###############################################################################
# Core initramfs / board support
###############################################################################

CONFIG_HWMON=y
# Hardware monitoring framework. Needed so sensor drivers can expose temps/fans.

CONFIG_I2C=y
# Core I2C subsystem. Required by your RTC/fan controller drivers.

CONFIG_SENSORS_EMC2305=y
# EMC2305 fan controller driver. Built-in so fan control is available early.

CONFIG_RTC_DRV_PCF2127=y
# RTC driver for PCF2127. Built-in so timekeeping is available early.


###############################################################################
# Namespaces
# These are fundamental container primitives. Keep these built-in.
###############################################################################

CONFIG_NAMESPACES=y
# Master switch for Linux namespaces.

CONFIG_UTS_NS=y
# Isolates hostname/domainname per container.

CONFIG_IPC_NS=y
# Isolates SysV IPC and POSIX message queues between containers.

CONFIG_PID_NS=y
# Gives containers their own PID tree (so processes inside see their own PID 1).

CONFIG_NET_NS=y
# Gives containers their own network stack, interfaces, routing, etc.

CONFIG_USER_NS=y
# User namespaces. Useful for modern container behavior and future flexibility.
# Not every setup strictly needs this on day one, but I would enable it.


###############################################################################
# Cgroups / resource control
# Required for kubelet/CRI-O to manage resource isolation.
###############################################################################

CONFIG_CGROUPS=y
# Master switch for cgroups.

CONFIG_CGROUP_BPF=y
# Allows BPF programs to be attached to cgroups. Not required for first boot,
# but modern systems increasingly expect this.

CONFIG_CGROUP_FREEZER=y
# Allows freezing/thawing process groups. Useful for container lifecycle control.

CONFIG_CGROUP_PIDS=y
# Limits number of processes in a cgroup.

CONFIG_CGROUP_DEVICE=y
# Controls device access from containers.

CONFIG_CPUSETS=y
# CPU affinity partitioning by cgroup.

CONFIG_MEMCG=y
# Memory cgroup support. Critical for container memory accounting/limits.

CONFIG_BLK_CGROUP=y
# Block IO control/accounting for cgroups.

CONFIG_CGROUP_SCHED=y
# Scheduler integration for cgroups.

CONFIG_FAIR_GROUP_SCHED=y
# Fair scheduler group support for cgroups.

CONFIG_CFS_BANDWIDTH=y
# CPU quota/limit support. Important for kubelet resource enforcement.


###############################################################################
# Filesystem / tmpfs / container filesystem basics
###############################################################################

CONFIG_KEYS=y
# Kernel key retention service. Commonly relied on by container/userland tooling.

CONFIG_TMPFS=y
# Tmpfs support. Containers and runtimes rely on this heavily.

CONFIG_TMPFS_XATTR=y
# Extended attributes on tmpfs. Useful for container runtime behavior.

CONFIG_TMPFS_POSIX_ACL=y
# POSIX ACLs on tmpfs. Good compatibility feature for userland.

CONFIG_OVERLAY_FS=y
# Overlay filesystem. This is the big one for container image/layer storage.
# Module is fine; CRI-O can load/use it after boot. No need to bloat FIT image.

CONFIG_FS_POSIX_ACL=y
# General POSIX ACL support. Good to have for overlay/tmpfs behavior.


###############################################################################
# Core networking stack
###############################################################################

CONFIG_INET=y
# IPv4 stack.

CONFIG_IPV6=y
# IPv6 stack. You may be tempted to disable it, but Kubernetes/container stacks
# increasingly assume it exists. Keep it on unless you have a hard reason not to.

CONFIG_UNIX=y
# Unix domain sockets. Containers and runtimes absolutely rely on this.

CONFIG_TUN=m
# TUN/TAP device support. Commonly used by networking tools/VPN/CNI-related flows.
# Module is fine.

CONFIG_DUMMY=m
# Dummy network interface. Sometimes useful for CNI/network setups and testing.


###############################################################################
# Netfilter / packet filtering / NAT
# This is where container networking gets messy. Better to enable a sane baseline.
###############################################################################

CONFIG_NETFILTER=y
# Netfilter core framework. Module is okay if your setup loads it before use.

CONFIG_NETFILTER_ADVANCED=y
# Exposes more advanced netfilter options and modules.

CONFIG_NF_CONNTRACK=y
# Connection tracking. Critical for NAT, Kubernetes service traffic, and many CNIs.

CONFIG_NF_NAT=y
# NAT framework. Required for masquerading and pod egress in many setups.

CONFIG_NF_TABLES=y
# nftables framework. Modern Linux packet filtering backend.

CONFIG_NFT_CT=y
# nftables conntrack expressions.

CONFIG_NFT_COUNTER=y
# nftables packet/byte counters

CONFIG_NFT_CHAIN_NAT=y
# nftables NAT chain support.

CONFIG_NFT_MASQ=y
# nftables masquerade support. Often needed for pod egress NAT.

CONFIG_NFT_REDIR=y
# nftables redirect target.

CONFIG_NFT_NAT=y
# nftables NAT support.

CONFIG_NF_NAT_IPV4=y
# IPv4 NAT helper support. Some kernels still expose this separately.

CONFIG_NF_NAT_IPV6=y
# IPv6 NAT helper support.

CONFIG_NF_CT_NETLINK=y
# userspace netlink access to the conntrack table; kube-proxy uses this for conntrack listing/cleanup

CONFIG_NF_CT_NETLINK_TIMEOUT=y
# userspace netlink support for conntrack timeout objects

CONFIG_NF_CT_NETLINK_HELPER=y
# userspace netlink support for conntrack helper objects

CONFIG_IP_NF_IPTABLES=y
# iptables compatibility for IPv4. Still useful because lots of CNI/plugin code
# still expects iptables even on nft-backed systems.

CONFIG_IP_NF_NAT=y
# IPv4 NAT support for iptables compatibility.

CONFIG_IP6_NF_IPTABLES=y
# ip6tables compatibility.

CONFIG_IP6_NF_FILTER=y
# IPv6 "filter" table (same as above but for IPv6)

CONFIG_NF_REJECT_IPV4=y
# core IPv4 reject logic used by netfilter/iptables/nftables

CONFIG_NFT_REJECT=y
# nftables equivalent of REJECT (needed for nf_tables backend compatibility)

CONFIG_IP_NF_FILTER=y
# IPv4 "filter" table (INPUT/FORWARD/OUTPUT chains for iptables)

CONFIG_IP_NF_TARGET_REJECT=y
# IPv4-specific REJECT target for legacy iptables

CONFIG_IP6_NF_TARGET_REJECT=y
# IPv6-specific REJECT target for legacy iptables

CONFIG_IP_SET=m
# IP sets. Useful for some network policies / firewalling toolchains.

CONFIG_NETFILTER_NETLINK_ACCT=y
# netfilter accounting subsystem used for nfacct-based kube-proxy metrics

CONFIG_NETFILTER_XT_MATCH_NFACCT=y
# iptables nfacct match that hooks rules into the netfilter accounting subsystem

CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
# xtables match for address types. Often used in iptables rules.

CONFIG_NETFILTER_XT_TARGET_REJECT=y
# iptables REJECT target (actively reject packets instead of silently dropping)

CONFIG_NETFILTER_XT_MATCH_COMMENT=y
# Allows comments in iptables rules. Not critical, but harmless and useful.

CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
# xtables conntrack matching.

CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
# iptables "statistic" match used for probabilistic packet matching / load balancing

CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
# Match multiple ports in one rule.

CONFIG_NETFILTER_XT_MATCH_TCPMSS=y
# Useful for TCP MSS clamping in some network paths.

CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
# iptables MASQUERADE target. Very commonly needed for pod outbound NAT.

CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
# Redirect target.

CONFIG_NETFILTER_XT_TARGET_MARK=y
# Packet marking support. Useful for advanced networking/routing rules.

CONFIG_NETFILTER_XT_TARGET_CT=y
# Connection tracking target for xtables.

# Optional. Good only if you know you need transparent proxying.
# Not required for initial CRI-O bring-up.
# CONFIG_NETFILTER_XT_TARGET_TPROXY=m


###############################################################################
# Bridge / container interface plumbing
###############################################################################

CONFIG_VETH=y
# Virtual Ethernet pairs. This is how container interfaces are commonly connected
# to the host/network namespace.

CONFIG_BRIDGE=y
# Ethernet bridge support. Needed by bridge-based CNIs.

CONFIG_BRIDGE_NETFILTER=y
# Allows bridged traffic to pass through netfilter/iptables/nftables hooks.
# Important for Kubernetes networking behavior.

# Optional / version-dependent:
# Some kernels expose additional ebtables/bridge netfilter pieces separately.
# Keep this if your kernel has it, but don't panic if it doesn't.
CONFIG_BRIDGE_NF_EBTABLES=y
# Bridge filtering via ebtables compatibility. Sometimes useful, not always critical.


###############################################################################
# Security / sandboxing
###############################################################################

CONFIG_SECCOMP=y
# Secure computing mode. Lets runtimes restrict syscall surface.

CONFIG_SECCOMP_FILTER=y
# BPF-based seccomp filters. This is the useful seccomp mode for containers.

# AppArmor / SELinux are optional depending on distro/security model.
# Alpine often won't use AppArmor by default; that's fine for first bring-up.

# If your kernel tree has these and you care later:
# CONFIG_SECURITY=y
# CONFIG_SECURITYFS=y


###############################################################################
# Misc userspace/container compatibility
###############################################################################

CONFIG_POSIX_MQUEUE=y
# POSIX message queues. Containers/apps sometimes rely on this.

CONFIG_EPOLL=y
# Event polling. Usually already enabled; standard modern userspace feature.

CONFIG_SIGNALFD=y
# File-descriptor-based signal delivery. Common Linux userspace feature.

CONFIG_TIMERFD=y
# File-descriptor timers. Common Linux userspace feature.

CONFIG_EVENTFD=y
# Event notification file descriptors. Common Linux userspace feature.

CONFIG_MEMFD_CREATE=y
# Anonymous memory-backed file creation. Widely used by modern software.

CONFIG_FHANDLE=y
# File handle support. Useful for container/runtime operations.

CONFIG_DMIID=n
# Optional on embedded boards; usually not needed unless your tree selects it.


###############################################################################
# Storage / block / other practical container bits
###############################################################################

CONFIG_BLK_DEV_LOOP=y
# Loop devices. Often useful for image/layer tooling or debugging.
# Could be =m too, but built-in is harmless and often convenient.

CONFIG_AUTOFS_FS=y
# Automount filesystem support. Not strictly required for CRI-O, but harmless.

CONFIG_PROC_FS=y
# /proc support. Essential.

CONFIG_SYSFS=y
# /sys support. Essential.

CONFIG_DEVTMPFS=y
# Kernel-managed /dev population support.

CONFIG_DEVTMPFS_MOUNT=y
# Automatically mount devtmpfs. Very practical on small/custom systems.

### Disable XEN because it breaks our build and we don't need it
CONFIG_XEN=n
CONFIG_XEN_DOM0=n
CONFIG_VHOST_XEN=n