Skip to content

fix(image): say which platforms an image archive can serve - #8304

Merged
devantler merged 4 commits into
mainfrom
claude/image-platform-coverage-8269
Nov 11, 2026
Merged

devantler merged 4 commits into
mainfrom
claude/image-platform-coverage-8269

Conversation

@devantler

Copy link
Copy Markdown
Contributor

Why

An exported image archive only holds content for the processor type of the machine it came from, but it still lists every processor type the image supports. Importing it on a machine of another type failed late, with an unclear error, after the export had reported success.

What

Import now checks each machine's processor type before copying anything, and stops with a clear message naming the images it cannot serve there. After an export, KSail warns which images other processor types cannot use, and the troubleshooting guide explains what a cross-architecture import supports.

Fixes #8269

🤖 Generated with Claude Code

An export carries content only for its nodes' platform but keeps each
multi-platform image's full index, so the archive advertises
platforms it cannot serve. Importing it on a node of another platform
then failed late, inside ctr, on a missing manifest.

Import now reads the archive's index first and, when it holds a
multi-platform image, checks each node's platform before copying
anything. A node the archive has no content for is refused with an
error naming the images. Single-node and multi-node exports both warn
afterwards which images carry only some of their platforms. The
troubleshooting guide says what a cross-architecture import supports.

Part of #8269

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

User trial at 1015eaa6ea84ab0238e44336a395db64ae594eb8

  • Real clusters: the CI system tests at this head exported docker.io/traefik/whoami:v1.10 (a multi-platform image) from live Vanilla (Kind) and K3s clusters on amd64 nodes. Both runs printed the new notice right after the export: WARN Image archive carries only some platforms of multi-platform images; import it on nodes of the carried platform carried=linux/amd64 images=docker.io/traefik/whoami:v1.10. The archive stayed 2.8M, the same size as before this change.
  • Same-platform import still works: both runs then imported the archive, restarted the workload and saw it healthy again.
  • Cross-platform refusal: this host has no arm64 node, so the refusal is proven by unit tests that build a multi-platform archive carrying only amd64 content. An import onto an arm64 node stops before anything is copied, with an error naming the image; an amd64 node is accepted. The image package tests pass locally (167).
  • The cancelled Go validation and workflow scan runs at this head have been re-run.

🤖 Generated with Claude Code

@github-actions

github-actions Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/10.2.0/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.sh
✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.test.sh
✅ [SUCCESS] .github/actions/free-disk-space/free-disk-space.sh
✅ [SUCCESS] .github/actions/ksail-cluster/hetzner-inventory-config.sh
✅ [SUCCESS] .github/actions/ksail-system-test/argocd-adoption.sh
✅ [SUCCESS] .github/actions/ksail-system-test/autoscaler-audit-trial.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/chart-values-drift.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-cli.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-values-precedence.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/talos-kubernetes-upgrade.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/reject-remote-kustomize-resources.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/remote-resource-guard.test.sh
✅ [SUCCESS] .github/actions/pull-registry-image/pull-registry-image.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/cache-validation.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/mirror-artifact.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.test.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.test.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.test.sh
✅ [SUCCESS] .github/scripts/build-calico-migration-baseline.sh
✅ [SUCCESS] .github/scripts/cask-pr-handoff-workflow.test.sh
✅ [SUCCESS] .github/scripts/cask-read-api.sh
✅ [SUCCESS] .github/scripts/cask-read-api.test.sh
✅ [SUCCESS] .github/scripts/cask-rendering.test.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.test.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.test.sh
✅ [SUCCESS] .github/scripts/codeql-source.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/collect-release-build-experiment.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.test.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.test.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-fixture.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-fixture.test.sh
✅ [SUCCESS] .github/scripts/diagnostics-artifact-ksail-fixture.sh
✅ [SUCCESS] .github/scripts/download-go-modules.sh
✅ [SUCCESS] .github/scripts/eks-report-test-lib.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.test.sh
❌ [ERROR] .github/scripts/generate-completions.sh
    Error: File:[.github/scripts/generate-completions.sh] is not executable

✅ [SUCCESS] .github/scripts/go-notices-release.test.sh
✅ [SUCCESS] .github/scripts/install-release.test.sh
✅ [SUCCESS] .github/scripts/list-link-check-files.sh
✅ [SUCCESS] .github/scripts/prepare-nested-kind-host.sh
✅ [SUCCESS] .github/scripts/prepare-nested-kind-host.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-cohort.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.test.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.test.sh
✅ [SUCCESS] .github/scripts/publish-operator-chart.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.test.sh
✅ [SUCCESS] .github/scripts/release-build-collector.test.sh
✅ [SUCCESS] .github/scripts/release-build-experiment.test.sh
✅ [SUCCESS] .github/scripts/release-build-samples.lib.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.test.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.test.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-replay.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.test.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.test.sh
✅ [SUCCESS] .github/scripts/summarize-mutation-report.sh
✅ [SUCCESS] .github/scripts/summarize-mutation-report.test.sh
✅ [SUCCESS] .github/scripts/summarize-nested-kubelet.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.test.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.test.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.test.sh
✅ [SUCCESS] .github/scripts/verify-diagnostics-artifact.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-vendored-comment-scan.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.test.sh
✅ [SUCCESS] desktop/scripts/make-icns.sh
✅ [SUCCESS] desktop/scripts/make-info-plist.sh
✅ [SUCCESS] desktop/scripts/make-macos-app.sh
✅ [SUCCESS] desktop/scripts/verify-macos-archive.sh
✅ [SUCCESS] docs/demos/render.sh
✅ [SUCCESS] images/ksail-analysis-runner/smoke.sh
✅ [SUCCESS] install.sh
✅ [SUCCESS] internal/ciharness/testdata/schematic_fake_ksail.sh
✅ [SUCCESS] pkg/svc/provisioner/cluster/vcluster/containerd_registry_hosts.sh
✅ [SUCCESS] scripts/stage-webui.sh

✅ Linters with no issues

actionlint, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@github-code-quality

github-code-quality Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Code coverage overview

Languages: Go

Go / code-coverage/go

main f9179bd claude/image-platfor... fba03b3 +/-
72% 72% 0%
View coverage of the 7 most impacted files.
File main f9179bd claude/image-platfor... fba03b3 +/-
pkg/svc/image/exec.go 100% 95% -5%
pkg/svc/image/importer.go 89% 88% -1%
pkg/cli/cluster...i/distconfig.go 78% 78% 0%
pkg/svc/image/exporter.go 88% 90% +2%
pkg/svc/install...site_removal.go 90% 92% +2%
pkg/svc/provisi...etzner/token.go 71% 75% +4%
pkg/svc/image/p...orm_coverage.go 0% 81% +81%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.


Updated November 11, 2026 02:35 UTC

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-11T03:13:39.099215Z fba03b3 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1015eaa6ea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pkg/svc/image/platform_coverage.go Resolved
> 🤖 Generated by the Agentic Engineer

Check each carried manifest for its config and layers. Cover archives that advertise a platform and contain its manifest but omit a layer.
Keep both node executor helpers in exec.go, and expect the import
archive cleanup on the detached cleanup context that main now uses.

Part of #8269

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

User trial at 287d7fc32765c2648b939139c2d201d771f89878

  • Since the last trial: the Codex finding is fixed (a platform counts as carried only when the archive holds its manifest's config and every layer), and main is merged in (after fix(image): give each node import its own archive and always remove it #8301 landed) with both node helpers kept.
  • Real clusters at this head: the Vanilla (Kind) and K3s system tests exported docker.io/traefik/whoami:v1.10 and printed the notice carried=linux/amd64 images=docker.io/traefik/whoami:v1.10; the archive stayed 2.8M. Both then imported it on their amd64 nodes, restarted the workload and saw it healthy. That also shows the stricter check still finds the real amd64 config and layers, so a same-platform import is not refused.
  • Cross-platform refusal remains proven by unit tests (manifest missing, and manifest kept without its config and layers). Image package tests pass locally (170) and CI is green (98 checks).

🤖 Generated with Claude Code

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: 287d7fc327

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Regenerate the embedded chat documentation so it carries both main's
documentation changes and the cross-architecture troubleshooting note.

Part of #8269

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

User trial at fba03b3d0fff8ee981ae769132c6255572658e02

  • The only change since the previous trial is a merge of main, with the embedded chat documentation regenerated by its generator to resolve the conflict in that generated file.
  • The Vanilla (Kind) system test at this head again printed the export notice carried=linux/amd64 images=docker.io/traefik/whoami:v1.10, then imported the archive, restarted the workload and saw it healthy. CI is green (98 checks).

🤖 Generated with Claude Code

@devantler

Copy link
Copy Markdown
Contributor Author

🤖 Generated by the Agentic Engineer

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: fba03b3d0f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@devantler
devantler marked this pull request as ready for review November 11, 2026 03:15
@devantler
devantler merged commit 01ebcd6 into main Nov 11, 2026
98 checks passed
@devantler
devantler deleted the claude/image-platform-coverage-8269 branch November 11, 2026 03:15
@github-project-automation github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Nov 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: ✅ Done

Development

Successfully merging this pull request may close these issues.

Image export archives advertise platforms they do not carry

1 participant