Repository navigation
fix(ci): build the guest init image on a Linux runner - #59
Merged
Merged
Conversation
The v0.26.0 release failed in 17s at `make -C .forks/containerization/vminitd cross-prep` — "No rule to make target". apple/containerization#810 removed the host cross-compile path: vminitd and the initfs are now built inside a Linux dev container that containerization launches via apple/container, and cctl's `rootfs create` no longer builds the ext4 from binaries, only packages a prebuilt tar. A GitHub macOS runner has no nested virtualization, so it cannot launch that container. Upstream split `init-image` out of `init` for exactly this case. Build the initfs on ubuntu-24.04-arm (free for public repos) in a swift:6.3-noble container mirroring images/linux-dev/Dockerfile, create the OCI image there too, and hand the macOS job a finished init.tar as an artifact. build-initfs.sh falls back to `mke2fs -d` when no loop device is available, which is the case in an unprivileged Actions container. To keep the ~30 minute Swift build skippable, the payload-cache probe moves into its own cheap job whose output gates both expensive jobs. Both fork refs are pinned full SHAs, so the key no longer needs the forks checked out. `make build` locally now requires a working `container` on PATH for the same upstream reason; noted on the runtime target. Co-Authored-By: Claude Opus 5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks the v0.26.0 release, which failed in 17s:
Why it broke
The fork rebase in #58 picked up apple/containerization#810 ("Build vminitd and initfs inside the dev container"), which removed the host cross-compile path this release depended on:
make -C vminitd cross-prep(swiftly + Static Linux SDK on the macOS host) is gone.cctl rootfs createno longer builds the ext4 from--vminitd/--vmexec; it only packages a prebuilt rootfs tar.make initon macOS now runs the build inside a Linux dev container launched by apple/container.A GitHub macOS runner has no nested virtualization, so it cannot launch that container. This is the same constraint that already forces us to ship a prebuilt
vmlinux-16krather than building the kernel in CI.The fix
Upstream split
init-imageout ofinitprecisely so CI can build the initfs on Linux and create the image from the tar afterwards. This PR takes that split, and goes one step further by creating the OCI image on the Linux side too — so the macOS job just consumes a finishedinit.tar.New job layout:
payloadubuntu-latestruntime-*prerelease, gates the two jobs belowinitfsubuntu-24.04-arm,container: swift:6.3-noblevminit:latest, uploaded as aninit.tarartifactgoreleasermacos-26Notes on the choices:
images/linux-dev/Dockerfilein the fork — same Swift release, same apt packages. The Static Linux SDK is installed via thelinux-sdktarget rather than baked in.build-initfs.shfalls back tomke2fs -dwhen no loop device is available, which is exactly the unprivileged-Actions-container case, so no privileged runner is needed.ubuntu-24.04-armis free for public repos.goreleaserusesif: always() && ...becauseinitfsis skipped on a cache hit and a skipped dependency would otherwise block it.Local builds
make buildnow needs a workingcontaineron PATH, for the same upstream reason — it used to cross-compile on the host. Noted on theruntimetarget. Thecross-prepinvocation is removed.Verification
Workflow YAML parses and the three jobs wire up as intended;
make -n runtimeis clean;swift:6.3-nobleconfirmed on Docker Hub. The Linux initfs build itself is unverified until this runs — it is the thing being changed.After merge,
v0.26.0needs to be retagged onto the newmain(the tag currently points at 0832a71, which predates this fix; no release object was created, so nothing is half-published).🤖 Generated with Claude Code