Skip to main content
Talos Linux is a minimal, immutable, and secure operating system designed specifically for running Kubernetes. There might be several reasons to build Talos images from source, and one of them might be to enable FIPS mode or verify image integrity. In this guide, we will walk through the process of cloning the Talos repository, setting up the build environment, and compiling a custom Talos image with FIPS enabled.

​
Set up the build environment

Before you start building, make sure your development machine meets these requirements:
  • A Linux machine or VM with at least 8 GB of RAM and 100 GB of free disk space.
  • Docker installed and running with the buildx plugin.
  • Go 1.26 or later installed.
  • Make utility installed.
  • Git.
  • Sufficient disk space, at least 100 GB of free storage.
  • Optional - Crane, a tool for interacting with remote images and registries can be installed.

​
Checkout Talos source code

Start by cloning the official Talos Linux repository from GitHub.
The repository is organized into several key directories:
  • internal directory contains the core system components
  • pkg directory contains the shared packages
  • hack directory contains the build scripts and utilities
Understanding this layout helps when you need to make modifications later. Below is a comprehensive view of the folder structure:

​
Create a builder instance

Set up a builder docker instance with access to the host network, so that it can push to a local container registry. To create a compatible builder instance run:
Note: the security.insecure flag is only required and used by the unit-tests target.

​
Connect to a docker registry

If you already have a container registry like ghcr.io, you can use it and all you have to do is login before building the Talos artifacts:
If not, set up a local docker registry for hosting the container image build artifacts:

​
Create Talos installer-base image

Before we can build the custom Talos installer image, we will need to first, build and push the Talos installer-base image to our private registry:
  • Talos installer-base:

​
Create Talos imager image

Before we can build a custom Talos installer image, we will need to next, build and push the Talos imager image to our private registry:
  • Talos imager:
Note: When building the Talos imager, by default Talos will include the boot assets for both amd64 and arm64 architectures.

​
Create Talos installer image

To build a custom Talos installer image (the image used to deploy Talos Linux on a machine) with FIPS enabled, we have multiple options available to us.
Note💡: If your private registry is well configured, the custom Talos installer image will be pushed to it. If not, you can check the _out/installer_image file for the build output.
Note💡: To build for arm64 platform, run: make <target> PLATFORM=linux/arm64.
Note💡: To build for arm64 and amd64 platforms, run: make <target> PLATFORM=linux/arm64,linux/amd64.
In this guide the build artifacts are for a linux/amd64 platform.
  • Build a basic Talos installer image:
  • Build a Talos installer image with system extensions:
First of all, let’s get the system extension image (specific to the version of Talos Linux) for amd-ucode, intel-ucode, iscsi-tools, util-linux-tools, kata-containers, and tailscale, for example:
Then, let’s build the installer image with those system extensions:
  • Build a Talos installer image with kernel arguments:
  • Build Talos installer image with system extensions and kernel arguments:

​
Build Talos kernel

To build the Talos kernel with FIPS enabled, run the following:
Note: You can check the _out/vmlinux-amd64 file for the build output.

​
Build Talos initramfs

To build the Talos initramfs with FIPS enabled, run the following:
Note: You can check the _out/initramfs-amd64.xz file for the build output.

​
Build Talosctl

To build a custom Talosctl with FIPS enabled, run the following:

​
Create cloud provider Talos disk images (Bonus)

In this bonus section, we will show you how to build cloud provider specific Talos disk images:
  • Talos disk image for Akamai Cloud:
  • Talos disk image for AWS Cloud:
  • Talos disk image for Azure Cloud:
  • Talos disk image for Digital Ocean Cloud:
  • Talos disk image for Exoscale Cloud:
  • Talos disk image for CloudStack Cloud:
  • Talos disk image for Google Cloud:
  • Talos disk image for Hetzner Cloud:
  • Talos disk image as an ISO for baremetal:
  • Talos disk image for baremetal as well:
  • Talos disk image for nocloud:
  • Talos disk image for OpenNebula Cloud:
  • Talos disk image for OpenStack Private Cloud:
  • Talos disk image for Oracle Cloud:
  • Talos disk image for Scaleway Cloud:
  • Talos disk image for UpCloud:
  • Talos disk image for VMware:
  • Talos disk image for Vultr Cloud:

​
Create cloud provider Talos disk images with system extensions

You can also embed system extensions into your Talos disk image build like we did for the Talos installer image build.
Note: You can also build Talos disk images with system extensions for other cloud providers by just updating image-gcp to the desired cloud provider.

​
Create cloud provider Talos disk images with kernel arguments

You can also embed custom kernel arguments into your Talos disk image.
Note: You can also build Talos disk images with custom kernel arguments for other cloud providers by just updating image-gcp to the desired cloud provider.

​
Create cloud provider Talos disk images with system extensions and kernel arguments

You can embed both, system extensions and custom kernel arguments into your Talos disk image.
Note: You can also build Talos disk images with custom kernel arguments for other cloud providers by just updating image-gcp to the desired cloud provider.

​
References: