Boot and update from runtime merged image fragments

1. A computer-implemented method for updating an operating system of a computing device, the method comprising:

determining an update that is to be implemented in the operating system;

accessing a plurality of composite image files that correspond to the update, each of the composite image files comprising an image fragment of a set of image fragments that form a complete operating system image, wherein the composite image files are signed containers containing files for implementing the update to the operating system;

performing a runtime in-memory merge of the composite image files on the computing device;

exposing the merged composite image files as a read-only volume; and

initiating a system boot of the computing device using the read-only volume.

2. The computer-implemented method of claim 1 , wherein the in-memory merge comprises storing modifications to the operating system defined by the composite image files as a read-write layer.

3. The computer-implemented method of claim 1 , wherein a layout of the composite image file comprises a root file, a metadata region, and one or more data regions.

4. The computer-implemented method of claim 3 , wherein the one or more data regions include a small data region and a data region.

5. The computer-implemented method of claim 4 , wherein the small data region is for file content that is less than a predetermined size, and the data region is for file content that meets or exceeds the predetermined size.

6. The computer-implemented method of claim 5 , wherein the data region is aligned with a start of each region to a page size.

7. The computer-implemented method of claim 1 , wherein the signed containers include data to track what directory/key owns security for the respective signed container.

8. The computer-implemented method of claim 1 , wherein the composite image files are processed as individual packages prior to delivery to the computing device.

9. A system comprising:

one or more processors;

a memory in communication with the one or more processors, the memory having computer-readable instructions stored thereupon which, when executed by the one or more processors, cause the system to perform operations comprising:

determining one or more operating system updates that are to be implemented in a computing device;

accessing a plurality of files and data associated with the updates;

generating a plurality of composite image files for implementing the update, each of the composite image files comprising an image fragment of a set of image fragments that form a complete operating system image, wherein the composite image files are signed containers that are combinable at the computing device by performing a runtime in-memory merge of the composite image files; and

sending the signed containers to the computing device.

10. The computing device of claim 9 , wherein a layout of the composite image file comprises a root file, a metadata region, and one or more data regions.

11. The computing device of claim 10 , wherein the one or more data regions include a small data region and a data region.

12. The computing device of claim 11 , wherein the one or more data regions include a small data region and a data region.

13. The computing device of claim 12 , wherein the small data region is for file content that is less than a predetermined size, and the data region is for file content that meets or exceeds the predetermined size.

14. The computing device of claim 13 , wherein the data region is aligned with a start of each region to a page size.

15. The computing device of claim 9 , wherein the in-memory merge comprises storing modifications to the operating system defined by the composite image files as a read-write layer.

16. A computer-readable medium having encoded thereon computer-executable instructions that, when executed by one or more processing units of a computing device, cause the computing device to perform operations comprising:

accessing a plurality of composite image files that correspond to an update that is to be implemented in the computing device, each of the composite image files comprising an image fragment of a set of image fragments that form a complete operating system image, wherein the one or more composite image files are signed containers;

performing a runtime in-memory merge of the composite image files;

exposing the merged composite image files as a read-only volume; and

initiating a system boot using the read-only volume.

17. The computer-readable medium of claim 16 , wherein the in-memory merge comprises storing modifications defined by the composite image files as a read-write layer.

18. The computer-readable medium of claim 16 , wherein the signed containers include data to track what directory/key owns security for the respective signed container.

19. The computer-readable medium of claim 16 , wherein a layout of the composite image file comprises a root file, a metadata region, and one or more data regions.

20. The computer-readable medium of claim 16 , wherein the composite image files are processed as individual packages prior to delivery to the computing device.