Bump Firecracker default to v1.12.0 #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build VM Images | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - 'images/**' | |
| - 'crates/sandchest-agent/**' | |
| workflow_dispatch: | |
| inputs: | |
| toolchain: | |
| description: 'Toolchain to build' | |
| required: true | |
| default: 'base' | |
| type: choice | |
| options: | |
| - base | |
| - node-22 | |
| - python-3.12 | |
| - go-1.22 | |
| concurrency: | |
| group: build-images | |
| cancel-in-progress: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build: | |
| name: Build Images | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| targets: x86_64-unknown-linux-musl | |
| - uses: Swatinem/rust-cache@v2 | |
| - name: Install build dependencies | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler musl-tools debootstrap e2fsprogs | |
| - name: Build guest agent (static musl binary) | |
| run: | | |
| cargo clean -p sandchest-agent --target x86_64-unknown-linux-musl --release | |
| cargo build --release --package sandchest-agent --target x86_64-unknown-linux-musl --features vsock | |
| - name: Verify agent has vsock support | |
| run: | | |
| strings target/x86_64-unknown-linux-musl/release/sandchest-agent | grep -c vsock || { echo "ERROR: agent binary missing vsock support"; exit 1; } | |
| ls -la target/x86_64-unknown-linux-musl/release/sandchest-agent | |
| - name: Fetch kernel | |
| working-directory: images | |
| run: make kernel | |
| - name: Build base rootfs with guest agent | |
| working-directory: images | |
| run: | | |
| sudo make rootfs \ | |
| AGENT_BIN=../target/x86_64-unknown-linux-musl/release/sandchest-agent | |
| - name: Install toolchain | |
| if: ${{ github.event.inputs.toolchain && github.event.inputs.toolchain != 'base' }} | |
| working-directory: images | |
| run: | | |
| sudo make toolchain \ | |
| TOOLCHAIN=${{ github.event.inputs.toolchain }} | |
| - name: Verify agent inside rootfs has vsock | |
| run: | | |
| ROOTFS="images/output/ubuntu-22.04/${{ github.event.inputs.toolchain || 'base' }}/rootfs.ext4" | |
| MNT=$(mktemp -d) | |
| sudo mount -o loop,ro "$ROOTFS" "$MNT" | |
| AGENT="$MNT/usr/local/bin/sandchest-guest-agent" | |
| echo "Agent binary inside rootfs:" | |
| ls -la "$AGENT" | |
| VSOCK_COUNT=$(strings "$AGENT" | grep -c vsock || true) | |
| echo "vsock string count: $VSOCK_COUNT" | |
| sudo umount "$MNT" && rmdir "$MNT" | |
| if [ "$VSOCK_COUNT" -lt 10 ]; then | |
| echo "ERROR: agent binary inside rootfs is missing vsock support ($VSOCK_COUNT strings)" | |
| exit 1 | |
| fi | |
| - name: Validate image | |
| working-directory: images | |
| run: ./scripts/validate-image.sh --output output/ubuntu-22.04/${{ github.event.inputs.toolchain || 'base' }} | |
| - name: Upload kernel to R2 | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} | |
| AWS_DEFAULT_REGION: auto | |
| run: | | |
| aws s3 cp images/kernel/vmlinux-5.10 \ | |
| "s3://${{ secrets.R2_BUCKET }}/binaries/vmlinux/latest/vmlinux" \ | |
| --endpoint-url "${{ secrets.R2_ENDPOINT }}" | |
| - name: Upload rootfs to R2 | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }} | |
| AWS_DEFAULT_REGION: auto | |
| run: | | |
| TOOLCHAIN=${{ github.event.inputs.toolchain || 'base' }} | |
| aws s3 cp "images/output/ubuntu-22.04/${TOOLCHAIN}/rootfs.ext4" \ | |
| "s3://${{ secrets.R2_BUCKET }}/binaries/rootfs/latest/rootfs.ext4" \ | |
| --endpoint-url "${{ secrets.R2_ENDPOINT }}" | |
| aws s3 cp "images/output/ubuntu-22.04/${TOOLCHAIN}/rootfs.ext4" \ | |
| "s3://${{ secrets.R2_BUCKET }}/binaries/rootfs/${{ github.sha }}/rootfs.ext4" \ | |
| --endpoint-url "${{ secrets.R2_ENDPOINT }}" | |
| - name: Upload image artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: vm-images-${{ github.sha }} | |
| path: | | |
| images/kernel/vmlinux-5.10 | |
| images/output/ubuntu-22.04/*/rootfs.ext4 | |
| images/output/ubuntu-22.04/*/rootfs.sha256 | |
| retention-days: 30 | |
| # Images are deployed to servers via the admin "Redeploy Daemon" button, | |
| # which pulls from R2 and patches the rootfs in-place. No direct SSH needed. |