What's the best way to include an exported OCI image?

[saminaltamimi]

Hey there, I'm very new to mkosi and I've been able to generate a USI (by luck's grace and helpful articles and RTFM) but I would like for that USI to include an nspawn container based off a Docker image.

I figured that the brute force way is doing something like:

podman export $(podman create quay.io/11notes/sonarr:4) > sonarr.tar
tar -xpf sonarr.tar -C ./mkosi.extra/var/lib/machines/sonarr

Then include a .nspawn file as well, but I'd like to be able to have mkosi be able to do this for me

I could do mkosi.images/ to build out an image but the reason I'd like OCI's is because most of the hard work has been done in terms of container securement and other things because I eventually want the ability to add verity and lock down the USI into an appliance-like image if possible.

[saminaltamimi]

So I've written a Justfile:

# Export a container image (via podman) into mkosi.extra machine directory.
# Usage:
#   just export-container IMAGE_NAME=<image> MACHINE_NAME=<machine>
get IMAGE_NAME MACHINE_NAME:
    podman export $(podman create "{{IMAGE_NAME}}") > {{MACHINE_NAME}}.tar
    mkdir -p ./mkosi.extra/var/lib/machines/{{MACHINE_NAME}}
    tar -xpf {{MACHINE_NAME}}.tar -C ./mkosi.extra/var/lib/machines/{{MACHINE_NAME}}
    rm -f "{{MACHINE_NAME}}.tar"
    podman system prune -af

which does the job for the most part. After diving in and re-reading, I see there is mkosi.prepare which sounds like exactly what I need it to do where I have a script with network access, I just need to pull the image and extract it in its location, but I receive this:

‣ Running prepare script /root/mkosi/mkosi.prepare…
‣ /work/prepare not found.

where the file is just simply:

#!/bin/bash

set -euo pipefail

podman export $(podman create quay.io/11notes/sonarr:4.0.16) > sonarr.tar
mkdir -p ./mkosi.extra/var/lib/machines/sonarr
tar -xpf sonarr.tar -C ./mkosi.extra/var/lib/machines/sonarr
rm -f "sonarr.tar"
podman system prune -af

I don't understand where I'm going wrong here, going to continue doing more digging.