feat(core): introduce ROOTFS_TYPE=nfs-root for full netboot

`nfs-root` is a new rootfs type distinct from the existing `nfs` hybrid
mode. Selecting it wires the `netboot` extension from the core
`ROOTFS_TYPE` dispatch in `do_main_configuration`, so callers no longer
need a separate `ENABLE_EXTENSIONS=netboot`. The legacy `nfs` branch
(kernel+DTB on local boot partition, `/` over NFS) is untouched — both
paths coexist until the hybrid mode's future is decided.

Core plumbing mirrors the `nfs` branch for all paths where local root
storage would be meaningless: partition layout skip
(`prepare_partitions`), archive/export gate and version suffix
(`rootfs-to-image.sh`), and the host-side filesystem compatibility
check in `main-config.sh`.

Extension hooks now key on `ROOTFS_TYPE=nfs-root` instead of guessing
from `nfs`, removing the `force ROOTFS_TYPE=nfs` shim that ran too
late relative to `do_main_configuration`.

Also folded in from CodeRabbit review on PR #9656:
- pipefail around tar|pv|compressor so truncated archives no longer
  slip through on an intermediate stage failure
- `rsync --delete` on `ROOTFS_EXPORT_DIR` so stale files from a
  previous build don't linger in the NFS export tree
- explicit `INITRD` directive in extlinux when `uInitrd` is staged;
  U-Boot only loads an initramfs when the stanza names it
- README updated to document `ROOTFS_TYPE=nfs-root` as the single
  switch

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: iav

extensions/netboot/README.md

@@ -27,10 +27,13 @@ setup, network configuration, troubleshooting, end-to-end examples.
 ## Why this exists
 
 `ROOTFS_TYPE=nfs` alone produces a hybrid image: kernel and DTB still
-live on a local boot partition (SD/eMMC), only `/` comes over NFS. This
-extension takes it further — kernel, DTB and PXE config are also staged
-for TFTP, and the only thing the target needs to boot is a network with
-working DHCP+TFTP+NFS.
+live on a local boot partition (SD/eMMC), only `/` comes over NFS.
+`ROOTFS_TYPE=nfs-root` takes it further — kernel, DTB and PXE config
+are also staged for TFTP, and the only thing the target needs to boot
+is a network with working DHCP+TFTP+NFS. Selecting `nfs-root` is the
+single switch that turns this extension on; it is auto-enabled from
+the core `ROOTFS_TYPE` dispatch, no separate `ENABLE_EXTENSIONS` flag
+is needed.
 
 Use cases:
 
@@ -48,7 +51,7 @@ to come over the wire.
 ## Build-time variables
 
 All variables are optional. The only required step is
-`ENABLE_EXTENSIONS=netboot`; defaults give you a single shared rootfs
+`ROOTFS_TYPE=nfs-root`; defaults give you a single shared rootfs
 per `BOARD × BRANCH × RELEASE` and a `pxelinux.cfg/default.example`
 file to copy into place.
 
@@ -59,7 +62,7 @@ file to copy into place.
 | `NETBOOT_NFS_PATH` | see below | Absolute NFS path of the rootfs on the server. The APPEND line uses exactly this string for `nfsroot=...`. |
 | `NETBOOT_HOSTNAME` | _(empty)_ | Per-host deployment. When set, the default `NETBOOT_NFS_PATH` becomes `/srv/netboot/rootfs/hosts/<hostname>` — each machine owns its own writable rootfs copy. When empty, the default is `/srv/netboot/rootfs/shared/${LINUXFAMILY}/${BOARD}/${BRANCH}-${RELEASE}` (one image, potentially reused by identical boards). |
 | `NETBOOT_CLIENT_MAC` | _(empty)_ | Client MAC (`aa:bb:cc:dd:ee:ff` or `aa-bb-cc-dd-ee-ff`). When set, the PXE config is written as `pxelinux.cfg/01-<mac>` (the PXELINUX per-MAC override) instead of `default.example`; multiple boards then coexist on one TFTP root, each picking its own extlinux. |
-| `ROOTFS_COMPRESSION` | `gzip` | Format of the rootfs archive produced by `create_image_from_sdcard_rootfs` when `ROOTFS_TYPE=nfs`. `gzip` → `.tar.gz`, `zstd` → `.tar.zst`, `none` → no archive at all. The `none` case requires `ROOTFS_EXPORT_DIR`. |
+| `ROOTFS_COMPRESSION` | `gzip` | Format of the rootfs archive produced by `create_image_from_sdcard_rootfs`. `gzip` → `.tar.gz`, `zstd` → `.tar.zst`, `none` → no archive at all. The `none` case requires `ROOTFS_EXPORT_DIR`. |
 | `ROOTFS_EXPORT_DIR` | _(empty)_ | Absolute path. When set, the rootfs tree is rsync'd directly into this directory in addition to (or instead of) the archive. Primary use: builder host is also the NFS server — single-step `build → boot` loop with no tar/unpack/rsync step. If this path is outside `${SRC}`, the extension bind-mounts it into the build container so the same path works on host and inside Docker. |
 
 ### Hook: `netboot_artifacts_ready`
@@ -268,7 +271,7 @@ export directory.
 ./compile.sh build \
   BOARD=helios64 BRANCH=edge RELEASE=resolute \
   BUILD_MINIMAL=yes \
-  ENABLE_EXTENSIONS=netboot \
+  ROOTFS_TYPE=nfs-root \
   NETBOOT_SERVER=192.168.1.125 \
   NETBOOT_HOSTNAME=helios64-a \
   NETBOOT_CLIENT_MAC=aa:bb:cc:dd:ee:ff \
@@ -435,7 +438,7 @@ ssh root@192.168.1.1 \
 ./compile.sh build \
   BOARD=helios64 BRANCH=edge RELEASE=resolute \
   BUILD_MINIMAL=yes \
-  ENABLE_EXTENSIONS=netboot \
+  ROOTFS_TYPE=nfs-root \
   NETBOOT_SERVER=192.168.1.125 \
   ROOTFS_COMPRESSION=none \
   ROOTFS_EXPORT_DIR=/srv/netboot/rootfs/shared/rockchip64/helios64/edge-resolute

extensions/netboot/netboot.sh

@@ -35,12 +35,7 @@
 #                             etc. For builder-as-NFS-server workflows prefer
 #                             ROOTFS_EXPORT_DIR to skip the archive step.
 
-function extension_prepare_config__netboot_force_nfs_rootfs() {
-	if [[ "${ROOTFS_TYPE}" != "nfs" ]]; then
-		display_alert "${EXTENSION}: forcing ROOTFS_TYPE=nfs" "was: ${ROOTFS_TYPE:-<unset>}" "info"
-		declare -g ROOTFS_TYPE="nfs"
-	fi
-
+function extension_prepare_config__netboot_defaults_and_validate() {
 	declare -g NETBOOT_SERVER="${NETBOOT_SERVER:-}"
 	declare -g NETBOOT_HOSTNAME="${NETBOOT_HOSTNAME:-}"
 	declare -g NETBOOT_CLIENT_MAC="${NETBOOT_CLIENT_MAC:-}"
@@ -80,7 +75,7 @@ function custom_kernel_config__netboot_enable_nfs_root() {
 # On an NFS-mounted root that's always meaningless (and would error) — strip the
 # systemd enablement symlink so the unit never runs.
 function post_customize_image__netboot_disable_resize_filesystem() {
-	[[ "${ROOTFS_TYPE}" == "nfs" ]] || return 0
+	[[ "${ROOTFS_TYPE}" == "nfs-root" ]] || return 0
 	display_alert "${EXTENSION}: disabling armbian-resize-filesystem.service" "meaningless on NFS root" "info"
 	run_host_command_logged find "${SDCARD}/etc/systemd/system/" \
 		-name "armbian-resize-filesystem.service" -type l -delete
@@ -92,7 +87,7 @@ function post_customize_image__netboot_disable_resize_filesystem() {
 # wizard blocks the whole bring-up. Drop the trigger flag; default root/1234 login
 # keeps working, and armbian-firstrun.service still regenerates SSH host keys.
 function post_customize_image__netboot_skip_firstlogin_wizard() {
-	[[ "${ROOTFS_TYPE}" == "nfs" ]] || return 0
+	[[ "${ROOTFS_TYPE}" == "nfs-root" ]] || return 0
 	[[ -f "${SDCARD}/root/.not_logged_in_yet" ]] || return 0
 	display_alert "${EXTENSION}: skipping armbian-firstlogin wizard" "no interactive console assumed on netboot" "info"
 	run_host_command_logged rm -f "${SDCARD}/root/.not_logged_in_yet"
@@ -115,7 +110,7 @@ function host_pre_docker_launch__netboot_mount_export_dir() {
 }
 
 function pre_umount_final_image__900_collect_netboot_artifacts() {
-	[[ "${ROOTFS_TYPE}" == "nfs" ]] || return 0
+	[[ "${ROOTFS_TYPE}" == "nfs-root" ]] || return 0
 
 	# shellcheck disable=SC2154 # ${version} is a readonly global set in create_image_from_sdcard_rootfs
 	declare tftp_out="${DEST}/images/${version}-netboot-tftp"
@@ -144,8 +139,10 @@ function pre_umount_final_image__900_collect_netboot_artifacts() {
 		run_host_command_logged cp -a "${MOUNT}/boot/dtb/." "${tftp_prefix_dir}/dtb/"
 	fi
 
+	declare initrd_line=""
 	if [[ -f "${MOUNT}/boot/uInitrd" ]]; then
 		run_host_command_logged cp -v "${MOUNT}/boot/uInitrd" "${tftp_prefix_dir}/uInitrd"
+		initrd_line="INITRD ${NETBOOT_TFTP_PREFIX}/uInitrd"
 	fi
 
 	# When NETBOOT_SERVER is empty, leave ${serverip} literal in nfsroot= so
@@ -184,7 +181,8 @@ function pre_umount_final_image__900_collect_netboot_artifacts() {
 		LABEL armbian
 		    MENU LABEL Armbian ${BOARD} ${BRANCH} ${RELEASE} (netboot)
 		    KERNEL ${NETBOOT_TFTP_PREFIX}/${kernel_name}
-		    ${fdt_line}
+		    ${fdt_line}${initrd_line:+
+		    ${initrd_line}}
 		    APPEND root=/dev/nfs nfsroot=${nfsroot_server}:${NETBOOT_NFS_PATH},tcp,v3 ip=dhcp rw rootwait earlycon loglevel=7 panic=10
 	EXTLINUX_CONF
 

lib/functions/configuration/main-config.sh

@@ -138,6 +138,13 @@ function do_main_configuration() {
 		nfs)
 			FIXED_IMAGE_SIZE=256 # small SD card with kernel, boot script and .dtb/.bin files
 			;;
+		nfs-root)
+			# Full netboot: no local storage in the early boot path at all. Kernel,
+			# DTB and extlinux go to TFTP, rootfs is mounted over NFS. The netboot
+			# extension owns artifact staging and PXE config generation.
+			FIXED_IMAGE_SIZE=256
+			enable_extension "netboot"
+			;;
 		f2fs)
 			enable_extension "fs-f2fs-support"
 			# Fixed image size is in 1M dd blocks (MiB)
@@ -161,9 +168,9 @@ function do_main_configuration() {
 	esac
 
 	# Check if the filesystem type is supported by the build host.
-	# Skipped for nfs: ROOTFS_TYPE=nfs produces a rootfs tarball;
-	# host-side filesystem support is irrelevant for the nfs case.
-	if [[ $CONFIG_DEFS_ONLY != yes && $ROOTFS_TYPE != nfs ]]; then
+	# Skipped for nfs/nfs-root: those produce a rootfs tarball and/or export tree;
+	# host-side filesystem support is irrelevant.
+	if [[ $CONFIG_DEFS_ONLY != yes && $ROOTFS_TYPE != nfs && $ROOTFS_TYPE != nfs-root ]]; then
 		check_filesystem_compatibility_on_host
 	fi
 

lib/functions/image/partitioning.sh

@@ -20,7 +20,7 @@ function prepare_partitions() {
 
 	# possible partition combinations
 	# /boot: none, ext4, ext2, fat (BOOTFS_TYPE)
-	# root: ext4, btrfs, f2fs, nilfs2, nfs (ROOTFS_TYPE)
+	# root: ext4, btrfs, f2fs, nilfs2, nfs, nfs-root (ROOTFS_TYPE)
 
 	# declare makes local variables by default if used inside a function
 	# NOTE: mountopts string should always start with comma if not empty
@@ -121,7 +121,7 @@ function prepare_partitions() {
 		BOOTSIZE=0
 	fi
 	# Check if we need root partition
-	[[ $ROOTFS_TYPE != nfs ]] &&
+	[[ $ROOTFS_TYPE != nfs && $ROOTFS_TYPE != nfs-root ]] &&
 		local rootpart=$((next++))
 
 	display_alert "calculated rootpart" "rootpart: ${rootpart}" "debug"
@@ -144,7 +144,7 @@ function prepare_partitions() {
 		display_alert "Using user-defined image size" "$FIXED_IMAGE_SIZE MiB" "info"
 		sdsize=$FIXED_IMAGE_SIZE
 		# basic sanity check
-		if [[ $ROOTFS_TYPE != nfs && $ROOTFS_TYPE != btrfs && $sdsize -lt $rootfs_size ]]; then
+		if [[ $ROOTFS_TYPE != nfs && $ROOTFS_TYPE != nfs-root && $ROOTFS_TYPE != btrfs && $sdsize -lt $rootfs_size ]]; then
 			exit_with_error "User defined image size is too small" "$sdsize <= $rootfs_size"
 		fi
 	else

lib/functions/image/rootfs-to-image.sh

@@ -19,7 +19,7 @@ function calculate_image_version() {
 	calculated_image_version="${vendor_version_prelude}${BOARD^}_${RELEASE}_${BRANCH}_${kernel_version_for_image}${DESKTOP_ENVIRONMENT:+_$DESKTOP_ENVIRONMENT}${EXTRA_IMAGE_SUFFIX}"
 	[[ $BUILD_DESKTOP == yes ]] && calculated_image_version=${calculated_image_version}_desktop
 	[[ $BUILD_MINIMAL == yes ]] && calculated_image_version=${calculated_image_version}_minimal
-	[[ $ROOTFS_TYPE == nfs ]] && calculated_image_version=${calculated_image_version}_nfsboot
+	[[ $ROOTFS_TYPE == nfs || $ROOTFS_TYPE == nfs-root ]] && calculated_image_version=${calculated_image_version}_nfsboot
 	display_alert "Calculated image version" "${calculated_image_version}" "debug"
 }
 
@@ -40,7 +40,7 @@ function create_image_from_sdcard_rootfs() {
 	if [[ ${INCLUDE_HOME_DIR:-no} == yes ]]; then exclude_home=""; fi
 	# nilfs2 fs does not have extended attributes support, and have to be ignored on copy
 	if [[ $ROOTFS_TYPE == nilfs2 ]]; then rsync_ea=""; fi
-	if [[ $ROOTFS_TYPE != nfs ]]; then
+	if [[ $ROOTFS_TYPE != nfs && $ROOTFS_TYPE != nfs-root ]]; then
 		display_alert "Copying files via rsync to" "/ (MOUNT root)"
 		run_host_command_logged rsync -aHWh $rsync_ea \
 			--exclude="/boot" \
@@ -69,11 +69,16 @@ function create_image_from_sdcard_rootfs() {
 		if [[ "${rootfs_compression}" != "none" ]]; then
 			ROOTFS_ARCHIVE_PATH="${DEST}/images/${version}-rootfs.${archive_ext}"
 			display_alert "Creating rootfs archive" "${version}-rootfs.${archive_ext}" "info"
-			tar cp --xattrs --directory=$SDCARD/ --exclude='./boot/*' --exclude='./dev/*' --exclude='./proc/*' --exclude='./run/*' --exclude='./tmp/*' \
-				--exclude='./sys/*' $exclude_home . |
-				pv -p -b -r -s "$(du -sb "$SDCARD"/ | cut -f1)" \
-					-N "$(logging_echo_prefix_for_pv "create_rootfs_archive") rootfs.${archive_ext}" |
-				${archive_filter} > "${ROOTFS_ARCHIVE_PATH}"
+			# Subshell with pipefail so failures in tar/pv propagate (otherwise the
+			# exit code of the final compressor stage hides truncation mid-archive).
+			(
+				set -o pipefail
+				tar cp --xattrs --directory=$SDCARD/ --exclude='./boot/*' --exclude='./dev/*' --exclude='./proc/*' --exclude='./run/*' --exclude='./tmp/*' \
+					--exclude='./sys/*' $exclude_home . |
+					pv -p -b -r -s "$(du -sb "$SDCARD"/ | cut -f1)" \
+						-N "$(logging_echo_prefix_for_pv "create_rootfs_archive") rootfs.${archive_ext}" |
+					${archive_filter} > "${ROOTFS_ARCHIVE_PATH}"
+			)
 		fi
 
 		# ROOTFS_EXPORT_DIR: when set, also rsync rootfs tree into this directory.
@@ -82,7 +87,9 @@ function create_image_from_sdcard_rootfs() {
 		if [[ -n "${ROOTFS_EXPORT_DIR}" ]]; then
 			display_alert "Exporting rootfs tree" "${ROOTFS_EXPORT_DIR}" "info"
 			run_host_command_logged mkdir -pv "${ROOTFS_EXPORT_DIR}"
-			run_host_command_logged rsync -aHWh $rsync_ea \
+			# --delete so files removed from the source rootfs don't survive in a
+			# reused export tree (otherwise the NFS root silently drifts from the image).
+			run_host_command_logged rsync -aHWh --delete $rsync_ea \
 				--exclude="/boot/*" \
 				--exclude="/dev/*" \
 				--exclude="/proc/*" \