diff --git a/release/Makefile b/release/Makefile
index be628d20ba8d..85da63b0c49a 100644
--- a/release/Makefile
+++ b/release/Makefile
@@ -1,349 +1,352 @@
 #
 # Makefile for building releases and release media.
 #
 # User-driven targets:
 #  cdrom: Builds release CD-ROM media (disc1.iso)
 #  dvdrom: Builds release DVD-ROM media (dvd1.iso)
 #  memstick: Builds memory stick image (memstick.img)
 #  mini-memstick: Builds minimal memory stick image (mini-memstick.img)
 #  ftp: Sets up FTP distribution area (ftp)
-#  release: Invokes real-release, vm-release, and cloudware-release targets
+#  release: Invokes real-release, vm-release, cloudware-release and oci-release targets
 #  real-release: Build all media and FTP distribution area
 #  vm-release: Build all virtual machine image targets
 #  cloudware-release: Build all cloud hosting provider targets
-#  install: Invokes the release-install and vm-install targets
+#  oci-release: Build all OCI container images
+#  install: Invokes the release-install, vm-install and oci-install targets
 #  release-install: Copies all release installation media into ${DESTDIR}
 #  vm-install: Copies all virtual machine images into ${DESTDIR}
 #  cloud-install: Copies non-uploaded cloud images into ${DESTDIR}
+#  oci-install: Copies all OCI container images into ${DESTDIR}
 #
 # Variables affecting the build process:
 #  WORLDDIR: location of src tree -- must have built world and default kernel
 #            (by default, the directory above this one)
 #  PORTSDIR: location of ports tree to distribute (default: /usr/ports)
 #  XTRADIR:  xtra-bits-dir argument for <arch>/mkisoimages.sh
 #  NOPKG:    if set, do not distribute third-party packages
 #  NOPORTS:  if set, do not distribute ports tree
 #  NOSRC:    if set, do not distribute source tree
 #  WITH_DVD: if set, generate dvd1.iso
 #  WITH_COMPRESSED_IMAGES: if set, compress installation images with xz(1)
 #		(uncompressed images are not removed)
 #  WITH_VMIMAGES: if set, build virtual machine images with the release
 #  WITH_COMPRESSED_VMIMAGES: if set, compress virtual machine disk images
 #  		with xz(1) (extremely time consuming)
 #  WITH_CLOUDWARE: if set, build cloud hosting disk images with the release
 #  TARGET/TARGET_ARCH: architecture of built release
 #
 
 WORLDDIR?=	${.CURDIR}/..
 PORTSDIR?=	/usr/ports
 
 .include "${WORLDDIR}/share/mk/bsd.compat.pre.mk"
 
 .if !defined(TARGET) || empty(TARGET)
 TARGET=		${MACHINE}
 .endif
 .if !defined(TARGET_ARCH) || empty(TARGET_ARCH)
 .if ${TARGET} == ${MACHINE}
 TARGET_ARCH=	${MACHINE_ARCH}
 .else
 TARGET_ARCH=	${TARGET}
 .endif
 .endif
 IMAKE=		${MAKE} TARGET_ARCH=${TARGET_ARCH} TARGET=${TARGET}
 DISTDIR=	dist
 
 # Define OSRELEASE by using newvers.sh
 .if !defined(OSRELEASE) || empty(OSRELEASE)
 .for _V in TYPE BRANCH REVISION
 ${_V}!=	eval $$(awk '/^${_V}=/{print}' ${.CURDIR}/../sys/conf/newvers.sh); echo $$${_V}
 .endfor
 .for _V in ${TARGET_ARCH}
 .if !empty(TARGET:M${_V})
 OSRELEASE=	${TYPE}-${REVISION}-${BRANCH}-${TARGET}
 VOLUME_LABEL=	${REVISION:C/[.-]/_/g}_${BRANCH:C/[.-]/_/g}_${TARGET}
 .else
 OSRELEASE=	${TYPE}-${REVISION}-${BRANCH}-${TARGET}-${TARGET_ARCH}
 VOLUME_LABEL=	${REVISION:C/[.-]/_/g}_${BRANCH:C/[.-]/_/g}_${TARGET_ARCH}
 .endif
 .endfor
 .endif
 
 .if !defined(VOLUME_LABEL) || empty(VOLUME_LABEL)
 VOLUME_LABEL=	FreeBSD_Install
 .endif
 
 .if !exists(${PORTSDIR})
 NOPORTS= true
 .endif
 
 DISTRIBUTIONS= base.txz kernel.txz
 .if !defined(NOPORTS)
 DISTRIBUTIONS+= ports.txz
 .endif
 .if !defined(NOSRC)
 DISTRIBUTIONS+= src.txz
 .endif
 
 RELEASE_TARGETS= ftp
 IMAGES=
 .if exists(${.CURDIR}/${TARGET}/mkisoimages.sh)
 RELEASE_TARGETS+= cdrom
 IMAGES+=	disc1.iso bootonly.iso
 . if defined(WITH_DVD) && !empty(WITH_DVD)
 RELEASE_TARGETS+= dvdrom
 IMAGES+=	dvd1.iso
 . endif
 .endif
 .if exists(${.CURDIR}/${TARGET}/make-memstick.sh)
 RELEASE_TARGETS+= memstick.img
 RELEASE_TARGETS+= mini-memstick.img
 IMAGES+=	memstick.img
 IMAGES+=	mini-memstick.img
 .endif
 
 CLEANFILES=	packagesystem *.txz MANIFEST release ${IMAGES}
 .if defined(WITH_COMPRESSED_IMAGES) && !empty(WITH_COMPRESSED_IMAGES)
 . for I in ${IMAGES}
 CLEANFILES+=	${I}.xz
 . endfor
 .endif
 .if defined(WITH_DVD) && !empty(WITH_DVD)
 CLEANFILES+=	pkg-stage
 .endif
 CLEANDIRS=	dist ftp disc1 disc1-disc1 disc1-memstick bootonly bootonly-bootonly bootonly-memstick dvd
 beforeclean:
 	chflags -R noschg .
 .include <bsd.obj.mk>
 clean: beforeclean
 
 base.txz:
 	mkdir -p ${DISTDIR}
 	( cd ${WORLDDIR} && ${IMAKE} distributeworld DISTDIR=${.OBJDIR}/${DISTDIR} )
 	# Bootstrap etcupdate(8) database.
 	sh ${WORLDDIR}/usr.sbin/etcupdate/etcupdate.sh extract -B \
 	    -m "${MAKE}" -M "TARGET_ARCH=${TARGET_ARCH} TARGET=${TARGET}" \
 	    -s ${WORLDDIR} -d "${.OBJDIR}/${DISTDIR}/base/var/db/etcupdate" \
 	    -L /dev/null ${NO_ROOT:D-N}
 .if defined(NO_ROOT)
 	echo "./var/db/etcupdate type=dir uname=root gname=wheel mode=0755" >> ${.OBJDIR}/${DISTDIR}/base.meta
 	sed -n 's,^\.,./var/db/etcupdate/current,p' ${.OBJDIR}/${DISTDIR}/base/var/db/etcupdate/current/METALOG \
 	    >> ${.OBJDIR}/${DISTDIR}/base.meta
 	rm ${.OBJDIR}/${DISTDIR}/base/var/db/etcupdate/current/METALOG
 .endif
 # Package all components
 	( cd ${WORLDDIR} && ${IMAKE} packageworld DISTDIR=${.OBJDIR}/${DISTDIR} )
 	mv ${DISTDIR}/*.txz .
 
 kernel.txz:
 	mkdir -p ${DISTDIR}
 	( cd ${WORLDDIR} && ${IMAKE} distributekernel DISTDIR=${.OBJDIR}/${DISTDIR} )
 	( cd ${WORLDDIR} && ${IMAKE} packagekernel DISTDIR=${.OBJDIR}/${DISTDIR} )
 	mv ${DISTDIR}/kernel*.txz .
 
 src.txz:
 	mkdir -p ${DISTDIR}/usr
 	ln -fs ${WORLDDIR} ${DISTDIR}/usr/src
 	( cd ${DISTDIR} && ${TAR_CMD} cLvf - --exclude .svn --exclude .zfs \
 	    --exclude .git --exclude @ --exclude usr/src/release/dist usr/src | \
 	    ${XZ_CMD} > ${.OBJDIR}/src.txz )
 
 ports.txz:
 	mkdir -p ${DISTDIR}/usr
 	ln -fs ${PORTSDIR} ${DISTDIR}/usr/ports
 	( cd ${DISTDIR} && ${TAR_CMD} cLvf - \
 	    --exclude .git --exclude .svn \
 	    --exclude usr/ports/distfiles --exclude usr/ports/packages \
 	    --exclude 'usr/ports/INDEX*' --exclude work usr/ports | \
 	    ${XZ_CMD} > ${.OBJDIR}/ports.txz )
 
 disc1: packagesystem
 # Install system
 	mkdir -p ${.TARGET}
 	( cd ${WORLDDIR} && ${IMAKE} installworld installkernel distribution \
 	    DESTDIR=${.OBJDIR}/${.TARGET} MK_AT=no \
 	    MK_INSTALLLIB=no MK_MAIL=no \
 	    ${_ALL_LIBCOMPATS:@v@MK_LIB$v=no@} \
 	    MK_TOOLCHAIN=no MK_PROFILE=no \
 	    MK_RESCUE=no MK_DICT=no \
 	    MK_KERNEL_SYMBOLS=no MK_TESTS=no MK_DEBUG_FILES=no \
 	    -DDB_FROM_SRC )
 # Copy distfiles
 	mkdir -p ${.TARGET}/usr/freebsd-dist
 	for dist in MANIFEST $$(ls *.txz | grep -vE -- '(${base ${_ALL_libcompats}:L:ts|})-dbg'); \
 	    do cp $${dist} ${.TARGET}/usr/freebsd-dist; \
 	done
 .if defined(NO_ROOT)
 	echo "./usr/freebsd-dist type=dir uname=root gname=wheel mode=0755" >> ${.TARGET}/METALOG
 	for dist in MANIFEST $$(ls *.txz | grep -vE -- '(${base ${_ALL_libcompats}:L:ts|})-dbg'); \
 	    do echo "./usr/freebsd-dist/$${dist} type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG; \
 	done
 .endif
 # Set up installation environment
 	ln -fs /tmp/bsdinstall_etc/resolv.conf ${.TARGET}/etc/resolv.conf
 	echo sendmail_enable=\"NONE\" > ${.TARGET}/etc/rc.conf
 	echo hostid_enable=\"NO\" >> ${.TARGET}/etc/rc.conf
 	echo debug.witness.trace=0 >> ${.TARGET}/etc/sysctl.conf
 	echo vfs.mountroot.timeout=\"10\" >> ${.TARGET}/boot/loader.conf
 	echo kernels_autodetect=\"NO\" >> ${.TARGET}/boot/loader.conf
 	echo loader_menu_multi_user_prompt=\"Installer\" >> ${.TARGET}/boot/loader.conf
 	cp ${.CURDIR}/rc.local ${.TARGET}/etc
 .if defined(NO_ROOT)
 	echo "./etc/resolv.conf type=link uname=root gname=wheel mode=0644 link=/tmp/bsdinstall_etc/resolv.conf" >> ${.TARGET}/METALOG
 	echo "./etc/rc.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/sysctl.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./boot/loader.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/rc.local type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 .endif
 	touch ${.TARGET}
 
 bootonly: packagesystem
 # Install system
 	mkdir -p ${.TARGET}
 	( cd ${WORLDDIR} && ${IMAKE} installworld installkernel distribution \
 	    DESTDIR=${.OBJDIR}/${.TARGET} MK_AT=no \
 	    MK_GAMES=no \
 	    MK_INSTALLLIB=no MK_MAIL=no \
 	    ${_ALL_LIBCOMPATS:@v@MK_LIB$v=no@} \
 	    MK_TOOLCHAIN=no MK_PROFILE=no \
 	    MK_RESCUE=no MK_DICT=no \
 	    MK_KERNEL_SYMBOLS=no MK_TESTS=no MK_DEBUG_FILES=no \
 	    -DDB_FROM_SRC )
 # Copy manifest only (no distfiles) to get checksums
 	mkdir -p ${.TARGET}/usr/freebsd-dist
 	cp MANIFEST ${.TARGET}/usr/freebsd-dist
 .if defined(NO_ROOT)
 	echo "./usr/freebsd-dist type=dir uname=root gname=wheel mode=0755" >> ${.TARGET}/METALOG
 	echo "./usr/freebsd-dist/MANIFEST type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 .endif
 # Set up installation environment
 	ln -fs /tmp/bsdinstall_etc/resolv.conf ${.TARGET}/etc/resolv.conf
 	echo sendmail_enable=\"NONE\" > ${.TARGET}/etc/rc.conf
 	echo hostid_enable=\"NO\" >> ${.TARGET}/etc/rc.conf
 	echo debug.witness.trace=0 >> ${.TARGET}/etc/sysctl.conf
 	echo vfs.mountroot.timeout=\"10\" >> ${.TARGET}/boot/loader.conf
 	echo kernels_autodetect=\"NO\" >> ${.TARGET}/boot/loader.conf
 	echo loader_menu_multi_user_prompt=\"Installer\" >> ${.TARGET}/boot/loader.conf
 	cp ${.CURDIR}/rc.local ${.TARGET}/etc
 .if defined(NO_ROOT)
 	echo "./etc/resolv.conf type=link uname=root gname=wheel mode=0644 link=/tmp/bsdinstall_etc/resolv.conf" >> ${.TARGET}/METALOG
 	echo "./etc/rc.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/sysctl.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./boot/loader.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/rc.local type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 .endif
 
 dvd: packagesystem
 # Install system
 	mkdir -p ${.TARGET}
 	( cd ${WORLDDIR} && ${IMAKE} installworld installkernel distribution \
 		DESTDIR=${.OBJDIR}/${.TARGET} MK_RESCUE=no MK_KERNEL_SYMBOLS=no \
 		MK_TESTS=no MK_DEBUG_FILES=no \
 		-DDB_FROM_SRC )
 # Copy distfiles
 	mkdir -p ${.TARGET}/usr/freebsd-dist
 	for dist in MANIFEST *.txz; \
 	    do cp $${dist} ${.TARGET}/usr/freebsd-dist; \
 	done
 .if defined(NO_ROOT)
 	echo "./usr/freebsd-dist type=dir uname=root gname=wheel mode=0755" >> ${.TARGET}/METALOG
 	for dist in MANIFEST *.txz; \
 	    do echo "./usr/freebsd-dist/$${dist} type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG; \
 	done
 .endif
 # Set up installation environment
 	ln -fs /tmp/bsdinstall_etc/resolv.conf ${.TARGET}/etc/resolv.conf
 	echo sendmail_enable=\"NONE\" > ${.TARGET}/etc/rc.conf
 	echo hostid_enable=\"NO\" >> ${.TARGET}/etc/rc.conf
 	echo debug.witness.trace=0 >> ${.TARGET}/etc/sysctl.conf
 	echo vfs.mountroot.timeout=\"10\" >> ${.TARGET}/boot/loader.conf
 	echo kernels_autodetect=\"NO\" >> ${.TARGET}/boot/loader.conf
 	echo loader_menu_multi_user_prompt=\"Installer\" >> ${.TARGET}/boot/loader.conf
 	cp ${.CURDIR}/rc.local ${.TARGET}/etc
 .if defined(NO_ROOT)
 	echo "./etc/resolv.conf type=link uname=root gname=wheel mode=0644 link=/tmp/bsdinstall_etc/resolv.conf" >> ${.TARGET}/METALOG
 	echo "./etc/rc.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/sysctl.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./boot/loader.conf type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 	echo "./etc/rc.local type=file uname=root gname=wheel mode=0644" >> ${.TARGET}/METALOG
 .endif
 	touch ${.TARGET}
 
 disc1-disc1 disc1-memstick: disc1
 	mkdir ${.TARGET}
 	tar -cf- -C disc1 . | tar -xf- -C ${.TARGET}
 
 bootonly-bootonly bootonly-memstick: bootonly
 	mkdir ${.TARGET}
 	tar -cf- -C bootonly . | tar -xf- -C ${.TARGET}
 
 release.iso: disc1.iso
 disc1.iso: disc1-disc1
 	cd disc1-disc1 && sh ${.CURDIR}/${TARGET}/mkisoimages.sh -b ${VOLUME_LABEL}_CD ../${.TARGET} .${NO_ROOT:D/METALOG} ${XTRADIR}
 
 dvd1.iso: dvd pkg-stage
 	cd dvd && sh ${.CURDIR}/${TARGET}/mkisoimages.sh -b ${VOLUME_LABEL}_DVD ../${.TARGET} .${NO_ROOT:D/METALOG} ${XTRADIR}
 
 bootonly.iso: bootonly-bootonly
 	cd bootonly-bootonly && sh ${.CURDIR}/${TARGET}/mkisoimages.sh -b ${VOLUME_LABEL}_BO ../${.TARGET} .${NO_ROOT:D/METALOG} ${XTRADIR}
 
 memstick: memstick.img
 memstick.img: disc1-memstick
 	cd disc1-memstick && sh ${.CURDIR}/${TARGET}/make-memstick.sh .${NO_ROOT:D/METALOG} ../${.TARGET}
 
 mini-memstick: mini-memstick.img
 mini-memstick.img: bootonly-memstick
 	cd bootonly-memstick && sh ${.CURDIR}/${TARGET}/make-memstick.sh .${NO_ROOT:D/METALOG} ../${.TARGET}
 
 packagesystem: ${DISTRIBUTIONS}
 	sh ${.CURDIR}/scripts/make-manifest.sh *.txz > MANIFEST
 	touch ${.TARGET}
 
 pkg-stage: dvd
 # TODO: Support for -DNO_ROOT
 .if !defined(NOPKG) || empty(NOPKG)
 	env PORTSDIR=${PORTSDIR} REPOS_DIR=${.CURDIR}/pkg_repos/ \
 		sh ${.CURDIR}/scripts/pkg-stage.sh
 	mkdir -p ${.OBJDIR}/dvd/packages/repos/
 	cp ${.CURDIR}/scripts/FreeBSD_install_cdrom.conf \
 		${.OBJDIR}/dvd/packages/repos/
 .endif
 	touch ${.TARGET}
 
 cdrom: disc1.iso bootonly.iso
 dvdrom: dvd1.iso
 ftp: packagesystem
 	rm -rf ftp
 	mkdir -p ftp
 	cp *.txz MANIFEST ftp
 
-release:	real-release vm-release cloudware-release
+release:	real-release vm-release cloudware-release oci-release
 	${MAKE} -C ${.CURDIR} ${.MAKEFLAGS} release-done
 	true
 
 release-done:
 	touch release
 
 real-release:
 	${MAKE} -C ${.CURDIR} ${.MAKEFLAGS} obj
 	${MAKE} -C ${.CURDIR} ${.MAKEFLAGS} ${RELEASE_TARGETS}
 
-install:	release-install vm-install .WAIT cloud-install
+install:	release-install vm-install oci-install .WAIT cloud-install
 
 release-install:
 .if defined(DESTDIR) && !empty(DESTDIR)
 	mkdir -p ${DESTDIR}
 .endif
 	cp -a ftp ${DESTDIR}/
 .if !empty(IMAGES)
 .for I in ${IMAGES}
 	cp -p ${I} ${DESTDIR}/${OSRELEASE}-${I}
 . if defined(WITH_COMPRESSED_IMAGES) && !empty(WITH_COMPRESSED_IMAGES)
 	${XZ_CMD} -k ${DESTDIR}/${OSRELEASE}-${I}
 . endif
 .endfor
 	( cd ${DESTDIR} && sha512 ${OSRELEASE}* > ${DESTDIR}/CHECKSUM.SHA512 )
 	( cd ${DESTDIR} && sha256 ${OSRELEASE}* > ${DESTDIR}/CHECKSUM.SHA256 )
 .endif
 
 .include "${.CURDIR}/Makefile.inc1"
 .include "${.CURDIR}/Makefile.vm"
+.include "${.CURDIR}/Makefile.oci"
diff --git a/release/Makefile.oci b/release/Makefile.oci
new file mode 100644
index 000000000000..461c95f49636
--- /dev/null
+++ b/release/Makefile.oci
@@ -0,0 +1,34 @@
+#
+#
+#
+# Makefile for building OCI container images.
+#
+
+.if defined(WITH_OCIIMAGES) && !empty(WITH_OCIIMAGES)
+OCI_IMAGES= static dynamic minimal
+.endif
+
+oci-install:
+.if defined(WITH_OCIIMAGES) && !empty(WITH_OCIIMAGES)
+	mkdir -p ${DESTDIR}/ociimages
+. for _IMG in ${OCI_IMAGES}
+	cp -p ${.OBJDIR}/container-image-${_IMG}.txz ${DESTDIR}/ociimages
+. endfor
+.endif
+
+OCI_TARGETS=
+OCI_DEPS_static=
+OCI_DEPS_dynamic= container-image-static.txz
+OCI_DEPS_minimal= container-image-dynamic.txz
+
+.for _IMG in ${OCI_IMAGES}
+OCI_TARGETS+= container-image-${_IMG}.txz
+container-image-${_IMG}.txz: ${OCI_DEPS_${_IMG}}
+	sh ${.CURDIR}/scripts/make-oci-image.sh ${.CURDIR} ${REVISION} ${BRANCH} ${TARGET_ARCH} ${_IMG}
+	skopeo copy \
+		containers-storage:localhost/freebsd${REVISION:R}-${_IMG}:latest \
+		oci-archive:${.OBJDIR}/container-image-${_IMG}.tar:freebsd${REVISION:R}-${_IMG}:${REVISION}-${BRANCH}-${TARGET_ARCH}
+	${XZ_CMD} < ${.OBJDIR}/container-image-${_IMG}.tar > ${.OBJDIR}/container-image-${_IMG}.txz
+.endfor
+
+oci-release: ${OCI_TARGETS}
diff --git a/release/release.conf.sample b/release/release.conf.sample
index c306efb13b65..e583e49828d4 100644
--- a/release/release.conf.sample
+++ b/release/release.conf.sample
@@ -1,116 +1,120 @@
 #!/bin/sh
 #
 
 ## Redefine environment variables here to override prototypes
 ## defined in release.sh.
 #load_chroot_env() { }
 #load_target_env() { }
 #buildenv_setup() { }
 
 ## Set the directory within which the release will be built.
 CHROOTDIR="/scratch"
 
 ## Do not explicitly require the devel/git port to be installed.
 #NOGIT=1
 ## Set the version control system host.
 GITROOT="https://git.freebsd.org/"
 GITSRC="src.git"
 GITPORTS="ports.git"
 
 ## Set the src/, ports/, and doc/ branches or tags.
 SRCBRANCH="main"
 PORTBRANCH="main"
 
 ## Sample configuration for using git from ports.
 #GITCMD="/usr/local/bin/git clone -q --branch main"
 
 ## Set to override the default target architecture.
 #TARGET="amd64"
 #TARGET_ARCH="amd64"
 #KERNEL="GENERIC"
 ## Multiple kernels may be set.
 #KERNEL="GENERIC XENHVM"
 
 ## Set to specify a custom make.conf and/or src.conf
 #MAKE_CONF="/etc/local/make.conf"
 #SRC_CONF="/etc/local/src.conf"
 
 ## Set to use make(1) flags.
 #MAKE_FLAGS="-s"
 
 ## Set to use world- and kernel-specific make(1) flags.
 #WORLD_FLAGS="-j $(sysctl -n hw.ncpu)"
 #KERNEL_FLAGS="-j $(( $(( $(sysctl -n hw.ncpu) + 1 )) / 2 ))"
 
 ## Set miscellaneous 'make release' settings.
 #NOPORTS=
 #NOSRC=
 #WITH_DVD=
 #WITH_COMPRESSED_IMAGES=
 
 ## Set to '1' to disable multi-threaded xz(1) compression.
 #XZ_THREADS=0
 
 ## Set when building embedded images.
 #EMBEDDEDBUILD=
 
 ## Set to a list of ports required to build embedded system-on-chip
 ## images, such as sysutils/u-boot-rpi.
 #EMBEDDEDPORTS=
 
 ## Set to the hardware platform of the target userland.  This value
 ## is passed to make(1) to set the TARGET (value of uname -m) to cross
 ## build.
 #EMBEDDED_TARGET=
 
 ## Set to the machine processor architecture of the target userland.
 ## This value is passed to make(1) to set the TARGET_ARCH (value of uname -p)
 ## to cross build.
 #EMBEDDED_TARGET_ARCH=
 
 ## Set to skip the chroot environment buildworld/installworld/distribution
 ## step if it is expected the build environment will exist via alternate
 ## means.
 #CHROOTBUILD_SKIP=
 
 ## Set to a non-empty value skip checkout or update of /usr/src in
 ## the chroot.  This is intended for use when /usr/src already exists.
 #SRC_UPDATE_SKIP=
 
 ## Set to a non-empty value skip checkout or update of /usr/ports in
 ## the chroot.  This is intended for use when /usr/ports already exists.
 #PORTS_UPDATE_SKIP=
 
 ## Set to pass additional flags to make(1) for the build chroot setup, such
 ## as TARGET/TARGET_ARCH.
 #CHROOT_MAKEENV=
 
 ## Set to a non-empty value to build virtual machine images as part of the
 ## release build.
 #WITH_VMIMAGES=
 
 ## Set to a non-empty value to compress virtual machine images with xz(1)
 ## as part of the release build.
 #WITH_COMPRESSED_VMIMAGES=
 
 ## If WITH_VMIMAGES is set to a non-empty value, this is the name of the
 ## file to use for the installed userland/kernel.
 #VMBASE="vm"
 
 ## If WITH_VMIMAGES is set to a non-empty value, this is the size of the
 ## virtual machine disk filesystem.  Valid size values are described in
 ## the makefs(8) manual page.
 #VMSIZE="20g"
 
 ## If WITH_VMIMAGES is set to a non-empty value, this is a list of disk
 ## image formats to create.  Valid values are listed in the mkimg(1)
 ## manual page, as well as 'mkimg --formats' output.
 #VMFORMATS="vhdf vmdk qcow2 raw"
 
 ## Set to a non-empty value to build virtual machine images for various
 ## cloud providers as part of the release build.
 #WITH_CLOUDWARE=
 
 ## If WITH_CLOUDWARE is set to a non-empty value, this is a list of providers
 ## to create disk images.
 #CLOUDWARE="EC2 GCE ORACLE VAGRANT-VIRTUALBOX VAGRANT-VMWARE"
+
+## If WITH_OCIIMAGES is set to a non-empty value, build Open Container
+## Initiative (OCI) base images as part of the release.
+#WITH_OCIIMAGES=
diff --git a/release/release.sh b/release/release.sh
index cee0fbd5643d..d6752e016994 100755
--- a/release/release.sh
+++ b/release/release.sh
@@ -1,453 +1,498 @@
 #!/bin/sh
 #-
 # Copyright (c) 2020-2021 Rubicon Communications, LLC (netgate.com)
 # Copyright (c) 2013-2019 The FreeBSD Foundation
 # Copyright (c) 2013 Glen Barber
 # Copyright (c) 2011 Nathan Whitehorn
 # All rights reserved.
 #
 # Portions of this software were developed by Glen Barber
 # under sponsorship from the FreeBSD Foundation.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
 #    notice, this list of conditions and the following disclaimer.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
 #
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
 # release.sh: check out source trees, and build release components with
 #  totally clean, fresh trees.
 # Based on release/generate-release.sh written by Nathan Whitehorn
 #
 
 export PATH="/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin"
 
 VERSION=3
 
 # Prototypes that can be redefined per-chroot or per-target.
 load_chroot_env() { }
 load_target_env() { }
 buildenv_setup() { }
 
 usage() {
 	echo "Usage: $0 [-c release.conf]"
 	exit 1
 }
 
 # env_setup(): Set up the default build environment variables, such as the
 # CHROOTDIR, VCSCMD, GITROOT, etc.  This is called before the release.conf
 # file is sourced, if '-c <release.conf>' is specified.
 env_setup() {
 	# The directory within which the release will be built.
 	CHROOTDIR="/scratch"
 	if [ -z "${RELENGDIR}" ]; then
 		export RELENGDIR="$(dirname $(realpath ${0}))"
 	fi
 
 	# The default version control system command to obtain the sources.
 	for _dir in /usr/bin /usr/local/bin; do
 		[ -x "${_dir}/git" ] && VCSCMD="/${_dir}/git"
 		[ ! -z "${VCSCMD}" ] && break 2
 	done
 
 	if [ -z "${VCSCMD}" -a -z "${NOGIT}" ]; then
 		echo "*** The devel/git port/package is required."
 		exit 1
 	fi
 	VCSCMD="/usr/local/bin/git clone -q"
 
 	# The default git checkout server, and branches for src/, doc/,
 	# and ports/.
 	GITROOT="https://git.FreeBSD.org/"
 	SRCBRANCH="main"
 	PORTBRANCH="main"
 	GITSRC="src.git"
 	GITPORTS="ports.git"
 
 	# Set for embedded device builds.
 	EMBEDDEDBUILD=
 
 	# The default make.conf and src.conf to use.  Set to /dev/null
 	# by default to avoid polluting the chroot(8) environment with
 	# non-default settings.
 	MAKE_CONF="/dev/null"
 	SRC_CONF="/dev/null"
 
 	# The number of make(1) jobs, defaults to the number of CPUs available
 	# for buildworld, and half of number of CPUs available for buildkernel
 	# and 'make release'.
 	WORLD_FLAGS="-j$(sysctl -n hw.ncpu)"
 	KERNEL_FLAGS="-j$(( $(( $(sysctl -n hw.ncpu) + 1 )) / 2))"
 	RELEASE_FLAGS="-j$(( $(( $(sysctl -n hw.ncpu) + 1 )) / 2))"
 
 	MAKE_FLAGS="-s"
 
 	# The name of the kernel to build, defaults to GENERIC.
 	KERNEL="GENERIC"
 
 	# Set to non-empty value to disable checkout of doc/ and/or ports/.
 	NOPORTS=
 
 	# Set to non-empty value to disable distributing source tree.
 	NOSRC=
 
 	# Set to non-empty value to build dvd1.iso as part of the release.
 	WITH_DVD=
 	WITH_COMPRESSED_IMAGES=
 
 	# Set to non-empty value to build virtual machine images as part of
 	# the release.
 	WITH_VMIMAGES=
 	WITH_COMPRESSED_VMIMAGES=
 	XZ_THREADS=0
 
 	# Set to non-empty value to build virtual machine images for various
 	# cloud providers as part of the release.
 	WITH_CLOUDWARE=
 
+	# Set to non-empty to build OCI images as part of the release
+	WITH_OCIIMAGES=
+
 	return 0
 } # env_setup()
 
 # env_check(): Perform sanity tests on the build environment, such as ensuring
 # files/directories exist, as well as adding backwards-compatibility hacks if
 # necessary.  This is called unconditionally, and overrides the defaults set
 # in env_setup() if '-c <release.conf>' is specified.
 env_check() {
 	chroot_build_release_cmd="chroot_build_release"
 
 	# Prefix the branches with the GITROOT for the full checkout URL.
 	SRC="${GITROOT}${GITSRC}"
 	PORT="${GITROOT}${GITPORTS}"
 
 	if [ -n "${EMBEDDEDBUILD}" ]; then
 		WITH_DVD=
 		WITH_COMPRESSED_IMAGES=
 		case ${EMBEDDED_TARGET}:${EMBEDDED_TARGET_ARCH} in
 			arm:arm*|arm64:aarch64|riscv:riscv64*)
 				chroot_build_release_cmd="chroot_arm_build_release"
 				;;
 			*)
 				;;
 		esac
 	fi
 
 	# If NOSRC and/or NOPORTS are unset, they must not pass to make
 	# as variables.  The release makefile verifies definedness of the
 	# NOPORTS variable instead of its value.
 	SRCPORTS=
 	if [ -n "${NOPORTS}" ]; then
 		SRCPORTS="NOPORTS=yes"
 	fi
 	if [ -n "${NOSRC}" ]; then
 		SRCPORTS="${SRCPORTS}${SRCPORTS:+ }NOSRC=yes"
 	fi
 
 	# The aggregated build-time flags based upon variables defined within
 	# this file, unless overridden by release.conf.  In most cases, these
 	# will not need to be changed.
 	CONF_FILES="__MAKE_CONF=${MAKE_CONF} SRCCONF=${SRC_CONF}"
 	NOCONF_FILES="__MAKE_CONF=/dev/null SRCCONF=/dev/null"
 	if [ -n "${TARGET}" ] && [ -n "${TARGET_ARCH}" ]; then
 		ARCH_FLAGS="TARGET=${TARGET} TARGET_ARCH=${TARGET_ARCH}"
 	else
 		ARCH_FLAGS=
 	fi
 
 	if [ -z "${CHROOTDIR}" ]; then
 		echo "Please set CHROOTDIR."
 		exit 1
 	fi
 
 	if [ $(id -u) -ne 0 ]; then
 		echo "Needs to be run as root."
 		exit 1
 	fi
 
 	# Unset CHROOTBUILD_SKIP if the chroot(8) does not appear to exist.
 	if [ ! -z "${CHROOTBUILD_SKIP}" -a ! -e ${CHROOTDIR}/bin/sh ]; then
 		CHROOTBUILD_SKIP=
 	fi
 
 	CHROOT_MAKEENV="${CHROOT_MAKEENV} \
 		MAKEOBJDIRPREFIX=${CHROOTDIR}/tmp/obj"
 	CHROOT_WMAKEFLAGS="${MAKE_FLAGS} ${WORLD_FLAGS} ${NOCONF_FILES}"
 	CHROOT_IMAKEFLAGS="${WORLD_FLAGS} ${NOCONF_FILES}"
 	CHROOT_DMAKEFLAGS="${WORLD_FLAGS} ${NOCONF_FILES}"
 	RELEASE_WMAKEFLAGS="${MAKE_FLAGS} ${WORLD_FLAGS} ${ARCH_FLAGS} \
 		${CONF_FILES}"
 	RELEASE_KMAKEFLAGS="${MAKE_FLAGS} ${KERNEL_FLAGS} \
 		KERNCONF=\"${KERNEL}\" ${ARCH_FLAGS} ${CONF_FILES}"
 	RELEASE_RMAKEFLAGS="${ARCH_FLAGS} ${RELEASE_FLAGS} \
 		KERNCONF=\"${KERNEL}\" ${CONF_FILES} ${SRCPORTS} \
 		WITH_DVD=${WITH_DVD} WITH_VMIMAGES=${WITH_VMIMAGES} \
-		WITH_CLOUDWARE=${WITH_CLOUDWARE} XZ_THREADS=${XZ_THREADS}"
+		WITH_CLOUDWARE=${WITH_CLOUDWARE} WITH_OCIIMAGES=${WITH_OCIIMAGES} \
+		XZ_THREADS=${XZ_THREADS}"
 
 	return 0
 } # env_check()
 
 # chroot_setup(): Prepare the build chroot environment for the release build.
 chroot_setup() {
 	load_chroot_env
 	mkdir -p ${CHROOTDIR}/usr
 
 	if [ -z "${SRC_UPDATE_SKIP}" ]; then
 		if [ -d "${CHROOTDIR}/usr/src/.git" ]; then
 			git -C ${CHROOTDIR}/usr/src pull -q
 		else
 			${VCSCMD} ${SRC} -b ${SRCBRANCH} ${CHROOTDIR}/usr/src
 		fi
 	fi
 	if [ -z "${NOPORTS}" ] && [ -z "${PORTS_UPDATE_SKIP}" ]; then
 		if [ -d "${CHROOTDIR}/usr/ports/.git" ]; then
 			git -C ${CHROOTDIR}/usr/ports pull -q
 		else
 			${VCSCMD} ${PORT} -b ${PORTBRANCH} ${CHROOTDIR}/usr/ports
 		fi
 	fi
 
 	if [ -z "${CHROOTBUILD_SKIP}" ]; then
 		cd ${CHROOTDIR}/usr/src
 		env ${CHROOT_MAKEENV} make ${CHROOT_WMAKEFLAGS} buildworld
 		env ${CHROOT_MAKEENV} make ${CHROOT_IMAKEFLAGS} installworld \
 			DESTDIR=${CHROOTDIR}
 		env ${CHROOT_MAKEENV} make ${CHROOT_DMAKEFLAGS} distribution \
 			DESTDIR=${CHROOTDIR}
 	fi
 
 	return 0
 } # chroot_setup()
 
 # extra_chroot_setup(): Prepare anything additional within the build
 # necessary for the release build.
 extra_chroot_setup() {
 	mkdir -p ${CHROOTDIR}/dev
 	mount -t devfs devfs ${CHROOTDIR}/dev
 	[ -e /etc/resolv.conf -a ! -e ${CHROOTDIR}/etc/resolv.conf ] && \
 		cp /etc/resolv.conf ${CHROOTDIR}/etc/resolv.conf
 	# Run ldconfig(8) in the chroot directory so /var/run/ld-elf*.so.hints
 	# is created.  This is needed by ports-mgmt/pkg.
 	eval chroot ${CHROOTDIR} /etc/rc.d/ldconfig forcerestart
 
 	# If MAKE_CONF and/or SRC_CONF are set and not character devices
 	# (/dev/null), copy them to the chroot.
 	if [ -e ${MAKE_CONF} ] && [ ! -c ${MAKE_CONF} ]; then
 		mkdir -p ${CHROOTDIR}/$(dirname ${MAKE_CONF})
 		cp ${MAKE_CONF} ${CHROOTDIR}/${MAKE_CONF}
 	fi
 	if [ -e ${SRC_CONF} ] && [ ! -c ${SRC_CONF} ]; then
 		mkdir -p ${CHROOTDIR}/$(dirname ${SRC_CONF})
 		cp ${SRC_CONF} ${CHROOTDIR}/${SRC_CONF}
 	fi
 
 	_gitcmd="$(which git)"
 	if [ -z "${NOGIT}" -a -z "${_gitcmd}" ]; then
 		# Install git from ports if the ports tree is available;
 		# otherwise install the pkg.
 		if [ -d ${CHROOTDIR}/usr/ports ]; then
 			# Trick the ports 'run-autotools-fixup' target to do the right
 			# thing.
 			_OSVERSION=$(chroot ${CHROOTDIR} /usr/bin/uname -U)
 			REVISION=$(chroot ${CHROOTDIR} make -C /usr/src/release -V REVISION)
 			BRANCH=$(chroot ${CHROOTDIR} make -C /usr/src/release -V BRANCH)
 			UNAME_r=${REVISION}-${BRANCH}
 			GITUNSETOPTS="CONTRIB CURL CVS GITWEB GUI HTMLDOCS"
 			GITUNSETOPTS="${GITUNSETOPTS} ICONV NLS P4 PERL"
 			GITUNSETOPTS="${GITUNSETOPTS} SEND_EMAIL SUBTREE SVN"
 			GITUNSETOPTS="${GITUNSETOPTS} PCRE PCRE2"
 			PBUILD_FLAGS="OSVERSION=${_OSVERSION} BATCH=yes"
 			PBUILD_FLAGS="${PBUILD_FLAGS} UNAME_r=${UNAME_r}"
 			PBUILD_FLAGS="${PBUILD_FLAGS} OSREL=${REVISION}"
 			PBUILD_FLAGS="${PBUILD_FLAGS} WRKDIRPREFIX=/tmp/ports"
 			PBUILD_FLAGS="${PBUILD_FLAGS} DISTDIR=/tmp/distfiles"
 			eval chroot ${CHROOTDIR} env OPTIONS_UNSET=\"${GITUNSETOPTS}\" \
 				${PBUILD_FLAGS} \
 				make -C /usr/ports/devel/git FORCE_PKG_REGISTER=1 \
 				WRKDIRPREFIX=/tmp/ports \
 				DISTDIR=/tmp/distfiles \
 				install clean distclean
 		else
 			eval chroot ${CHROOTDIR} env ASSUME_ALWAYS_YES=yes \
 				pkg install -y devel/git
 			eval chroot ${CHROOTDIR} env ASSUME_ALWAYS_YES=yes \
 				pkg clean -y
 		fi
 	fi
 
+	if [ ! -z "${WITH_OCIIMAGES}" ]; then
+		# Install buildah and skopeo from ports if the ports tree is available;
+		# otherwise install the pkg.
+		if [ -d ${CHROOTDIR}/usr/ports ]; then
+			# Trick the ports 'run-autotools-fixup' target to do the right
+			# thing.
+			_OSVERSION=$(chroot ${CHROOTDIR} /usr/bin/uname -U)
+			REVISION=$(chroot ${CHROOTDIR} make -C /usr/src/release -V REVISION)
+			BRANCH=$(chroot ${CHROOTDIR} make -C /usr/src/release -V BRANCH)
+			UNAME_r=${REVISION}-${BRANCH}
+			GITUNSETOPTS="CONTRIB CURL CVS GITWEB GUI HTMLDOCS"
+			GITUNSETOPTS="${GITUNSETOPTS} ICONV NLS P4 PERL"
+			GITUNSETOPTS="${GITUNSETOPTS} SEND_EMAIL SUBTREE SVN"
+			GITUNSETOPTS="${GITUNSETOPTS} PCRE PCRE2"
+			PBUILD_FLAGS="OSVERSION=${_OSVERSION} BATCH=yes"
+			PBUILD_FLAGS="${PBUILD_FLAGS} UNAME_r=${UNAME_r}"
+			PBUILD_FLAGS="${PBUILD_FLAGS} OSREL=${REVISION}"
+			PBUILD_FLAGS="${PBUILD_FLAGS} WRKDIRPREFIX=/tmp/ports"
+			PBUILD_FLAGS="${PBUILD_FLAGS} DISTDIR=/tmp/distfiles"
+			for _PORT in sysutils/buildah sysutils/skopeo; do
+				eval chroot ${CHROOTDIR} env ${PBUILD_FLAGS} make -C \
+				     /usr/ports/${_PORT} \
+				     FORCE_PKG_REGISTER=1 deinstall install clean distclean
+			done
+		else
+			eval chroot ${CHROOTDIR} env ASSUME_ALWAYS_YES=yes \
+				pkg install -y sysutils/buildah sysutils/skopeo
+			eval chroot ${CHROOTDIR} env ASSUME_ALWAYS_YES=yes \
+				pkg clean -y
+		fi
+		# Use the vfs storage driver so that this works whether or not
+		# the build directory is on ZFS. The images are small so the
+		# performance difference is negligible.
+		eval chroot ${CHROOTDIR} sed -I .bak -e '/^driver/s/zfs/vfs/' /usr/local/etc/containers/storage.conf
+		# Remove any stray images from previous builds
+		eval chroot ${CHROOTDIR} buildah rmi -af
+	fi
+
 	if [ ! -z "${EMBEDDEDPORTS}" ]; then
 		_OSVERSION=$(chroot ${CHROOTDIR} /usr/bin/uname -U)
 		REVISION=$(chroot ${CHROOTDIR} make -C /usr/src/release -V REVISION)
 		BRANCH=$(chroot ${CHROOTDIR} make -C /usr/src/release -V BRANCH)
 		UNAME_r=${REVISION}-${BRANCH}
 		PBUILD_FLAGS="OSVERSION=${_OSVERSION} BATCH=yes"
 		PBUILD_FLAGS="${PBUILD_FLAGS} UNAME_r=${UNAME_r}"
 		PBUILD_FLAGS="${PBUILD_FLAGS} OSREL=${REVISION}"
 		PBUILD_FLAGS="${PBUILD_FLAGS} WRKDIRPREFIX=/tmp/ports"
 		PBUILD_FLAGS="${PBUILD_FLAGS} DISTDIR=/tmp/distfiles"
 		for _PORT in ${EMBEDDEDPORTS}; do
 			eval chroot ${CHROOTDIR} env ${PBUILD_FLAGS} make -C \
 				/usr/ports/${_PORT} \
 				FORCE_PKG_REGISTER=1 deinstall install clean distclean
 		done
 	fi
 
 	buildenv_setup
 
 	return 0
 } # extra_chroot_setup()
 
 # chroot_build_target(): Build the userland and kernel for the build target.
 chroot_build_target() {
 	load_target_env
 	if [ ! -z "${EMBEDDEDBUILD}" ]; then
 		RELEASE_WMAKEFLAGS="${RELEASE_WMAKEFLAGS} \
 			TARGET=${EMBEDDED_TARGET} \
 			TARGET_ARCH=${EMBEDDED_TARGET_ARCH}"
 		RELEASE_KMAKEFLAGS="${RELEASE_KMAKEFLAGS} \
 			TARGET=${EMBEDDED_TARGET} \
 			TARGET_ARCH=${EMBEDDED_TARGET_ARCH}"
 	fi
 	eval chroot ${CHROOTDIR} make -C /usr/src ${RELEASE_WMAKEFLAGS} buildworld
 	eval chroot ${CHROOTDIR} make -C /usr/src ${RELEASE_KMAKEFLAGS} buildkernel
+	if [ ! -z "${WITH_OCIIMAGES}" ]; then
+		eval chroot ${CHROOTDIR} make -C /usr/src ${RELEASE_WMAKEFLAGS} packages
+	fi
 
 	return 0
 } # chroot_build_target
 
 # chroot_build_release(): Invoke the 'make release' target.
 chroot_build_release() {
 	load_target_env
 	if [ ! -z "${WITH_VMIMAGES}" ]; then
 		if [ -z "${VMFORMATS}" ]; then
 			VMFORMATS="$(eval chroot ${CHROOTDIR} \
 				make -C /usr/src/release -V VMFORMATS)"
 		fi
 		if [ -z "${VMSIZE}" ]; then
 			VMSIZE="$(eval chroot ${CHROOTDIR} \
 				make -C /usr/src/release ${ARCH_FLAGS} -V VMSIZE)"
 		fi
 		RELEASE_RMAKEFLAGS="${RELEASE_RMAKEFLAGS} \
 			VMFORMATS=\"${VMFORMATS}\" VMSIZE=${VMSIZE}"
 	fi
 	eval chroot ${CHROOTDIR} make -C /usr/src/release \
 		${RELEASE_RMAKEFLAGS} release
 	eval chroot ${CHROOTDIR} make -C /usr/src/release \
 		${RELEASE_RMAKEFLAGS} install DESTDIR=/R \
 		WITH_COMPRESSED_IMAGES=${WITH_COMPRESSED_IMAGES} \
 		WITH_COMPRESSED_VMIMAGES=${WITH_COMPRESSED_VMIMAGES}
 
 	return 0
 } # chroot_build_release()
 
 efi_boot_name()
 {
 	case $1 in
 		arm)
 			echo "bootarm.efi"
 			;;
 		arm64)
 			echo "bootaa64.efi"
 			;;
 		amd64)
 			echo "bootx64.efi"
 			;;
 		riscv)
 			echo "bootriscv64.efi"
 			;;
 	esac
 }
 
 # chroot_arm_build_release(): Create arm SD card image.
 chroot_arm_build_release() {
 	load_target_env
 	case ${EMBEDDED_TARGET} in
 		arm|arm64|riscv)
 			if [ -e "${RELENGDIR}/tools/arm.subr" ]; then
 				. "${RELENGDIR}/tools/arm.subr"
 			fi
 			;;
 		*)
 			;;
 	esac
 	[ ! -z "${RELEASECONF}" ] && . "${RELEASECONF}"
 	export MAKE_FLAGS="${MAKE_FLAGS} TARGET=${EMBEDDED_TARGET}"
 	export MAKE_FLAGS="${MAKE_FLAGS} TARGET_ARCH=${EMBEDDED_TARGET_ARCH}"
 	export MAKE_FLAGS="${MAKE_FLAGS} ${CONF_FILES}"
 	eval chroot ${CHROOTDIR} env WITH_UNIFIED_OBJDIR=1 make ${MAKE_FLAGS} -C /usr/src/release obj
 	export WORLDDIR="$(eval chroot ${CHROOTDIR} make ${MAKE_FLAGS} -C /usr/src/release -V WORLDDIR)"
 	export OBJDIR="$(eval chroot ${CHROOTDIR} env WITH_UNIFIED_OBJDIR=1 make ${MAKE_FLAGS} -C /usr/src/release -V .OBJDIR)"
 	export DESTDIR="${OBJDIR}/${KERNEL}"
 	export IMGBASE="${CHROOTDIR}/${OBJDIR}/${BOARDNAME}.img"
 	export OSRELEASE="$(eval chroot ${CHROOTDIR} make ${MAKE_FLAGS} -C /usr/src/release \
 		TARGET=${EMBEDDED_TARGET} TARGET_ARCH=${EMBEDDED_TARGET_ARCH} \
 		-V OSRELEASE)"
 	chroot ${CHROOTDIR} mkdir -p ${DESTDIR}
 	chroot ${CHROOTDIR} truncate -s ${IMAGE_SIZE} ${IMGBASE##${CHROOTDIR}}
 	export mddev=$(chroot ${CHROOTDIR} \
 		mdconfig -f ${IMGBASE##${CHROOTDIR}} ${MD_ARGS})
 	arm_create_disk
 	arm_install_base
 	arm_install_boot
 	arm_install_uboot
 	mdconfig -d -u ${mddev}
 	chroot ${CHROOTDIR} rmdir ${DESTDIR}
 	mv ${IMGBASE} ${CHROOTDIR}/${OBJDIR}/${OSRELEASE}-${BOARDNAME}.img
 	chroot ${CHROOTDIR} mkdir -p /R
 	chroot ${CHROOTDIR} cp -p ${OBJDIR}/${OSRELEASE}-${BOARDNAME}.img \
 		/R/${OSRELEASE}-${BOARDNAME}.img
 	chroot ${CHROOTDIR} xz -T ${XZ_THREADS} /R/${OSRELEASE}-${BOARDNAME}.img
 	cd ${CHROOTDIR}/R && sha512 ${OSRELEASE}* \
 		> CHECKSUM.SHA512
 	cd ${CHROOTDIR}/R && sha256 ${OSRELEASE}* \
 		> CHECKSUM.SHA256
 
 	return 0
 } # chroot_arm_build_release()
 
 # main(): Start here.
 main() {
 	set -e # Everything must succeed
 	env_setup
 	while getopts c: opt; do
 		case ${opt} in
 			c)
 				RELEASECONF="$(realpath ${OPTARG})"
 				;;
 			\?)
 				usage
 				;;
 		esac
 	done
 	shift $(($OPTIND - 1))
 	if [ ! -z "${RELEASECONF}" ]; then
 		if [ -e "${RELEASECONF}" ]; then
 			. ${RELEASECONF}
 		else
 			echo "Nonexistent configuration file: ${RELEASECONF}"
 			echo "Using default build environment."
 		fi
 	fi
 	env_check
 	trap "umount ${CHROOTDIR}/dev" EXIT # Clean up devfs mount on exit
 	chroot_setup
 	extra_chroot_setup
 	chroot_build_target
 	${chroot_build_release_cmd}
 
 	return 0
 } # main()
 
 main "${@}"
diff --git a/release/scripts/make-oci-image.sh b/release/scripts/make-oci-image.sh
new file mode 100644
index 000000000000..a139a38d1930
--- /dev/null
+++ b/release/scripts/make-oci-image.sh
@@ -0,0 +1,63 @@
+#! /bin/sh
+
+# Build an Open Container Initiative (OCI) container image
+
+curdir=$1; shift
+rev=$1; shift
+branch=$1; shift
+arch=$1; shift
+image=$1; shift
+
+major=${rev%.*}
+minor=${rev#*.}
+
+abi=FreeBSD:${major}:${arch}
+
+echo "Building OCI freebsd${major}-${image} image for ${abi}"
+
+. ${curdir}/tools/oci-image-${image}.conf
+
+init_workdir() {
+	local abi=$1; shift
+	local workdir=$(mktemp -d -t oci-images)
+
+	mkdir ${workdir}/repos
+	cat > ${workdir}/repos/base.conf <<EOF
+FreeBSD-base: {
+  url: "file:///usr/obj/usr/src/repo/${abi}/latest"
+  signature_type: "none"
+  fingerprints: "none"
+}
+EOF
+	cp /etc/pkg/FreeBSD.conf ${workdir}/repos
+	echo ${workdir}
+}
+
+install_packages() {
+	local abi=$1; shift
+	local workdir=$1; shift
+	local rootdir=$1; shift
+	if [ ! -d ${rootdir}/usr/share/keys/pkg/trusted ]; then
+		mkdir -p ${rootdir}/usr/share/keys/pkg/trusted
+	fi
+	cp /usr/share/keys/pkg/trusted/* ${rootdir}/usr/share/keys/pkg/trusted
+	# We install the packages and then remove repository metadata (keeping the
+	# metadata for what was installed). This trims more than 40Mb from the
+	# resulting image.
+	env IGNORE_OSVERSION=yes ABI=${abi} pkg --rootdir ${rootdir} --repo-conf-dir ${workdir}/repos \
+		install -yq "$@" || exit $?
+	rm -rf ${rootdir}/var/db/pkg/repos
+}
+
+workdir=$(init_workdir ${abi})
+if [ -n "${OCI_BASE_IMAGE}" ]; then
+	base_image=freebsd${major}-${OCI_BASE_IMAGE}
+else
+	base_image=scratch
+fi
+
+c=$(buildah from ${base_image})
+m=$(buildah mount $c)
+oci_image_build
+buildah unmount $c
+buildah commit --rm $c freebsd${major}-${image}:latest
diff --git a/release/tools/oci-image-dynamic.conf b/release/tools/oci-image-dynamic.conf
new file mode 100644
index 000000000000..b146ff2cf7c3
--- /dev/null
+++ b/release/tools/oci-image-dynamic.conf
@@ -0,0 +1,11 @@
+#! /bin/sh
+
+# Build Open Container Initiative (OCI) container image suitable as a base for
+# dynamic-linked workloads. This adds libraries from the FreeBSD-clibs and
+# FreeBSD-openssl-lib packages.
+
+OCI_BASE_IMAGE=static
+
+oci_image_build() {
+	install_packages ${abi} ${workdir} $m FreeBSD-clibs FreeBSD-openssl-lib
+}
diff --git a/release/tools/oci-image-minimal.conf b/release/tools/oci-image-minimal.conf
new file mode 100644
index 000000000000..122da1905436
--- /dev/null
+++ b/release/tools/oci-image-minimal.conf
@@ -0,0 +1,19 @@
+#! /bin/sh
+
+# Build Open Container Initiative (OCI) container image suitable as a base for
+# shell-based workloads. This adds FreeBSD-runtime, FreeBSD-pkg-bootstrap and a
+# handful of others packages to create a small image which can be easily
+# extended by installing packages.
+
+OCI_BASE_IMAGE=dynamic
+
+oci_image_build() {
+	install_packages ${abi} ${workdir} $m \
+			 FreeBSD-runtime \
+			 FreeBSD-certctl \
+			 FreeBSD-kerberos-lib \
+			 FreeBSD-libexecinfo \
+			 FreeBSD-rc \
+			 FreeBSD-pkg-bootstrap \
+			 FreeBSD-mtree
+}
diff --git a/release/tools/oci-image-static.conf b/release/tools/oci-image-static.conf
new file mode 100644
index 000000000000..27cfb3c6778c
--- /dev/null
+++ b/release/tools/oci-image-static.conf
@@ -0,0 +1,42 @@
+#! /bin/sh
+
+# Build Open Container Initiative (OCI) container image suitable as a base for
+# static-linked workloads. This contains mtree directories, SSL certificates and
+# a few other config files.
+
+OCI_BASE_IMAGE=
+
+oci_image_build() {
+	mtree -deU -p $m/ -f /etc/mtree/BSD.root.dist > /dev/null
+	mtree -deU -p $m/var -f /etc/mtree/BSD.var.dist > /dev/null
+	mtree -deU -p $m/usr -f /etc/mtree/BSD.usr.dist > /dev/null
+	mtree -deU -p $m/usr/include -f /etc/mtree/BSD.include.dist > /dev/null
+	mtree -deU -p $m/usr/lib -f /etc/mtree/BSD.debug.dist > /dev/null
+	install_packages ${abi} ${workdir} $m FreeBSD-caroot FreeBSD-zoneinfo
+	cp /etc/master.passwd $m/etc
+	pwd_mkdb -p -d $m/etc $m/etc/master.passwd || return $?
+	cp /etc/group $m/etc || return $?
+	cp /etc/termcap.small $m/etc/termcap.small || return $?
+	cp /etc/termcap.small $m/usr/share/misc/termcap || return $?
+	env DESTDIR=$m /usr/sbin/certctl rehash
+	# Generate a suitable repo config for pkgbase
+	case ${branch} in
+		CURRENT|STABLE|BETA*)
+			repo=base_latest
+			;;
+		*)
+			repo=base_release_${minor}
+			;;
+	esac
+	mkdir -p $m/usr/local/etc/pkg/repos
+	cat > $m/usr/local/etc/pkg/repos/base.conf <<EOF
+FreeBSD-base: {
+  url: "https://pkg.FreeBSD.org/\${ABI}/${repo}",
+  mirror_type: "srv",
+  signature_type: "fingerprints",
+  fingerprints: "/usr/share/keys/pkg",
+  enabled: yes
+}
+EOF
+
+}
diff --git a/share/examples/Makefile b/share/examples/Makefile
index 58f5a2109ec3..560fdae6de5b 100644
--- a/share/examples/Makefile
+++ b/share/examples/Makefile
@@ -1,421 +1,427 @@
 #
 # Doing a make install builds /usr/share/examples
 
 .include <src.opts.mk>
 
 PACKAGE=examples
 FILESDIR=	${SHAREDIR}/examples
 
 LDIRS=	BSD_daemon \
 	FreeBSD_version \
 	bootforth \
 	csh \
 	drivers \
 	etc \
 	find_interface \
 	flua \
 	indent \
 	ipfw \
 	jails \
 	kld \
 	libvgl \
 	mdoc \
 	netgraph \
+	oci \
 	perfmon \
 	ppi \
 	ppp \
 	printing \
 	ses \
 	scsi_target \
 	sound \
 	sunrpc \
 	ypldap
 
 
 SE_DIRS+=	BSD_daemon
 SE_BSD_DAEMON= \
 	FreeBSD.pfa \
 	README \
 	beastie.eps \
 	beastie.fig \
 	eps.patch \
 	poster.sh
 
 .if ${MACHINE_CPUARCH} == "amd64" || ${MACHINE_CPUARCH} == "aarch64"
 .if ${MK_BHYVE} != "no"
 LDIRS+=		bhyve
 SE_DIRS+=	bhyve
 SE_BHYVEPACKAGE=bhyve
 SE_BHYVE=	vmrun.sh
 PACKAGE_bhyve/vmrun.sh=	bhyve
 .endif
 .endif
 
 SE_DIRS+=	FreeBSD_version
 SE_FREEBSD_VERSION= \
 	FreeBSD_version.c \
 	Makefile \
 	README
 
 SE_DIRS+=	bootforth
 SE_BOOTFORTH_PACKAGE=bootloader
 SE_BOOTFORTH= \
 	README \
 	boot.4th \
 	frames.4th \
 	loader.rc \
 	menu.4th \
 	menuconf.4th \
 	screen.4th
 
 SE_DIRS+=	csh
 SE_CSHPACKAGE=	csh
 SE_CSH=		dot.cshrc
 
 SE_DIRS+=	drivers
 SE_DRIVERS= \
 	README \
 	make_device_driver.sh \
 	make_pseudo_driver.sh
 
 SE_DIRS+=	etc
 SE_ETC= \
 	README.examples \
 	bsd-style-copyright \
 	make.conf
 
 SE_DIRS+=	find_interface
 SE_FIND_INTERFACE= \
 	Makefile \
 	README \
 	find_interface.c
 
 SE_DIRS+=	flua
 SE_FLUA=	libjail.lua
 
 SE_DIRS+=	indent
 SE_INDENT=	indent.pro
 
 .if ${MK_IPFILTER} != "no"
 SUBDIR+=	ipfilter
 .endif
 
 SE_DIRS+=	ipfw
 SE_IPFWPACKAGE=	ipfw
 SE_IPFW=	change_rules.sh
 
 SE_DIRS+=	jails
 SE_JAILPACKAGE=	jail
 SE_JAILS= \
 	README \
 	VIMAGE \
 	jail.xxx.conf \
 	jib \
 	jng \
 	rc.conf.jails \
 	rcjail.xxx.conf
 
 SE_DIRS+=	kld
 SE_KLD=	Makefile
 
 SE_DIRS+=	kld/cdev
 SE_KLD_CDEV= \
 	Makefile \
 	README \
 
 SE_DIRS+=	kld/cdev/module
 SE_KLD_CDEV_MODULE= \
 	Makefile \
 	cdev.c \
 	cdev.h \
 	cdevmod.c
 
 SE_DIRS+=	kld/cdev/test
 SE_KLD_CDEV_TEST= \
 	Makefile \
 	testcdev.c
 
 SE_DIRS+=	kld/dyn_sysctl
 SE_KLD_DYN_SYSCTL= \
 	Makefile \
 	README \
 	dyn_sysctl.c
 
 SE_DIRS+=	kld/firmware
 SE_KLD_FIRMWARE= \
 	Makefile \
 	README
 
 SE_DIRS+=	kld/firmware/fwconsumer
 SE_KLD_FIRMWARE_FWCONSUMER= \
 	Makefile \
 	fw_consumer.c
 
 SE_DIRS+=	kld/firmware/fwimage
 SE_KLD_FIRMWARE_FWIMAGE= \
 	Makefile \
 	firmware.img.uu
 
 SE_DIRS+=	kld/khelp
 SE_KLD_KHELP= \
 	Makefile \
 	README \
 	h_example.c
 
 SE_DIRS+=	kld/syscall
 SE_KLD_SYSCALL=	Makefile
 
 SE_DIRS+=	kld/syscall/module
 SE_KLD_SYSCALL_MODULE= \
 	Makefile \
 	syscall.c
 
 SE_DIRS+=	kld/syscall/test
 SE_KLD_SYSCALL_TEST= \
 	Makefile \
 	call.c
 
 SE_DIRS+=	libvgl
 SE_LIBVGL=	\
 	Makefile \
 	demo.c
 
 SE_DIRS+=	mdoc
 SE_MDOC= \
 	POSIX-copyright \
 	deshallify.sh \
 	example.1 \
 	example.3 \
 	example.4 \
 	example.9
 
 SE_DIRS+=	netgraph
 SE_NETGRAPH= \
 	ether.bridge \
 	frame_relay \
 	ngctl \
 	raw \
 	udp.tunnel \
 	virtual.chain \
 	virtual.lan \
 
+SE_DIRS+=	oci
+SE_OCI= \
+	README \
+	Containerfile.pkg
+
 SE_DIRS+=	perfmon
 SE_PERFMON= \
 	Makefile \
 	README \
 	perfmon.c \
 
 .if ${MK_PF} != "no"
 SE_DIRS+=	pf
 .if ${MK_STAGING} == "no"
 SE_PFPACKAGE=	pf
 SE_PF= \
 	ackpri \
 	faq-example1 \
 	faq-example2 \
 	faq-example3 \
 	pf.conf \
 	queue1 \
 	queue2 \
 	queue3 \
 	queue4 \
 	spamd
 .endif
 .endif
 
 SE_DIRS+=	ppi
 SE_PPI= \
 	Makefile \
 	ppilcd.c
 
 SE_DIRS+=	ppp
 SE_PPPPACKAGE=	ppp
 SE_PPP= \
 	chap-auth \
 	login-auth \
 	ppp.conf.sample \
 	ppp.conf.span-isp \
 	ppp.conf.span-isp.working \
 	ppp.linkdown.sample \
 	ppp.linkdown.span-isp \
 	ppp.linkdown.span-isp.working \
 	ppp.linkup.sample \
 	ppp.linkup.span-isp \
 	ppp.linkup.span-isp.working \
 	ppp.secret.sample \
 	ppp.secret.span-isp \
 	ppp.secret.span-isp.working
 
 SE_DIRS+=	printing
 SE_PRINTINGPACKAGE=lp
 SE_PRINTING= \
 	diablo-if-net \
 	hpdf \
 	hpif \
 	hpof \
 	hprf \
 	hpvf \
 	if-simple \
 	if-simpleX \
 	ifhp \
 	make-ps-header \
 	netprint \
 	psdf \
 	psdfX \
 	psif \
 	pstf \
 	pstfX
 
 SE_DIRS+=	ses
 SE_SES= \
 	Makefile \
 	Makefile.inc
 
 SE_DIRS+=	ses/getencstat
 SE_SES_GETENCSTAT= \
 	Makefile \
 	getencstat.0
 
 SE_DIRS+=	ses/sesd
 SE_SES_SESD= \
 	Makefile \
 	sesd.0
 
 SE_DIRS+=	ses/setencstat
 SE_SES_SETENCSTAT= \
 	Makefile \
 	setencstat.0
 
 SE_DIRS+=	ses/setobjstat
 SE_SES_SETOBJSTAT= \
 	Makefile \
 	setobjstat.0
 
 SE_DIRS+=	ses/srcs
 SE_SES_SRCS= \
 	chpmon.c \
 	eltsub.c \
 	eltsub.h \
 	getencstat.c \
 	getnobj.c \
 	getobjmap.c \
 	getobjstat.c \
 	inienc.c \
 	sesd.c \
 	setencstat.c \
 	setobjstat.c
 
 SE_DIRS+=	scsi_target
 SE_SCSI_TARGET= \
 	Makefile \
 	scsi_target.c \
 	scsi_target.h \
 	scsi_target.8 \
 	scsi_cmds.c
 
 SE_DIRS+=	sound
 SE_SOUND= \
 	  sndstat_nv.c \
 	  midi.c
 
 SE_DIRS+=	sound/oss
 SE_SOUND_OSS= \
 	README \
 	audio.c
 
 SE_DIRS+=	sunrpc
 SE_SUNRPC=	Makefile
 
 SE_DIRS+=	sunrpc/dir
 SE_SUNRPC_DIR= \
 	Makefile \
 	dir.x \
 	dir_proc.c \
 	rls.c
 
 SE_DIRS+=	sunrpc/msg
 SE_SUNRPC_MSG= \
 	Makefile \
 	msg.x \
 	msg_proc.c \
 	printmsg.c \
 	rprintmsg.c
 
 SE_DIRS+=	sunrpc/sort
 SE_SUNRPC_SORT= \
 	Makefile \
 	rsort.c \
 	sort.x \
 	sort_proc.c
 
 .if ${MK_EFI} != "no"
 LDIRS+=		uefisign
 SE_DIRS+=	uefisign
 SE_UEFISIGN=	uefikeys
 SE_UEFISIGNPACKAGE=efi-tools
 .endif
 
 SE_DIRS+=	ypldap
 SE_YPLDAP=	ypldap.conf
 SE_YPLDAPPACKAGE=yp
 
 .if ${MK_HAST} != "no"
 LDIRS+=		hast
 SE_HASTPACKAGE=	hast
 SE_DIRS+=	hast
 SE_HAST=	ucarp.sh \
 	ucarp_down.sh \
 	ucarp_up.sh \
 	vip-down.sh \
 	vip-up.sh
 .endif
 
 .if ${MK_USB} != "no"
 LDIRS+=		libusb20
 SE_DIRS+=	libusb20
 SE_LIBUSB20= \
 	Makefile \
 	README \
 	util.c \
 	util.h \
 	bulk.c \
 	control.c
 .endif
 
 
 # Setup the FILES_GROUPS for all DIRS variables above.
 # The variables are prefixed by 'SE_' to prevent variable collision in
 # other parts of the system
 .for d in ${SE_DIRS}
 .for f in ${SE_${d:tu:C/\//_/g}}
 SER_${d:tu:C/\//_/g}+=	${d}/${f}
 .endfor
 FILESGROUPS+=	SER_${d:tu:C/\//_/g}
 SER_${d:tu:C/\//_/g}DIR+=	${SHAREDIR}/examples/${d}
 .if ${SE_${d:tu:C/\//_/g}PACKAGE:U} != ""
 SER_${d:tu:C/\//_/g}PACKAGE=	${SE_${d:tu:C/\//_/g}PACKAGE}
 .else
 SER_${d:tu:C/\//_/g}PACKAGE=	examples
 .endif
 .endfor
 
 BINDIR= ${SHAREDIR}/examples
 
 beforeinstall: copies
 META_TARGETS+=	copies
 
 copies:
 .for i in ${LDIRS}
 	if [ -L ${DESTDIR}${BINDIR}/$i ]; then \
 		rm -f ${DESTDIR}${BINDIR}/$i; \
 	fi
 .endfor
 
 SUBDIR+=	smbfs
 
 HAS_TESTS=
 SUBDIR.${MK_TESTS}+= tests
 
 SUBDIR_PARALLEL=
 
 .include <bsd.prog.mk>
diff --git a/share/examples/oci/Containerfile.pkg b/share/examples/oci/Containerfile.pkg
new file mode 100644
index 000000000000..ed8ac7caf4b6
--- /dev/null
+++ b/share/examples/oci/Containerfile.pkg
@@ -0,0 +1,27 @@
+# This is an example showing how to extend the freebsd-minimal OCI image by
+# installing additional packages while keeping the resulting image as small as
+# possible.
+
+# The OS version matching the desired freebsd-minimal image
+ARG version=15.0-CURRENT-amd64
+
+# Select freebsd-minimal as our starting point.
+FROM localhost/freebsd-minimal:${version}
+
+# A list of package(s) to install
+ARG packages
+
+# Install package management tools. We specify 'FreeBSD' as the repository to
+# use for downloading pkg since the freebsd-minimal image has both FreeBSD and
+# FreeBSD-base pkg repo configs installed and FreeBSD-base does not contain the
+# pkg package.
+RUN env ASSUME_ALWAYS_YES=yes pkg bootstrap -r FreeBSD && pkg update
+
+# Install some package(s).
+RUN pkg install -y ${packages}
+
+# Clean up and remove package management overhead. We delete downloaded
+# packages, uninstall pkg and delete the repository metadata downloaded by 'pkg
+# install'.  This retains the record of which packages are installed in the
+# image.
+RUN pkg clean -ay && pkg delete -fy pkg && rm -rf /var/db/pkg/repos
diff --git a/share/examples/oci/README b/share/examples/oci/README
new file mode 100644
index 000000000000..212687251754
--- /dev/null
+++ b/share/examples/oci/README
@@ -0,0 +1,7 @@
+This example Containerfile shows how to add packages to freebsd-minimal while
+minimising the package metadata overhead.
+
+For instance, To build a new image called 'my-new-image:latest' containing the
+nginx package:
+
+# podman build --squash --build-arg packages=nginx --tag my-new-image:latest -f Containerfile.pkg
diff --git a/share/man/man7/release.7 b/share/man/man7/release.7
index c81f540d9463..5c5c11efd0fb 100644
--- a/share/man/man7/release.7
+++ b/share/man/man7/release.7
@@ -1,778 +1,790 @@
 .\" Copyright (c) 2002 Murray Stokely <murray@FreeBSD.org>
 .\" All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd August 6, 2023
+.Dd September 26, 2024
 .Dt RELEASE 7
 .Os
 .Sh NAME
 .Nm release
 .Nd "release building infrastructure"
 .Sh DESCRIPTION
 .Fx
 provides a complete build environment suitable for users to make
 full releases of the
 .Fx
 operating system.
 All of the tools necessary to build a release are available from the
 .Fx
 source code repository in
 .Pa src/release .
 A complete release can be built with only a single command,
 including the creation of ISO images suitable for burning to CD-ROM,
 memory stick images, and a network install directory.
 This command is aptly named
 .Dq Li "make release" .
 .Pp
 For some users, it may be desirable to provide an absolutely clean
 build environment, with no local modifications to the source tree or to
 .Xr make.conf 5 ,
 and with clean checkouts of specific versions of the doc, src, and ports
 trees.
 For this purpose, a script
 .Pq Pa src/release/release.sh
 is provided to automate these checkouts and then execute
 .Dq Li "make release"
 in a clean
 .Xr chroot 8 .
 .Pp
 Before attempting to build a release, the user is expected to be
 familiar with the contents of
 .Xr build 7 ,
 and should have experience upgrading systems from source.
 .Pp
 The release build process requires that
 .Pa /usr/obj
 be populated with the output of
 .Dq Li "make buildworld"
 and
 .Dq Li "make buildkernel" .
 This is necessary to provide the object files for the release or, when
 using
 .Pa release.sh ,
 so that the object files for a complete system can be installed into a clean
 .Xr chroot 8
 environment.
 .Pp
 If the target release build is for a different architecture or machine type,
 the
 .Va TARGET
 and
 .Va TARGET_ARCH
 variables must be used.
 See the supported
 .Fa release.conf
 variables for more information.
 .Pp
 The release procedure on some architectures may also require that the
 .Xr md 4
 (memory disk) device driver be present in the kernel
 .Pq either by being compiled in or available as a module .
 .Pp
 This document does not cover source code management, quality
 assurance, or other aspects of the release engineering process.
 .Sh CLEAN RELEASE GENERATION
 Official releases of
 .Fx
 are produced in a clean environment to
 ensure consistency between the versions of the src, ports, and doc trees
 and to avoid contamination from the host system
 .Po such as local patches, changes
 to
 .Xr make.conf 5 ,
 etc.
 .Pc .
 This is accomplished using the wrapper script
 .Pa src/release/release.sh .
 .Pp
 .Ic release.sh
 .Op Fl c Ar release.conf
 .Pp
 .Ic release.sh
 checks out the
 .Li src/ ,
 .Li ports/ ,
 and
 .Li doc/
 trees to
 .Va CHROOTDIR ,
 then calls
 .Dq Li "make buildworld"
 and
 .Dq Li "make installworld"
 to generate a
 .Xr chroot 8
 environment.
 Next,
 .Dq Li "make release"
 is run within the
 .Xr chroot 8
 environment and places the result in
 .Pa $CHROOTDIR/R .
 .Pp
 The optional
 .Fa release.conf
 configuration file supports the following variables:
 .Bl -tag -width Ev
 .It Va CHROOTDIR
 The directory within which the release will be built.
 .It Va CHROOT_MAKEENV
 Additional
 .Xr make 1
 arguments to pass through, which directly affect the
 tuning of the build chroot.
 .It Va NOGIT
 Do not explicitly require the
 .Xr git 1
 port to be installed.
 .It Va GITROOT
 The
 .Xr git 1
 host used to check out the various trees.
 Defaults to
 .Pa https://git.FreeBSD.org .
 .It Va SRCBRANCH
 The
 .Li src/
 branch to use.
 Defaults to
 .Fl b Va main .
 .It Va PORTBRANCH
 The
 .Li ports/
 branch to use.
 Defaults to
 .Va head/@rHEAD .
 .It Va TARGET
 The target machine type for cross-building a release.
 .It Va TARGET_ARCH
 The target machine architecture for cross-building a release.
 .Pp
 For the supported list of
 .Va TARGET
 and
 .Va TARGET_ARCH
 combinations, consult the output of
 .Dq make targets
 as documented in
 .Xr build 7 .
 .It Va KERNEL
 The target kernel configuration to use.
 Defaults to
 .Va GENERIC .
 Multiple
 .Va KERNEL
 entries may be specified.
 .It Va MAKE_CONF
 The
 .Xr make.conf 5
 to use for the release build.
 Defaults to
 .Fa /dev/null
 to prevent polluting the release with local system changes.
 .It Va SRC_CONF
 The
 .Xr src.conf 5
 to use for the release build.
 Defaults to
 .Fa /dev/null
 to prevent polluting the release with local system changes.
 .It Va MAKE_FLAGS
 Additional flags to pass to
 .Xr make 1 .
 .It Va WORLD_FLAGS
 Additional flags to pass to
 .Xr make 1
 during the
 .Dq buildworld
 phase.
 Defaults to setting the number of
 .Xr make 1
 jobs
 .Pq Ar -j
 to the number of CPUs available on a SMP-capable system.
 .It Va KERNEL_FLAGS
 Additional flags to pass to
 .Xr make 1
 during the
 .Dq buildkernel
 phase.
 Defaults to setting the number of
 .Xr make 1
 jobs
 .Pq Ar -j
 to half the number of CPUs available on a SMP-capable system.
 .It Va NOPORTS
 Set to a non-empty value to skip the
 .Li ports/
 tree checkout.
 When set,
 .Va NOPORTS
 will prevent the
 .Fa ports.txz
 distribution package from being created.
 .It Va WITH_DVD
 Set to a non-empty value to include the
 .Cm dvdrom
 target.
 .It Va WITH_COMPRESSED_IMAGES
 Set to a non-empty value to compress the release images with
 .Xr xz 1 .
 The original
 .Pq uncompressed
 images are not removed.
 .It Va XZ_THREADS Pq Vt int
 Set to the number of threads
 .Xr xz 1
 should use when compressing images.
 By default,
 .Va XZ_THREADS
 is set to
 .Va 0 ,
 which uses all available cores on the system.
 .It Va VCSCMD
 The command run to obtain the source trees.
 Defaults to
 .Qq Cm git clone Fl q .
 .It Va CHROOTBUILD_SKIP
 If defined, the
 .Li buildworld ,
 .Li installworld ,
 and
 .Li distribution
 stages of the
 .Xr chroot 8
 build environment setup are skipped.
 This is intended solely for cases where the
 .Xr chroot 8
 userland are provided by alternate means.
 .It Va SRC_UPDATE_SKIP
 Set to a non-empty value to prevent checkout or update of
 .Fa /usr/src
 within the
 .Xr chroot 8 .
 This is intended for use only when
 .Fa /usr/src
 is expected to exist by alternative means.
 .It Va PORTS_UPDATE_SKIP
 Set to a non-empty value to prevent checkout or update of
 .Fa /usr/ports
 within the
 .Xr chroot 8 .
 This is intended for use only when
 .Fa /usr/ports
 is expected to exist by alternative means.
 .El
 .Sh EMBEDDED BUILDS
 The following
 .Fa release.conf
 variables are relevant only to release builds for embedded systems:
 .Bl -tag -width Ev
 .It Va EMBEDDEDBUILD
 Set to a non-null value to enable functionality for embedded device
 release builds.
 .Pp
 When set,
 .Va WITH_DVD
 is unset.
 Additionally,
 .Va EMBEDDED_TARGET
 and
 .Va EMBEDDED_TARGET_ARCH
 must also be defined.
 When the build environment is created,
 .Fa release.sh
 runs a separate build script located in an architecture-specific
 directory in
 .Pa src/release/${EMBEDDED_TARGET}/ .
 .It Va EMBEDDEDPORTS
 Set to the list of any ports that are required for the target device
 in the format of
 .Fa category/port .
 .It Va EMBEDDED_TARGET
 When set, its value is passed to
 .Xr make 1
 to set the
 .Va TARGET
 .Pq value of Cm uname Fl m
 to cross build the target userland.
 .It Va EMBEDDED_TARGET_ARCH
 When set, its value is passed to
 .Xr make 1
 to set the
 .Va TARGET_ARCH
 .Pq value of Cm uname Fl p
 to cross build the target userland.
 .El
 .Sh VIRTUAL MACHINE DISK IMAGES
 The following
 .Fa release.conf
 variables are relevant only to virtual machine disk image builds:
 .Bl -tag -width Ev
 .It Va WITH_VMIMAGES
 Set to a non-null value to build virtual machine disk images as part
 of the release build.
 .Va WITH_VMIMAGES
 may also be specified as an environment variable passed to
 .Xr make 1 .
 .It Va WITH_COMPRESSED_VMIMAGES
 Set to a non-null value to compress the virtual machine disk images with
 .Xr xz 1
 as part of the
 .Cm install
 .Xr make 1
 target.
 Note that compressing virtual machine disk images may take a very long
 time on some systems.
 .It Va VMBASE
 Set to change the name of the resulting virtual machine disk image file.
 The default value is
 .Va vm .
 .It Va VMSIZE
 Set to change the size of the virtual machine disk capacity.
 The default value is
 .Va 20g .
 See
 .Xr makefs 8
 for valid values.
 .Pp
 Virtual machine disk images are, by default, created as sparse images.
 When
 .Va WITH_COMPRESSED_VMIMAGES
 is used, the resulting files compressed with
 .Xr xz 1
 compress to roughly the same size, regardless of the specified disk image
 size.
 .It Va VMFS
 (Deprecated.)
 Set to specify which of the filesystem(s) listed in
 .Va VMFSLIST
 is linked to the historical non-filesystem-labelled file name.
 Valid values are
 .Va ufs
 and
 .Va zfs .
 The default value is
 .Va ufs .
 .It Va VMFSLIST
 Set to specify the list of file system types to build images for.
 Valid values are one or both of
 .Va ufs
 and
 .Va zfs .
 The default value is
 .Va ufs zfs .
 .It Va VMFORMATS
 Set to the target virtual disk image format(s) to create.
 By default, the
 .Va vhdf , Va vmdk , Va qcow2 ,
 and
 .Va raw
 formats are created.
 See
 .Xr mkimg 1
 for valid format values.
 .El
 .Pp
 For a list of supported
 .Va VMFORMATS
 values
 .Pq including cloud hosting provider formats
 along with a brief description, run:
 .Bd -literal -offset indent
 cd /usr/src
 make -C release list-vmtargets
 .Ed
 .Sh CLOUD HOSTING MACHINE IMAGES
 The
 .Fx
 release build tools support building virtual machine images for various
 cloud hosting providers, each with their own specific configuration to
 include support for each hosting provider by default.
 .Pp
 The following
 .Xr make 1
 environment variables are supported:
 .Bl -tag -width Ev
 .It Va CLOUDWARE
 Set to a list of one or more cloud hosting providers, enclosed in quotes.
 Requires
 .Va WITH_CLOUDWARE
 to also be set.
 .It Va WITH_CLOUDWARE
 Set to a non-empty value to enable building virtual machine images
 for various cloud hosting providers.
 Requires
 .Va CLOUDWARE
 to also be set.
 .El
 .Pp
 Additionally, the
 .Va CLOUDWARE
 and
 .Va WITH_CLOUDWARE
 variables can be added to
 .Pa release.conf ,
 and used in conjunction with
 .Pa release.sh .
 .Pp
 For a list of supported
 .Va CLOUDWARE
 values, run:
 .Bd -literal -offset indent
 cd /usr/src
 make -C release list-cloudware
 .Ed
+.Sh OCI IMAGES
+The
+.Fx
+release build tools have experimental support for building
+Open Container Initiative (OCI) format container base images.
+This is enabled using a
+.Fa release.conf
+variable:
+.Bl -tag -width Ev
+.It Va WITH_OCIIMAGES
+Set to a non-null value to build OCI base images.
+.El
 .Sh MAKEFILE TARGETS
 The release makefile
 .Pq Pa src/release/Makefile
 is fairly abstruse.
 Most developers will only be concerned with the
 .Cm release
 and
 .Cm install
 targets.
 .\" XXX: Some sort of introduction to this list?  All the others have one.
 .Bl -tag -width ".Cm packagesystem"
 .It Cm release
 Meta-target to build all release media and distributions applicable to this
 platform.
 .It Cm install
 Copy all produced release media to
 .Pa ${DESTDIR} .
 .It Cm cdrom
 Builds installation CD-ROM images.
 This may require the
 .Xr md 4
 (memory disk) device driver be present in the kernel
 (either by being compiled in or available as a module).
 This target produces files called
 .Pa disc1.iso
 and
 .Pa bootonly.iso
 as its output.
 .It Cm dvdrom
 Builds installation DVD-ROM images.
 This may require the
 .Xr md 4
 (memory disk) device driver be present in the kernel
 (either by being compiled in or available as a module).
 This target produces the
 .Pa dvd1.iso
 file as its output.
 .It Cm memstick
 Builds an installation memory stick image named
 .Pa memstick.img .
 Not applicable on all platforms.
 Requires that the
 .Xr md 4
 .Pq memory disk
 device driver be present in the kernel
 .Pq either by being compiled in or available as a module .
 .It Cm mini-memstick
 Similar to
 .Cm memstick ,
 with the exception that the installation distribution sets
 are not included.
 .It Cm ftp
 Creates a directory named
 .Pa ftp
 containing the distribution files used in network installations
 and suitable for upload to an FTP mirror.
 .It Cm vm-image
 Creates virtual machine disk images in various formats.
 The
 .Cm vm-image
 target requires the
 .Va WITH_VMIMAGES
 .Xr make 1
 environment variable to be set to a non-null value.
 .It Cm vm-cloudware
 Builds
 .Fx
 virtual machine images for various cloud hosting providers.
 See
 .Qq CLOUD HOSTING MACHINE IMAGES
 for implementation details.
 .It Cm list-cloudware
 Displays the list of valid
 .Va CLOUDWARE
 values.
 .It Cm list-vmtargets
 Displays the list of valid
 .Va VMFORMATS
 and
 .Va CLOUDWARE
 values.
 .El
 .Pp
 Major subtargets called by targets above:
 .Bl -tag -width ".Cm packagesystem"
 .It Cm packagesystem
 Generates all the distribution archives
 .Pq base, kernel, ports, doc
 applicable on this platform.
 .It Cm disc1
 Builds a bootable installation system containing all the distribution files
 packaged by the
 .Cm packagesystem
 target, and suitable for imaging by the
 .Cm cdrom ,
 .Cm dvdrom
 and
 .Cm memstick
 targets.
 .It Cm reldoc
 Builds the release documentation.
 This includes the release notes,
 hardware guide, and installation instructions.
 Other documentation, such as the Handbook,
 is built during the
 .Cm base.txz
 target invoked by
 .Cm packagesystem .
 .El
 .Sh ENVIRONMENT
 Optional variables:
 .Bl -tag -width ".Ev TARGET_ARCH"
 .It Ev OSRELEASE
 Optional base name for generated media images when invoking the
 .Cm install
 target
 .Pq e.g., FreeBSD-12.1-RELEASE-amd64 .
 Defaults to the output of
 .Ic `uname -s`-`uname -r`-`uname -p`
 within the chroot.
 .It Ev WORLDDIR
 Location of a directory containing the src tree.
 By default, the directory
 above the one containing the makefile
 .Pq Pa src .
 .It Ev PORTSDIR
 Location of a directory containing the ports tree.
 By default,
 .Pa /usr/ports .
 If it is unset or cannot be found, ports will not be included in the release.
 .It Ev NOPORTS
 If defined, the Ports Collection will be omitted from the release.
 .It Ev NOSRC
 If set, do not include system source code in the release.
 .It Ev TARGET
 The target hardware platform.
 This is analogous to the
 .Dq Nm uname Fl m
 output.
 This is necessary to cross-build some target architectures.
 For example, cross-building for ARM64 machines requires
 .Ev TARGET_ARCH Ns = Ns Li aarch64
 and
 .Ev TARGET Ns = Ns Li arm64 .
 If not set,
 .Ev TARGET
 defaults to the current hardware platform.
 .It Ev TARGET_ARCH
 The target machine processor architecture.
 This is analogous to the
 .Dq Nm uname Fl p
 output.
 Set this to cross-build for a different architecture.
 If not set,
 .Ev TARGET_ARCH
 defaults to the current machine architecture, unless
 .Ev TARGET
 is also set, in which case it defaults to the appropriate
 value for that platform.
 Typically, one only needs to set
 .Ev TARGET .
 .El
 .Sh FILES
 .Bl -tag -compact -width Pa
 .It Pa /usr/doc/Makefile
 .It Pa /usr/doc/share/mk/doc.project.mk
 .It Pa /usr/ports/Mk/bsd.port.mk
 .It Pa /usr/ports/Mk/bsd.sites.mk
 .It Pa /usr/share/examples/etc/make.conf
 .It Pa /usr/src/Makefile
 .It Pa /usr/src/Makefile.inc1
 .It Pa /usr/src/release/Makefile
 .It Pa /usr/src/release/Makefile.vm
 .It Pa /usr/src/release/release.sh
 .It Pa /usr/src/release/release.conf.sample
 .It Pa /usr/src/release/tools/*.conf
 .It Pa /usr/src/release/tools/vmimage.subr
 .El
 .Sh EXAMPLES
 The following sequence of commands can be used to build a
 .Dq "-CURRENT snapshot":
 .Bd -literal -offset indent
 cd /usr
 git clone -b main https://git.freebsd.org/src.git src
 cd src
 make buildworld buildkernel
 cd release
 make obj
 make release
 make install DESTDIR=/var/freebsd-snapshot
 .Ed
 .Pp
 After running these commands, all produced distribution files (tarballs
 for FTP, CD-ROM images, etc.) are available in the
 .Pa /var/freebsd-snapshot
 directory.
 .Pp
 The following sequence of commands can be used to build a
 .Dq "-CURRENT snapshot"
 in a clean environment, including ports and documentation:
 .Bd -literal -offset indent
 cd /usr/src/release
 sh release.sh
 .Ed
 .Pp
 Optionally, a configuration file can be used to customize the release build:
 .Bd -literal -offset indent
 cd /usr/src/release
 sh release.sh -c $HOME/release.conf
 .Ed
 .Pp
 Configuration files specific to various supported embedded systems, such as
 the Raspberry Pi, exist in the directory corresponding to the
 .Va TARGET
 .Xr make 1
 variable.
 For example, to build an image for the Raspberry Pi:
 .Bd -literal -offset indent
 cd /usr/src/release
 sh release.sh -c arm/RPI-B.conf
 .Ed
 .Pp
 To build an image for the Raspberry Pi 3:
 .Bd -literal -offset indent
 cd /usr/src/release
 sh release.sh -c arm64/RPI3.conf
 .Ed
 .Pp
 After running these commands, all prepared release files are available in the
 .Pa /scratch
 directory.
 The target directory can be changed by specifying the
 .Va CHROOTDIR
 variable in
 .Li release.conf .
 .Sh COMPATIBILITY
 The reldoc target was removed in commit f61e92ca5a23, and
 .Ev DOCDIR ,
 .Ev DOCBRANCH ,
 .Ev DOC_UPDATE_SKIP ,
 and
 .Ev NODOC
 are therefore no longer supported.
 .Sh SEE ALSO
 .Xr cc 1 ,
 .Xr git 1 Pq Pa ports/devel/git ,
 .Xr install 1 ,
 .Xr make 1 ,
 .Xr mkimg 1 ,
 .Xr uname 1 ,
 .Xr md 4 ,
 .Xr make.conf 5 ,
 .Xr build 7 ,
 .Xr ports 7 ,
 .Xr chroot 8 ,
 .Xr mtree 8 ,
 .Xr sysctl 8
 .Rs
 .%T "FreeBSD Release Engineering"
 .%U https://docs.freebsd.org/en/articles/freebsd-releng/
 .Re
 .Rs
 .%T "FreeBSD Developers' Handbook"
 .%U https://docs.freebsd.org/en/books/developers-handbook/
 .Re
 .Sh HISTORY
 .Fx
 1.x
 used a manual checklist, compiled by
 .An Rod Grimes ,
 to produce a release.
 Apart from being incomplete, the list put a lot of specific demands on
 available file systems and was quite torturous to execute.
 .Pp
 As part of the
 .Fx 2.0
 release engineering effort, significant
 effort was spent getting
 .Pa src/release/Makefile
 into a shape where it could at least automate most of the tediousness
 of building a release in a sterile environment.
 .Pp
 For the
 .Fx 9.0
 release,
 .Pa src/release/Makefile
 was overhauled and the wrapper script
 .Pa src/release/generate-release.sh
 introduced to support the introduction of a new installer.
 .Pp
 For the
 .Fx 9.2
 release,
 .Pa src/release/release.sh
 was introduced to support per-build configuration files.
 .Pa src/release/release.sh
 is heavily based on the
 .Pa src/release/generate-release.sh
 script.
 .Pp
 At near 1000 revisions spread over multiple branches, the
 .Xr git 1
 log of
 .Pa src/release/Makefile
 contains a vivid historical record of some
 of the hardships release engineers go through.
 .Sh AUTHORS
 .Pa src/release/Makefile
 was originally written by
 .An -nosplit
 .An Rod Grimes ,
 .An Jordan Hubbard ,
 and
 .An Poul-Henning Kamp .
 .Pp
 This manual page was originally written by
 .An Murray Stokely Aq Mt murray@FreeBSD.org .
 .Pp
 It was updated by
 .An Nathan Whitehorn Aq Mt nwhitehorn@FreeBSD.org
 to include the
 .Fa generate-release.sh
 script used for the
 .Fx 9.0
 release cycle.
 .Pp
 It was later updated by
 .An Glen Barber Aq Mt gjb@FreeBSD.org
 to include the
 .Fa release.sh
 script used for the
 .Fx 9.2
 release cycle.