPATIBILITY
-
-# Temporarily accept ssh-rsa algorithm for openssh >= 8.8,
-# until most ssh clients could deprecate ssh-rsa.
-HostkeyAlgorithms +ssh-rsa
-PubkeyAcceptedAlgorithms +ssh-rsa
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf
deleted file mode 100644
index da57a42f47b..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/openssh/no-trigger-limit-burst.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-[Socket]
-TriggerLimitBurst=0
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf
deleted file mode 100644
index f763cf3e45f..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/selinux/10-var-lib-selinux.conf
+++ /dev/null
@@ -1,2 +0,0 @@
-#Type Path Mode UID GID Age Argument
-L /var/lib/selinux/ - - - - ../../usr/lib/selinux/policy
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild
deleted file mode 100644
index 15a0374c975..00000000000
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/misc-files-0-r9.ebuild
+++ /dev/null
@@ -1,207 +0,0 @@
-# Copyright (c) 2023 The Flatcar Maintainers.
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-TMPFILES_OPTIONAL=1
-inherit systemd tmpfiles
-
-DESCRIPTION='Flatcar miscellaneous files'
-HOMEPAGE='https://www.flatcar.org/'
-
-LICENSE='Apache-2.0'
-SLOT='0'
-KEYWORDS='amd64 arm64'
-IUSE="audit ntp openssh policycoreutils"
-
-# No source directory.
-S="${WORKDIR}"
-
-# Versions listed below are version of packages that shedded the
-# modifications in their ebuilds.
-#
-# net-misc/openssh must be installed on host for enabling its unit to
-# work during installation.
-DEPEND="
- openssh? ( >=net-misc/openssh-9.4_p1 )
-"
-
-# Versions listed below are version of packages that shedded the
-# modifications in their ebuilds.
-RDEPEND="
- ${DEPEND}
- >=app-shells/bash-5.2_p15-r2
- ntp? ( >=net-misc/ntp-4.2.8_p17 )
- policycoreutils? ( >=sys-apps/policycoreutils-3.6 )
- audit? ( >=sys-process/audit-4.0.1-r1 )
-"
-
-declare -A CORE_BASH_SYMLINKS
-CORE_BASH_SYMLINKS=(
- ['.bash_logout']='../../usr/share/flatcar/etc/skel/.bash_logout'
- ['.bash_profile']='../../usr/share/flatcar/etc/skel/.bash_profile'
- ['.bashrc']='../../usr/share/flatcar/etc/skel/.bashrc'
-)
-
-src_compile() {
- # An empty file for temporary symlink destinations under
- # /usr/share/flatcar/etc.
- touch "${T}/empty-file"
- # Generate the tmpfiles config file for bash symlinks in core home
- # directory.
- local name config config_tmp target
- config="${T}/home-core-bash-symlinks.conf"
- config_tmp="${config}.tmp"
- truncate --size 0 "${config_tmp}"
- for name in "${!CORE_BASH_SYMLINKS[@]}"; do
- target=${CORE_BASH_SYMLINKS["${name}"]}
- echo "L /home/core/${name} - core core - ${target}" >>"${config_tmp}"
- done
- LC_ALL=C sort "${config_tmp}" >"${config}"
-}
-
-misc_files_install_dropin() {
- local unit conf
- unit=${1}; shift
- conf=${1}; shift
-
- [[ -n ${unit} ]] || die "No unit specified"
- [[ -n ${conf} ]] || die "No conf file specified"
- [[ ${conf} = *.conf ]] || die "Conf file must have .conf suffix"
-
- local override_dir
- override_dir="$(systemd_get_systemunitdir)/${unit}.d"
- (
- insopts -m 0644
- insinto "${override_dir}"
- doins "${conf}"
- )
-}
-
-src_install() {
- # Use absolute paths to be clear about what locations are used. The
- # dosym below will make relative paths out of them.
- #
- # For files inside /usr/share/flatcar/etc the ebuild will create empty
- # files to avoid having dangling symlinks. During the assembly of the
- # image, the /usr/share/flatcar/etc directory will be removed, and
- # /etc will be moved in its place.
- #
- # These links exist because old installations can still have
- # references to them.
- local -A compat_symlinks
- compat_symlinks=(
- ['/usr/share/bash/bash_logout']='/usr/share/flatcar/etc/bash/bash_logout'
- ['/usr/share/bash/bashrc']='/usr/share/flatcar/etc/bash/bashrc'
- ['/usr/share/skel/.bash_logout']='/usr/share/flatcar/etc/skel/.bash_logout'
- ['/usr/share/skel/.bash_profile']='/usr/share/flatcar/etc/skel/.bash_profile'
- ['/usr/share/skel/.bashrc']='/usr/share/flatcar/etc/skel/.bashrc'
- ['/usr/lib/selinux/config']='/usr/share/flatcar/etc/selinux/config'
- ['/usr/lib/selinux/mcs']='/usr/share/flatcar/etc/selinux/mcs'
- ['/usr/lib/selinux/semanage.conf']='/usr/share/flatcar/etc/selinux/semanage.conf'
- )
- if use audit; then
- compat_symlinks+=(
- ['/usr/share/audit/rules.d/00-clear.rules']='/usr/share/flatcar/etc/audit/rules.d/00-clear.rules'
- ['/usr/share/audit/rules.d/80-selinux.rules']='/usr/share/flatcar/etc/audit/rules.d/80-selinux.rules'
- ['/usr/share/audit/rules.d/99-default.rules']='/usr/share/flatcar/etc/audit/rules.d/99-default.rules'
- ['/usr/share/auditd/auditd.conf']='/usr/share/flatcar/etc/audit/auditd.conf'
- )
- fi
- if use ntp; then
- compat_symlinks+=(
- ['/usr/share/ntp/ntp.conf']='/usr/share/flatcar/etc/ntp.conf'
- )
- fi
- if use openssh; then
- compat_symlinks+=(
- ['/usr/share/ssh/ssh_config']='/usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf'
- ['/usr/share/ssh/sshd_config']='/usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf'
- )
- fi
-
- local link target
- for link in "${!compat_symlinks[@]}"; do
- target=${compat_symlinks["${link}"]}
- dosym -r "${target}" "${link}"
- if [[ "${target}" = /usr/share/flatcar/etc/* ]]; then
- insinto "${target%/*}"
- newins "${T}/empty-file" "${target##*/}"
- fi
- done
-
- insinto '/etc/bash/bashrc.d'
- doins "${FILESDIR}/bash/99-flatcar-bcc.bash"
-
- insinto '/usr/share/flatcar'
- # The "oems" folder should contain a file "$OEMID" for each expected OEM sysext and
- # either be empty or contain a newline-separated list of files to delete during the
- # migration (done from the initrd). The existence of the file will help old clients
- # to do the fallback download of the sysext payload in the postinstall hook.
- # The paths should use /oem instead of /usr/share/oem/ to avoid symlink resolution.
- doins -r "${FILESDIR}"/oems
-
- dotmpfiles "${T}/home-core-bash-symlinks.conf"
- # Ideally we would be calling systemd-tmpfiles to create the
- # symlinks, but at this point systemd may not have any info about
- # the core user. Thus we hardcode the id 500.
- dodir /home/core
- fowners 500:500 /home/core
- local name
- for name in "${!CORE_BASH_SYMLINKS[@]}"; do
- target=${CORE_BASH_SYMLINKS["${name}"]}
- link="/home/core/${name}"
- dosym "${target}" "${link}"
- fowners --no-dereference 500:500 "${link}"
- done
-
- if use audit; then
- # Install our rules.
- insinto /etc/audit/rules.d
- for name in 00-clear.rules 80-selinux.rules 99-default.rules; do
- doins "${FILESDIR}/audit/${name}"
- # Upstream wants these to have restrictive perms.
- fperms 0640 "/etc/audit/rules.d/${name}"
- done
- # Enable audit-rules.service by default.
- systemd_enable_service multi-user.target audit-rules.service
- fi
-
- if use ntp; then
- insinto /etc
- doins "${FILESDIR}/ntp/ntp.conf"
- misc_files_install_dropin ntpd.service "${FILESDIR}/ntp/ntpd-always-restart.conf"
- misc_files_install_dropin ntpdate.service "${FILESDIR}/ntp/ntp-environment.conf"
- misc_files_install_dropin sntp.service "${FILESDIR}/ntp/ntp-environment.conf"
- fi
-
- if use openssh; then
- # Install our configuration snippets.
- insinto /etc/ssh/ssh_config.d
- doins "${FILESDIR}/openssh/50-flatcar-ssh.conf"
- insinto /etc/ssh/sshd_config.d
- doins "${FILESDIR}/openssh/50-flatcar-sshd.conf"
-
- # Install our socket drop-in file that disables the rate
- # limiting on the sshd socket.
- misc_files_install_dropin sshd.socket "${FILESDIR}/openssh/no-trigger-limit-burst.conf"
-
- # Enable some sockets that aren't enabled by their own ebuilds.
- systemd_enable_service sockets.target sshd.socket
- fi
-
- if use policycoreutils; then
- # Exceptionally, the location for policy definitions is set up
- # in profiles/coreos/base/profile.bashrc. See the comment for
- # cros_post_src_install_set_up_var_lib_selinux for reasoning.
- #
- # Recreate the symlink in /var in case of wiping the root
- # filesystem.
- dotmpfiles "${FILESDIR}/selinux/10-var-lib-selinux.conf"
- fi
-
- # Create a symlink for Kubernetes to redirect writes from /usr/libexec/... to /var/kubernetes/...
- # (The below keepdir will result in a tmpfiles entry in base_image_var.conf)
- keepdir /var/kubernetes/kubelet-plugins/volume/exec
- dosym /var/kubernetes/kubelet-plugins/volume/exec /usr/libexec/kubernetes/kubelet-plugins/volume/exec
-}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/ami b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/ami
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/ami
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/ami
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/azure b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/azure
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/azure
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/azure
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/digitalocean b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/digitalocean
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/digitalocean
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/digitalocean
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/gce b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/gce
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/gce
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/gce
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/openstack b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/openstack
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/openstack
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/openstack
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/packet b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/packet
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/packet
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/packet
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/qemu b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/qemu
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/qemu
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/qemu
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/vmware b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/vmware
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/coreos-base/misc-files/files/oems/vmware
rename to sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/files/oems/vmware
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml
new file mode 100644
index 00000000000..7c900b19e8e
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/metadata.xml
@@ -0,0 +1,4 @@
+
+
+
+
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild
new file mode 100644
index 00000000000..2e9e8b38d5a
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/old-oem-files/old-oem-files-0.ebuild
@@ -0,0 +1,24 @@
+# Copyright (c) 2026 The Flatcar Maintainers.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=9
+
+DESCRIPTION='Listings of old OEM files'
+HOMEPAGE='https://www.flatcar.org/'
+
+LICENSE='Apache-2.0'
+SLOT='0'
+KEYWORDS='amd64 arm64'
+
+# No source directory.
+S="${WORKDIR}"
+
+src_install() {
+ insinto '/usr/share/flatcar'
+ # The "oems" folder should contain a file "$OEMID" for each expected OEM sysext and
+ # either be empty or contain a newline-separated list of files to delete during the
+ # migration (done from the initrd). The existence of the file will help old clients
+ # to do the fallback download of the sysext payload in the postinstall hook.
+ # The paths should use /oem instead of /usr/share/oem/ to avoid symlink resolution.
+ doins -r "${FILESDIR}"/oems
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash
index b7b266cfe9d..d29e363fdaf 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/app-shells/bash
@@ -1 +1,28 @@
export bash_cv_getcwd_malloc=yes
+
+cros_post_src_install_flatcar_modifications() {
+ # These links exist because old installations can still have
+ # references to them.
+ dosym -r '/usr/share/flatcar/etc/bash/bash_logout' '/usr/share/bash/bash_logout'
+ dosym -r '/usr/share/flatcar/etc/bash/bashrc' '/usr/share/bash/bashrc'
+ insinto '/usr/share/flatcar/etc/bash'
+ newins - 'bash_logout'
+ newins - 'bashrc'
+
+ dosym -r '/usr/share/flatcar/etc/skel/.bash_logout' '/usr/share/skel/.bash_logout'
+ dosym -r '/usr/share/flatcar/etc/skel/.bash_profile' '/usr/share/skel/.bash_profile'
+ dosym -r '/usr/share/flatcar/etc/skel/.bashrc' '/usr/share/skel/.bashrc'
+ insinto '/usr/share/flatcar/etc/skel'
+ newins - '.bash_logout'
+ newins - '.bash_profile'
+ newins - '.bashrc'
+
+ insinto '/etc/bash/bashrc.d'
+ newins - '99-flatcar-bcc.bash' <<'EOF'
+for iovisor_bcc_tool in tcpretrans tcpconnect tcpaccept biolatency; do
+ alias "iovisor-${iovisor_bcc_tool}=docker run --rm -it -v /lib/modules:/lib/modules -v /sys/kernel/debug:/sys/kernel/debug -v /sys/fs/cgroup:/sys/fs/cgroup -v /sys/fs/bpf:/sys/fs/bpf --privileged --net host --pid host quay.io/iovisor/bcc /usr/share/bcc/tools/${iovisor_bcc_tool}"
+done
+
+unset -v iovisor_bcc_tool
+EOF
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
index bc72eb5c0a1..e6fdefbb75c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/ntp
@@ -1,15 +1,115 @@
-ntp_install_mask=''
# Do not install ntpdate or sntp systemd files in /etc.
-ntp_install_mask+=" /etc/systemd"
-# Do not install the default ntp.conf, we provide our own in
-# coreos-base/misc-files.
-ntp_install_mask+=" /etc/ntp.conf"
+INSTALL_MASK+=" /etc/systemd "
# Do not install perl scripts to /usr/bin.
-ntp_install_mask+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap"
-# Do not install perl package to /usr/share/ntp.
-ntp_install_mask+=" /usr/share/ntp"
-
-ntp_install_mask+=' '
-INSTALL_MASK+=${ntp_install_mask}
-PKG_INSTALL_MASK+=${ntp_install_mask}
-unset ntp_install_mask
+INSTALL_MASK+=" /usr/bin/calc_tickadj /usr/bin/ntp-wait /usr/bin/ntptrace /usr/bin/update-leap "
+
+cros_post_src_install_ntp_flatcar_modifications() {
+ # Drop perl package. Not in install mask, because we install our own symlink here.
+ rm -rf "${ED}/usr/share/ntp/"* || die
+ dosym -r /usr/share/flatcar/etc/ntp.conf /usr/share/ntp/ntp.conf
+ insinto /usr/share/flatcar/etc/
+ newins - ntp.conf
+
+ rm -f "${ED}/etc/ntp/ntp.conf"
+ insinto /etc
+ newins - ntp.conf <<'EOF'
+# NOTES:
+# DHCP clients can append or replace NTP configuration files.
+# You should consult your DHCP client documentation about its
+# default behaviour and how to change it.
+
+# Name of the servers ntpd should sync with
+# Please respect the access policy as stated by the responsible person.
+#server ntp.example.tld iburst
+
+# Common pool for random people
+#server pool.ntp.org
+
+# AWS Time Sync Service.
+server 169.254.169.123 prefer iburst minpoll 4 maxpoll 4
+# AWS Time Sync Service IPv6:
+server fd00:ec2::123 prefer iburst minpoll 4 maxpoll 4
+
+# GCP NTP Service
+server metadata.google.internal prefer iburst
+
+# Pools for Flatcar users
+server 0.flatcar.pool.ntp.org
+server 1.flatcar.pool.ntp.org
+server 2.flatcar.pool.ntp.org
+server 3.flatcar.pool.ntp.org
+
+##
+# A list of available servers can be found here:
+# http://www.pool.ntp.org/
+# http://www.pool.ntp.org/#use
+# A good way to get servers for your machine is:
+# netselect -s 3 pool.ntp.org
+##
+
+# you should not need to modify the following paths
+driftfile /var/lib/ntp/ntp.drift
+
+#server ntplocal.example.com prefer
+#server timeserver.example.org
+
+# Warning: Using default NTP settings will leave your NTP
+# server accessible to all hosts on the Internet.
+
+# If you want to deny all machines (including your own)
+# from accessing the NTP server, uncomment:
+#restrict default ignore
+
+
+# Default configuration:
+# - Allow only time queries, at a limited rate, sending KoD when in excess.
+# - Allow all local queries (IPv4, IPv6)
+# From commit da515112395ea7ce0da7cba7103de65d53fc93c9:
+#
+# net-misc/ntp: add notrap to default restrict config
+#
+# It's a common security hardening option and doesn't seem likely to
+# affect any actual usage.
+restrict default nomodify nopeer noquery notrap limited kod
+restrict 127.0.0.1
+restrict [::1]
+
+
+# To allow machines within your network to synchronize
+# their clocks with your server, but ensure they are
+# not allowed to configure the server or used as peers
+# to synchronize against, uncomment this line.
+#
+#restrict 192.168.0.0 mask 255.255.255.0 nomodify nopeer notrap
+EOF
+
+ (
+ insopts -m 0644
+ unit_dir=$(systemd_get_systemunitdir)
+ insinto "${unit_dir}/ntpd.service.d"
+ newins - ntpd-always-restart.conf <<'EOF'
+[Service]
+# From commit 5e5abb4d7ea48a9238b9baa22941fda6a6bbda8c:
+#
+# ntpd: always restart, required to handle large time jumps.
+#
+# Some VM platforms suspend machines by simply stopping them instead of
+# gracefully suspending them like real hardware would. This means that
+# when the system is resumed the kernel's time will be completely wrong
+# and it doesn't have a way to fix it. Additionally ntp will abort if the
+# clock offset is greater than 1000 seconds (conveniently without logging
+# any error messages). We can tune that in ntp.conf but ntpd has so many
+# knobs related to how it skews the clock and other update strategies that
+# the easiest option is to just restart.
+Restart=always
+EOF
+ cat >"${T}/ntp-environment.conf" <<'EOF'
+[Service]
+Environment="SERVER=0.flatcar.pool.ntp.org 1.flatcar.pool.ntp.org 2.flatcar.pool.ntp.org 3.flatcar.pool.ntp.org"
+EOF
+ insinto "${unit_dir}/ntpdate.service.d"
+ doins "${T}/ntp-environment.conf"
+ insinto "${unit_dir}/sntp.service.d"
+ doins "${T}/ntp-environment.conf"
+ )
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
index 77a32cfa39c..7dbfbb61c45 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/net-misc/openssh
@@ -3,12 +3,61 @@
# Do not install the config snippet that defines a subsystem. We have
# our own definition in coreos-init.
if [[ $(flatcar_target) != 'sdk' ]] ; then
- openssh_mask=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
- PKG_INSTALL_MASK+="${openssh_mask}"
- INSTALL_MASK+="${openssh_mask}"
- unset openssh_mask
+ INSTALL_MASK+=" /usr/lib*/misc/ssh-keysign /etc/ssh/sshd_config.d/*gentoo-subsystem.conf "
fi
-cros_post_src_install_vendorize_pam() {
+cros_post_src_install_flatcar_modifications() {
vendorize_pam_files
+
+ if [[ $(flatcar_target) != 'sdk' ]] ; then
+ dosym -r /usr/share/flatcar/etc/ssh/ssh_config.d/50-flatcar-ssh.conf /usr/share/ssh/ssh_config
+ insinto /usr/share/flatcar/etc/ssh/ssh_config.d/
+ newins - 50-flatcar-ssh.conf
+ insinto /etc/ssh/ssh_config.d
+ newins - 50-flatcar-ssh.conf <<'EOF'
+# Use defaults for ssh client system-wide configuration.
+EOF
+
+ dosym -r /usr/share/flatcar/etc/ssh/sshd_config.d/50-flatcar-sshd.conf /usr/share/ssh/sshd_config
+ insinto /usr/share/flatcar/etc/ssh/sshd_config.d/
+ newins - 50-flatcar-sshd.conf
+ insinto /etc/ssh/sshd_config.d
+ newins - 50-flatcar-sshd.conf <<'EOF'
+# Use most defaults for sshd configuration.
+Subsystem sftp internal-sftp
+ClientAliveInterval 180
+
+# These are either defaults or already set up by config generated by
+# the Gentoo ebuild. But we need to keep them, as the older
+# installations may still use the old symlink from
+# /etc/ssh/sshd_config to /usr/share/ssh/sshd_config.
+#
+# BEGIN SETTINGS KEPT FOR COMPATIBILITY
+UseDNS no
+UsePAM yes
+# handled by PAM
+PrintLastLog no
+# handled by PAM
+PrintMotd no
+# END SETTINGS KEPT FOR COMPATIBILITY
+
+# Temporarily accept ssh-rsa algorithm for openssh >= 8.8,
+# until most ssh clients could deprecate ssh-rsa.
+HostkeyAlgorithms +ssh-rsa
+PubkeyAcceptedAlgorithms +ssh-rsa
+EOF
+ # Install our socket drop-in file that disables the rate
+ # limiting on the sshd socket.
+ (
+ insopts -m 0644
+ unit_dir=$(systemd_get_systemunitdir)
+ insinto "${unit_dir}/sshd.socket"
+ newins - no-trigger-limit-burst.conf <<'EOF'
+[Socket]
+TriggerLimitBurst=0
+EOF
+ # Enable some sockets that aren't enabled by their own ebuilds.
+ systemd_enable_service sockets.target sshd.socket
+ )
+ fi
}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base
new file mode 100644
index 00000000000..e27c1c1c385
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base
@@ -0,0 +1,9 @@
+cros_post_src_install_flatcar_modifications() {
+ # These links exist because old installations can still have
+ # references to them.
+ dosym -r '/usr/share/flatcar/etc/selinux/mcs' '/usr/lib/selinux/mcs'
+ dosym -r '/usr/share/flatcar/etc/selinux/config' '/usr/lib/selinux/config'
+ insinto '/usr/share/flatcar/etc/selinux'
+ newins - 'mcs'
+ newins - 'config'
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
index 8b6c1ef2cdd..89592475820 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/policycoreutils
@@ -1,20 +1,24 @@
# sys-apps/policycoreutils creates /var/lib/selinux directory in
# src_install and then needs it to be available when running
-# pkg_postinst, because it does a policy module rebuild there. We
-# initially have put /var/lib/selinux into INSTALL_MASK and told
-# coreos-base/misc-files to install the directory at
-# /usr/lib/selinux/policy together with a symlink at /var/lib/selinux
-# pointing to the directory. But this is done too late - at
-# sys-apps/policycoreutils' pkg_postinst time, /var/lib/selinux does
-# not exist, because coreos-base/misc-files was not yet emerged. So we
-# need to fall back to this hack, where we set up /var/lib/selinux and
-# /usr/lib/selinux/policy the way we want.
-cros_post_src_install_set_up_var_lib_selinux() {
+# pkg_postinst, because it does a policy module rebuild there. We want
+# the policies to be in /usr/lib/selinux/policy and /var/lib/selinux
+# to be a symlink to it, so we need to fall back to this hack, where
+# we set the paths up the way we want.
+cros_post_src_install_flatcar_modifications() {
+ vendorize_pam_files
+
dodir /usr/lib/selinux
mv "${ED}/var/lib/selinux" "${ED}/usr/lib/selinux/policy"
dosym -r /usr/lib/selinux/policy /var/lib/selinux
-}
-cros_post_src_install_vendorize_pam() {
- vendorize_pam_files
+ # the ebuild does not inherit the tmpfiles eclass, so we opencode
+ # the newtmpfiles function here
+ (
+ insopts -m 0644
+ insinto /usr/lib/tmpfiles.d
+ newins - 10-var-lib-selinux.conf <<'EOF'
+#Type Path Mode UID GID Age Argument
+L /var/lib/selinux/ - - - - ../../usr/lib/selinux/policy
+EOF
+ )
}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
new file mode 100644
index 00000000000..6b3d3591005
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-libs/libsemanage
@@ -0,0 +1,7 @@
+cros_post_src_install_flatcar_modifications() {
+ # This links exist because old installations can still have
+ # references to them.
+ dosym -r '/usr/share/flatcar/etc/selinux/semanage.conf' '/usr/lib/selinux/semanage.conf'
+ insinto '/usr/share/flatcar/etc/selinux'
+ newins - 'semanage.conf'
+}
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
index 31d2888b547..ffd737e7f08 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
+++ b/sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-process/audit
@@ -1,9 +1,43 @@
# Do not install Gentoo-provided audit rules, we will install our own
-# in coreos-base/misc-files. Also skip installing legacy initscripts
-# stuff in /usr/libexec.
+# in the hook below. Also skip installing legacy initscripts stuff in
+# /usr/libexec.
INSTALL_MASK+=" /etc/audit/audit.rules* /usr/libexec "
cros_post_src_install_audit_flatcar_modifications() {
+ # install these for backward compatibility
+ dosym -r /usr/share/flatcar/etc/audit/rules.d/00-clear.rules /usr/share/audit/rules.d/00-clear.rules
+ dosym -r /usr/share/flatcar/etc/audit/rules.d/80-selinux.rules /usr/share/audit/rules.d/80-selinux.rules
+ dosym -r /usr/share/flatcar/etc/audit/rules.d/99-default.rules /usr/share/audit/rules.d/99-default.rules
+ insinto /usr/share/flatcar/etc/audit/rules.d/
+ newins - 00-clear.rules 80-selinux.rules 99-default.rules
+ dosym -r /usr/share/flatcar/etc/audit/auditd.conf /usr/share/auditd/auditd.conf
+ insinto /usr/share/flatcar/etc/audit/
+ newins - auditd.conf
+
+ insinto /etc/audit/rules.d
+ newins - 00-clear.rules <<'EOF'
+# First rule - delete all
+# This is to clear out old rules, so we don't append to them.
+-D
+EOF
+ newins - 80-selinux.rules <<'EOF'
+# Enable all SELinux related events
+# 1400 to 1499 are for kernel SELinux use (see /include/uapi/linux/audit.h)
+
+-a exclude,never -F msgtype>=1400 -F msgtype<=1499
+EOF
+ newins - 99-default.rules <<'EOF'
+# Always report changes to the audit subsystem itself.
+-a exclude,never -F msgtype=CONFIG_CHANGE
+
+# Ignore everything else.
+-a exclude,always -F msgtype>0
+EOF
+ # Upstream wants these to have restrictive perms.
+ fperms 0640 /etc/audit/rules.d/{00-clear.rules,80-selinux.rules,99-default.rules}
+ # Enable audit-rules.service by default.
+ systemd_enable_service multi-user.target audit-rules.service
+
# Upstream installs its tmpfiles config file with unnecessarilly
# restrictive mode, relax it.
#
diff --git a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
index 5ba41170fd8..8684aafb416 100644
--- a/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
+++ b/sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/generic/package.use
@@ -7,11 +7,6 @@ app-editors/vim minimal -crypt
# minimal: Don't pull app-vim/gentoo-syntax
app-editors/vim-core minimal
-# Install our modifications and compatibility symlinks for ssh and ntp
-#
-# Install a SELinux policy directory symlink
-coreos-base/misc-files audit ntp openssh policycoreutils
-
dev-lang/python gdbm
dev-libs/dbus-glib tools
dev-libs/elfutils -utils
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r23.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r24.ebuild
similarity index 100%
rename from sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r23.ebuild
rename to sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-3.6.8-r24.ebuild
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
index 5c5da8ebe23..87996e72730 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-apps/baselayout/baselayout-9999.ebuild
@@ -87,6 +87,11 @@ src_install() {
doins Makefile
exeinto /usr/share/baselayout
doexe dumb-tmpfiles-proc.sh
+
+ # Create a symlink for Kubernetes to redirect writes from /usr/libexec/... to /var/kubernetes/...
+ # (The below keepdir will result in a tmpfiles entry in base_image_var.conf)
+ keepdir /var/kubernetes/kubelet-plugins/volume/exec
+ dosym /var/kubernetes/kubelet-plugins/volume/exec /usr/libexec/kubernetes/kubelet-plugins/volume/exec
}
pkg_preinst() {