Repository navigation
Conversation
add support for input-tar
Signed-off-by: Avi Deitcher <avi@deitcher.net>
prevent using same file for input tar and output tar
Signed-off-by: largemouth <largemouth@aliyun.com>
chore: fix function name in comment
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
use canonical ref when looking in cache
bump actions to v4 to avoid deprecation
cgroups v2 has been out since 2015. Not having to set a kernel parameter helps improve the user experience by not requiring it when it is required by services in a build. Making this the default was discussed back in 2021. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>
Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>
Make cgroups v2 the default in the init pkg
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
…ectory Signed-off-by: Avi Deitcher <avi@deitcher.net>
move moby components that do not have runtime dependencies to own directory
Signed-off-by: Avi Deitcher <avi@deitcher.net>
add cache export format OCI
Signed-off-by: Avi Deitcher <avi@deitcher.net>
bump actions/setup-go to v5 and go-version to 1.22.3
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Update `ReferenceExpand` to support image references from remote registries. This fixes local image lookup and pulling with newer versions of Docker. fixes #4045 Signed-off-by: Jameel Al-Aziz <jameel@bastion.io>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
* separate kernel series hashing Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> * fix issues with the update component sha script - add bsd/gnu cross compatibility for sed - also replace in */test.sh files - replace potentially problematic xargs - remove potentially problematic word boundary \b Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> * Move common kernel files to dedicated folder Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> * run update-kernel-yamls Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> --------- Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* update images.yaml for raw-efi Signed-off-by: Avi Deitcher <avi@deitcher.net> * Fix mkimage-raw-efi script Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> Signed-off-by: Avi Deitcher <avi@deitcher.net> --------- Signed-off-by: Avi Deitcher <avi@deitcher.net> Signed-off-by: Chris Irrgang <chris.irrgang@gmx.de> Co-authored-by: Chris Irrgang <chris.irrgang@gmx.de>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Group the four builder-related fields (name, image, config path, restart) that always travel together into a BuilderConfig struct. This simplifies: - DockerRunner interface (Build() and Builder() lose 3 params each) - buildOpts struct (4 fields -> 1) - buildArch() function signature (3 fewer params) - DiskUsage() / PruneBuilder() / getClientForPlatform() signatures - 4 WithBuildBuilder*() option functions -> 1 WithBuildBuilderConfig() Also rename the confusingly-named "builderName" local variables in buildArch() and getClientForPlatform() to "dockerContext", which better reflects their actual purpose (they hold a Docker context name, not the builder container name). No behavioral changes. Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
On shared servers where multiple users build packages against the same Docker daemon, all users fight over a single hardcoded builder container named "linuxkit-builder". One user's build can destroy another's in-flight build when builder lifecycle management detects mismatches. Make the builder container name configurable: 1. --builder-name CLI flag (highest priority) 2. LINUXKIT_BUILDER_NAME environment variable 3. "linuxkit-builder" default (original behavior, unchanged) The flag is available on both "linuxkit pkg build" and "linuxkit pkg builder" (du/prune) commands. Users on shared servers can set LINUXKIT_BUILDER_NAME or pass --builder-name to get per-user isolation (e.g. LINUXKIT_BUILDER_NAME=linuxkit-builder-$USER). Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
The moby/buildkit image declares VOLUME /var/lib/buildkit, which causes Docker to create an anonymous volume when no explicit mount is given. These anonymous volumes are orphaned every time the builder container is recreated (--builder-restart, config change, privilege fix), leaking disk space. Switch to a named volume (<builder-name>-state) that is explicitly mounted on container creation. This: - Preserves build cache across container restarts, config changes, and privilege fixes, making rebuilds faster. - Eliminates anonymous volume leaks. - Removes the state volume when the builder image version changes, since buildkit state compatibility across versions is not guaranteed. Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
pkg build: make buildkit builder container name configurable
Introduce environment variables for key CI/CD flags so that self-hosted
runners (e.g. GitHub Actions) can configure registry mirrors and push
targets without modifying calling Makefiles:
- LINUXKIT_MIRROR - equivalent to --mirror (space/comma-separated);
CLI flags take precedence (last SetProxy wins)
- LINUXKIT_PKG_ORG - equivalent to --org for all pkg subcommands
- LINUXKIT_BUILDER_IMAGE - equivalent to --builder-image
- LINUXKIT_BUILDER_CONFIG - equivalent to --builder-config
All env var constants are consolidated in pkg_build.go alongside the
existing LINUXKIT_CACHE, LINUXKIT_BUILDER_NAME, LINUXKIT_BUILDERS.
Priority for all: CLI flag > env var > built-in default
Adds a new Environment Variables section to docs/packages.md with a
reference table covering all LINUXKIT_* vars and a note explaining the
two-layer mirror configuration required in CI (linuxkit pulls vs
buildkit Dockerfile pulls).
Signed-off-by: Roman Shaposhnik <rucoder@gmail.com>
Signed-off-by: Mikhail Malyshev <mike.malyshev@gmail.com>
pkg build: add env var support for mirror, org, builder image and config
LoadConfigFiles() was only called inside the container-inspect block, so filesToLoadIntoContainer was never populated when no builder container existed yet. The subsequent copyFilesToContainer() call received a nil map, sending an empty tar archive and leaving /etc/buildkit/ empty inside the newly created container. Move the LoadConfigFiles() call before the inspect check so the config and certificate data is always available when creating a fresh builder. Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Paul Gaiduk <paulg@zededa.com>
pkg build: fix builder config and certs not copied into new containers
…egistry When an image exists in the registry but not in local cache and a release tag is requested, FindDescriptor returns nil causing a panic at build.go:588. This was a regression introduced in 4129cc7 which removed the early return for missing local cache images. Fix by pulling the image into local cache when the descriptor is nil and a release is needed. Also guard the targetDocker block against nil descriptors, and fix the FindDescriptor mock to return nil,nil (matching the real implementation) instead of an error. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Paul Gaiduk <paulg@zededa.com>
pkg build: fix nil pointer dereference when releasing image only in registry
Signed-off-by: mickael emirkanian <mickael.emirkanian@docker.com>
…29 (#4214) * Update buildkit to v1.29 This is to handle CVE-2026-33748 and CVE-2026-33747. Signed-off-by: eriknordmark <erik@zededa.com> * ci: update golangci-lint to v2.11.4 for Go 1.25 support v2.0.2 was built with Go 1.24 and fails against go.mod targeting Go 1.25.5. v2.11.4 is the latest stable release built with Go 1.25+. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: eriknordmark <erik@zededa.com> * src/cmd/linuxkit: run go mod tidy and go mod vendor Regenerate vendor directory and update go.mod/go.sum to match the buildkit v1.29 dependency updates. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * pkglib: fix authprovider API change in buildkit v1.29 DockerAuthProviderConfig.ConfigFile was removed in buildkit v1.29. Replace with AuthConfigProvider callback wrapping cf.GetAuthConfig. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * gcp: replace deprecated golang.org/x/net/context with stdlib context SA1019: golang.org/x/net/context is deprecated; use the standard library context package instead. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: eriknordmark <erik@zededa.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
containerd v2.2.0 (currently pinned in tools/containerd-dev) is vulnerable to CVE-2026-46680: when an image's User directive is a numeric string outside int32 range, containerd treats it as a username and resolves it against the image's /etc/passwd, letting a crafted image escape Kubernetes runAsNonRoot enforcement. Fixed on the 2.2 line in v2.2.4. The bump cascades through the FROM in pkg/containerd, pkg/init and test/pkg/containerd (all of which build off linuxkit/containerd-dev) and the example/test/project YAMLs that pin the resulting tree hashes. CI on this PR will fail until a maintainer pushes the rebuilt linuxkit/containerd-dev image; I don't have push access to the linuxkit/ Docker Hub org. Signed-off-by: eriknordmark <erik@zededa.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* pkglib: use SolveOpt.LocalMounts instead of LocalDirs Package builds hand buildkit the package directory as the Dockerfile and build-context local mounts. They were passed as plain paths through the deprecated SolveOpt.LocalDirs field, which buildkit removed in v0.30.0 in favour of SolveOpt.LocalMounts. Wrap each path in an fsutil filesystem and pass it as a local mount instead, which is what buildkit did internally for LocalDirs entries before dropping the field. No behaviour change against the currently pinned buildkit v0.29.0, where both fields exist; this only removes the barrier to moving past v0.29.0. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * src/cmd/linuxkit: update buildkit to v0.31.1 Moves the vendored buildkit client from v0.29.0 to v0.31.1, which carries the two low-severity fixes in that patch release (GHSA-7236-3392-c5c6, a custom frontend bypassing Seccomp/AppArmor restrictions, and GHSA-72x6-4j93-7w86, a runtime DoS via unbounded group parsing). Anything past v0.29.0 needs SolveOpt.LocalMounts, which the preceding commit switched to. go mod tidy pulls a matching round of transitive updates -- docker/cli, go-containerregistry, containerd, sigstore and the OpenTelemetry set are the visible ones -- and raises the go directive to 1.25.9. It also retires the vendored golang.org/x/net/context copy, unused since gcp moved to the standard library context. Signed-off-by: eriknordmark <erik@zededa.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Signed-off-by: eriknordmark <erik@zededa.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* Fix gzip EFI zboot loading in macOS VZ ARM64 EFI zboot kernels wrap a compressed Linux Image in an MZ/zimg container. Extract the gzip payload before passing it to the VZ loader. Validate the fixed header, Linux PE signature, payload bounds, output size and complete ARM64 Image header. Preserve existing non-zboot paths. Return setup and VM-start errors through the runner so deferred cleanup runs. Restore terminal settings and unregister signal notifications when leaving the runner, including failure and interrupted shutdown paths. Add malformed-input, output-bound, I/O failure, cleanup and fuzz tests. Validate the CLI with wrapped, raw and gzip kernels, setup/start failures, and signal-driven shutdown on an ARM64 Mac. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Bound VZ shutdown and cancel kernel preparation Install signal handling before kernel preparation and clean up partial output on cancellation. Bound graceful and forced shutdown, honor a second signal, and preserve failures from stop requests and cleanup. Add cancellation, gzip boundary, cleanup failure and VM lifecycle regression tests. Validate 14 actual CLI cases, including persistent guests, interrupted decoding, error paths and subsequent successful boots. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Recheck VZ completion before timeout errors Honor buffered stop results and ready terminal states when the deadline fires concurrently. Bound the state drain so repeated notifications cannot extend shutdown indefinitely. Add deterministic result-priority and bounded-drain regressions. Revalidate race tests, vet, ten lifecycle repetitions and all fourteen actual CLI acceptance cases. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Reject blocking kernel inputs before VZ startup Open kernel paths nonblocking on Darwin and validate the opened file, preserving symlinks to regular files and close-on-exec behavior. Reject FIFO, device and directory inputs without waiting for a writer. Install the signal watcher immediately before kernel preparation so earlier metadata and command-line reads retain default termination behavior. Cover FIFO rejection, regular-file symlinks and descriptor flags with regression tests. Validate the three preflight CLI cases, all fourteen existing runtime scenarios, race tests, vet and Linux/Windows cross-builds. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Document VZ kernel and shutdown limits Describe gzip EFI zboot support and the decoded size limit. Document signal handling, shutdown deadlines, forced-stop data loss and macOS availability so operators can assess the current shutdown policy. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Force VZ shutdown only on a second signal Keep waiting for graceful guest shutdown after the first SIGINT or SIGTERM, including declined or pending requests. Do not force a stop merely because a deadline expires or state notifications close. A second signal triggers the bounded forced-stop path. Preserve observed errors and keep synchronous Start ownership. Document the policy and test request failures, blocked callbacks, natural stop, forced-stop failures and cancellation ordering. Validate the policy on a persistent guest beyond the former five-second grace period, plus a 120-second run, repeated shutdowns, recovery boots and FIFO regressions. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Resolve VZ lint findings Check test cleanup errors, discard unused shutdown channel results before returning, and normalize the disk-format error text. Preserve the first-signal graceful wait and second-signal forced-stop policy. Fixes #4225 Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> * Deduplicate VZ kernel checks and scope defaults Share opened-file validation while keeping the Darwin nonblocking open and the portable pre-open check separate. Restrict lifecycle defaults to Darwin+cgo, matching their only caller and fixing the Linux unused lint error. Preserve shutdown behavior. Signed-off-by: Joonho Lee <mynameisjune111@gmail.com> --------- Signed-off-by: Joonho Lee <mynameisjune111@gmail.com>
Signed-off-by: Joonho Lee <mynameisjune111@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot]
Can you help keep this open source service alive? 💖 Please sponsor : )