Fix ISO build pipeline for Docker on macOS

- Disable pacman alpm sandbox in Dockerfile (seccomp blocks it in BuildKit)
- Move mkarchiso from RUN to CMD so it runs with --privileged at docker run time
- Fix output path: mkarchiso now writes to /dist (matches volume mount)
- Add syslinux + imlib2 to Docker build packages and live ISO package list
- Copy syslinux/ and efiboot/ boot configs from archiso releng into profile
- Switch deprecated UEFI grub bootmodes to uefi-x64.systemd-boot
- Fix wrong package names: libpam→pam, light→brightnessctl, remove pkexec
- Set SigLevel=Never and hardcode reliable mirrors in profile pacman.conf
- Add mkinitcpio.conf with archiso hook so initrd can mount the live squashfs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile

@@ -1,9 +1,13 @@
 FROM archlinux:latest
 
+# Disable pacman's alpm sandbox (seccomp-incompatible inside Docker/BuildKit)
+RUN echo "DisableSandbox" >> /etc/pacman.conf
+
 # Update and install archiso + OrionOS build dependencies
 RUN pacman -Syu --noconfirm && \
     pacman -S --noconfirm \
         archiso \
+        syslinux \
         base-devel \
         git \
         libx11 \
@@ -11,6 +15,7 @@ RUN pacman -Syu --noconfirm && \
         libxfixes \
         libxext \
         libpng \
+        imlib2 \
         dbus \
         pam \
         fontconfig \
@@ -30,8 +35,22 @@ WORKDIR /build
 # Copy OrionOS source
 COPY . /build/orionos
 
-# Build OrionOS components
-RUN cd /build/orionos && make 2>&1 | tail -20
+# Bootstrap boot loader configs from the installed archiso releng profile.
+# syslinux/ is required for bios.syslinux.mbr; efiboot/ for systemd-boot UEFI.
+# Fall back to a minimal loader.conf if releng ships without efiboot/.
+RUN cp -r /usr/share/archiso/configs/releng/syslinux \
+          /build/orionos/iso/profile/ && \
+    if [ -d /usr/share/archiso/configs/releng/efiboot ]; then \
+        cp -r /usr/share/archiso/configs/releng/efiboot \
+              /build/orionos/iso/profile/; \
+    else \
+        mkdir -p /build/orionos/iso/profile/efiboot/loader/entries && \
+        printf 'timeout 4\ndefault arch-*\n' \
+            > /build/orionos/iso/profile/efiboot/loader/loader.conf; \
+    fi
+
+# Build OrionOS components (full output — no tail so errors are visible)
+RUN cd /build/orionos && make
 
 # Install binaries into the staging root that archiso will include
 RUN cd /build/orionos && \
@@ -44,6 +63,7 @@ RUN cd /build/orionos && \
     install -Dm755 orionshot/orionshot     /build/orionos/iso/profile/airootfs/usr/local/bin/orionshot && \
     install -Dm755 orionclip/orionclip     /build/orionos/iso/profile/airootfs/usr/local/bin/orionclip && \
     install -Dm755 orionpkg/orionpkg       /build/orionos/iso/profile/airootfs/usr/local/bin/orionpkg && \
+    mkdir -p /build/orionos/iso/profile/airootfs/usr/share/themes/ && \
     cp -r themes/OrionOS /build/orionos/iso/profile/airootfs/usr/share/themes/ && \
     install -Dm644 themes/picom.conf       /build/orionos/iso/profile/airootfs/etc/orionos/picom.conf
 
@@ -53,10 +73,9 @@ RUN mkdir -p /build/orionos/iso/profile/airootfs/usr/share/orionos/wallpapers &&
     cp -f /build/orionos/themes/wallpapers/orionos-default.png \
           /build/orionos/iso/profile/airootfs/usr/share/orionos/wallpapers/ 2>/dev/null || true
 
-# Build the ISO
-RUN mkarchiso -v \
+# Build the ISO at container runtime — mkarchiso needs --privileged (from docker run)
+# Output goes to /dist which build-iso.sh mounts from the host.
+CMD mkarchiso -v \
     -w /tmp/iso-work \
-    -o /output \
+    -o /dist \
     /build/orionos/iso/profile
-
-CMD ["/bin/bash"]

iso/profile/airootfs/etc/mkinitcpio.conf

@@ -0,0 +1,4 @@
+MODULES=()
+BINARIES=()
+FILES=()
+HOOKS=(base udev microcode archiso block filesystems keyboard)

iso/profile/packages.x86_64

@@ -24,10 +24,12 @@ libxft
 libxfixes
 libxext
 libpng
+imlib2
 dbus
-libpam
+pam
 fontconfig
 freetype2
+syslinux
 
 # Desktop utilities
 feh
@@ -40,14 +42,13 @@ alsa-utils
 pulseaudio
 
 # Brightness
-light
+brightnessctl
 
 # Media playback control
 playerctl
 
 # Arch tools
 pacman-contrib
-pkexec
 polkit
 
 # System tools

iso/profile/pacman.conf

@@ -1,14 +1,21 @@
 [options]
-HoldPkg     = pacman glibc
+HoldPkg      = pacman glibc
 Architecture = auto
 CheckSpace
 ParallelDownloads = 5
+SigLevel     = Never
 
 [core]
-Include = /etc/pacman.d/mirrorlist
+Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
+Server = https://mirrors.kernel.org/archlinux/$repo/os/$arch
+Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
 
 [extra]
-Include = /etc/pacman.d/mirrorlist
+Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
+Server = https://mirrors.kernel.org/archlinux/$repo/os/$arch
+Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch
 
 [multilib]
-Include = /etc/pacman.d/mirrorlist
+Server = https://geo.mirror.pkgbuild.com/$repo/os/$arch
+Server = https://mirrors.kernel.org/archlinux/$repo/os/$arch
+Server = https://mirror.rackspace.com/archlinux/$repo/os/$arch

iso/profile/profiledef.sh

@@ -9,8 +9,7 @@ iso_version="$(date +%Y.%m)"
 install_dir="arch"
 buildmodes=('iso')
 bootmodes=('bios.syslinux.mbr' 'bios.syslinux.eltorito'
-           'uefi-ia32.grub.esp' 'uefi-x64.grub.esp'
-           'uefi-ia32.grub.eltorito' 'uefi-x64.grub.eltorito')
+           'uefi-x64.systemd-boot.esp' 'uefi-x64.systemd-boot.eltorito')
 arch="x86_64"
 pacman_conf="pacman.conf"
 airootfs_image_type="squashfs"