Gsettles/etcd mcr v2 - #4250
Closed
gsettles01 wants to merge 301 commits into
Closed
Conversation
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Adding this to fix console issues on Scaleway's instances Signed-off-by: Tristan Bringuier <tristan.bringuier@enix.fr> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: Tristan Bringuier <tristan.bringuier@enix.fr> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
rclone was previously called from the Mantle image but it's not the case anymore because we need some environment variables (CHANNEL, ARCH, etc.) Let's switch to the `rclone` Docker image. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
This pulls in flatcar/init#136 to prevent the default network setup to conflict with TUN/TAP device configuration from other tools. Signed-off-by: Kai Lueke <kailuke@microsoft.com>
Exclude TUN devices from default systemd-networkd setup
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Maxime de Roucy <maxime.deroucy@claranet.com> Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Christian Baumann <thechristschn@gmail.com> Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It's from Gentoo commit b4c450b220406a895ed093b19b92241746408a66. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
It's from Gentoo commit 107cc22593c97542852ee68c564554c2fbfcdf20. Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
This has been raised in current CI. Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
In RPM build mode, copy the image's rpmdb.sqlite out as an IC sidecar artifact (acl_production_image_rpmdb.sqlite) alongside the VHD so package state is preserved for downstream image-customization steps. Also tighten RPM database existence checks to test for the rpmdb.sqlite file directly instead of the var/lib/rpm directory in build_sysext and rpm_install.sh. Original-PR: 27776 Co-authored-by: Lanze Liu <lanzeliu@microsoft.com>
Adds a docs page covering how to enable kdump on ACL, and fixes an inaccurate addon path in the build script comments. - Add `acl/docs/kdump.md` — enable/disable steps, verification, dump collection, and how kdump is wired into the image. - Link the new page from `acl/docs/README.md`. - Fix stale comments in `build_library/rpm/uki_install.sh` that pointed at the non-existent `EFI/Linux/acl.efi.extra.d/`. The ACL UKI is `vmlinuz-<kernel_version>.efi`, so the addon must go in the version-specific `EFI/Linux/vmlinuz-<kver>.efi.extra.d/`. Original-PR: 27971 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-reset (#21) The support-UKI-mode-by-restoring-firstboot-addon patch hardcoded the UKI addon dir as /boot/EFI/Linux/acl.efi.extra.d. ACL UKIs now use UAPI naming (vmlinuz-<version>.efi), so that path never exists - is_uki_mode() always returned false and flatcar-reset silently skipped re-arming the firstboot (Ignition) addon on UKI images. Derive the dir from $(uname -r) so it matches the actual UKI name. All three uses (is_uki_mode, --stop cleanup, restore) reference the variable, so the single change fixes the whole flow. Bump coreos-init.spec Release 3 -> 4. Original-PR: 27985 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Select the QEMU VM boot timeout by architecture instead of a single fixed 180s, fixing flaky arm64 QEMU smoke-test boot failures. Emulated arm64 (TCG) VMs boot far slower than native amd64. Across recent builds the "Qemu VM Boot" smoke test runs ~19-28s on amd64 but clusters near 180-250s on arm64, producing marginal-timeout boot failures at the 180s ceiling. - validate/validate_common.sh: add per-arch defaults VM_BOOT_TIMEOUT_AMD64=100 and VM_BOOT_TIMEOUT_ARM64=300; VM_BOOT_TIMEOUT now defaults to empty and a new resolve_boot_timeout() (called at the top of validate_main) picks the value from BOARD. An explicit VM_BOOT_TIMEOUT env var or --boot-timeout flag still overrides. - build_rpm_image.sh: default left empty; only forwards --boot-timeout to the validate script when explicitly set, keeping validate_common.sh the single source of truth. - Update help/usage docs in the three affected scripts. Original-PR: 27944 Co-authored-by: Jiri Appl <Jiri.Appl@microsoft.com>
…23) Enable acl.kdump and acl.kdump.grub as enforcing kola tests, with bootloader/platform exceptions: acl.kdump requires UKI boot (addon-based crashkernel, so GRUB is excepted), and acl.kdump.grub targets GRUB images only (excepted on UKI and on azure where /oem/grub.cfg does not persist). Also harden the crash kernel config in build_image_util.sh: - dracut_args now exclude "setup-root ignition" so the crash kernel avoids dm-verity /usr mounts that trigger emergency.target on aarch64. - Add KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices" to avoid SMP hang on aarch64 and ensure stable device access post-panic. Original-PR: 27990 Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
… cleaned up (#24) The Azure smoke test provisions a throwaway VM in its own resource group and is meant to delete it when the run ends. That delete was silently a no-op, so RGs leaked. The pipeline passes buildId / adoProject / arch as --tag values, which validate_common.sh parses into RESOURCE_TAGS. It then sources validate_azure.sh, whose top-level `RESOURCE_TAGS=(createdBy=...)` line overwrote that list, so the RG was tagged only createdBy / purpose / creationTime. The per-run cleanup deletes RGs matching buildId && adoProject && arch, matched nothing, and the RG survived. Make the default assignment conditional so it only seeds createdBy when no tags were parsed instead of overwriting. The buildId / adoProject / arch tags now stay on the RG, so the per-run cleanup deletes it immediately. Standalone use (no --tag) still gets the createdBy default. Original-PR: 28041 Co-authored-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Add GitHub templates following the pattern used in microsoft/azurelinux: - PR template with summary, changelog, type of change, test methodology, and merge checklist - Bug report issue template with environment details - Feature request issue template Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
) - Convert bug report and feature request to GitHub issue forms (.yml) with required, structured fields (arch/platform dropdowns, regression, severity) - Fix feature request label: feature-request (nonexistent) -> enhancement - Add config.yml with blank_issues_enabled: false to require picking a template - PR template unchanged Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#30) Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
#37) mantle PR microsoft/azure-container-linux-mantle#32 adds ExcludeDistros: [acl] to acl.kdump and acl.kdump.grub (AB#22249), so kola no longer selects them on ACL. kola_enforcing.yaml still listed acl.kdump as enforced with only a bootloader: [grub] exception, so on the QEMU/amd64 UKI leg with the 'default' kola filter evaluate_test_results.sh reported it as an enforced test NOT SELECTED and failed the stage. Comment out both entries (with the original exception rules preserved) so they can be restored once the mantle-side ExcludeDistros is dropped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The pr: trigger only matched aclmain, so PRs targeting release branches (e.g. release/3.0) got no validation build. Add a release/* wildcard to the branch include list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2e9b3a2-6af7-4aec-b523-faac80674783
* rpm: skip build-time-only mercurial, subversion and go-md2man These three are mapped to RPM names in the package catalog but are installed in no image and no sysext - mercurial and subversion are version control clients only ever used at build time, and go-md2man generates man pages during package builds. Confirmed against the packages.txt artefacts of a production build (amd64 and arm64, base image plus every sysext): none of the three appears in any of them. Map them to SKIP so the catalog reflects reality. No functional change to any shipped artefact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611 * rpm: drop ncompress and gflags from the image Both are installed in the production base image today, and neither is used. ncompress provides the legacy .Z compress/uncompress pair. It is a direct RDEPEND of Flatcar's coreos-base/coreos manifest, which is how it reaches the image, but nothing in ACL invokes it. The only reverse dependency in Azure Linux is perl-Archive-Extract-Z-uncompress in the extended repository, which we do not ship. gflags reaches the image only through coreos-base/update_engine, which is already SKIPped in this catalog because ACL does not ship update_engine. Its only Azure Linux reverse dependencies are rocksdb and glog, neither of which is installed. This removes two packages from the base image. Nothing else in the catalog or in acl/ references either name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
The package catalog maps app-admin/ignition and sys-apps/ignition to the RPM name "ignition", but Azure Linux 3 ships no package by that name - only ignition-flatcar. Nothing provides, obsoletes or requires the name "ignition" in any of the base, ms-oss, extended, cloud-native or ms-non-oss repositories. The build still works today only because dnf5 resolves the unmatched spec to the single available ignition-* package. That is incidental behaviour, not something the catalog should depend on: it hides the mistake, and it stops being correct on any release where a package literally named "ignition" exists. Name the RPM explicitly. Verified against a production build: build_image passes the literal string "ignition" to dnf5, and ignition-flatcar-2.22.0-5 is listed under the transaction's top-level "Installing:" section, so the substitution is performed by dnf5 rather than by a dependency or a Provides. No functional change - the same package is installed either way. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
Azure Linux ships xz-compressed RPM payloads, but rpm only advertises the rpmlib(PayloadIsXz) capability when built with the lzma USE flag, which is off by default upstream. Without it, installing those packages fails with a missing-dependency error. Set the flags in the SDK target profile rather than in Dockerfile.sdk-update so they apply both when a fresh SDK image is bootstrapped and when an existing one is updated. Also enable bzip2 for rpmlib(PayloadIsBzip2), and pin caps, which is needed to apply file capabilities from Azure Linux packages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d938d41-62cb-43ad-9422-864d07815eb2
* fix: use Azure Linux containerd config for RPM images
Use the containerd2 RPM configuration as the containerd configuration
source in RPM builds, so containerd no longer ignores the intended config.
- Preserve the Flatcar configuration asset for Portage builds.
- Relocate the Azure Linux config from /etc/containerd/config.toml to
/usr/share/containerd/config.toml (only /usr survives sysext capture).
- Enable SELinux in the relocated CRI configuration.
- Keep RPM-specific behavior in a dedicated mangle helper.
Original-PR: 28557
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e
* fix: keep the Azure Linux containerd unit in RPM mode
RPM-mode sysexts were copying the Flatcar containerd files over the ones
installed by the Azure Linux RPM, which replaced the RPM unit and dropped
its OOMScoreAdjust=-999. The previous commit then replaced the Flatcar
config too, so neither the unit-level nor the config-level (oom_score)
OOM protection survived.
Stop copying any Flatcar files in RPM mode and keep the unit and config
shipped by the RPM. The ACL-specific behaviour the Flatcar unit provided
is layered back on as a containerd.service.d/10-acl.conf drop-in:
- point ExecStart at the config relocated under /usr/share, since a
sysext cannot provide /etc/containerd/config.toml, and keep the
CONTAINERD_CONFIG indirection so tests can swap in the cgroupfs
variant via their own drop-in
- Type=notify and RestartSec=5
- the /run/docker/libcontainerd socket symlink docker.service expects
- the resource limits from the upstream unit
The RPM does not run its %post at sysext build time, so the
multi-user.target.wants enablement symlink is created explicitly, and
config-cgroupfs.toml is generated from the relocated config to match
PORTAGE mode.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3
) * acl/docs: add guide for preloading container images into ACL images Documents how to bake OCI container images into the containerd content store of an ACL image with the Azure Linux Image Customizer, so they are present on first boot without a registry pull. The primary flow runs the image's own containerd inside the postCustomization chroot to pull and pin the images directly, requiring no host-side containerd, no version matching, and no intermediate tarball. An offline variant that hydrates a data root out of band is documented for air-gapped builds. The guide lists the x64 and Arm64 ACL Marketplace SKUs and links to the Image Customizer documentation for exporting an image version as a VHD. The output is emitted as vhd-fixed so it can be uploaded into a managed disk and published as an Azure Compute Gallery image version, which the guide also covers. It also records the workarounds needed for ACL: a separate build directory to avoid an overlayfs ELOOP, a pinned Image Customizer tag, SSL_CERT_FILE pointing at the trust bundle in /usr, and numeric chown. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: address review feedback on containerd preload guide - Replace fixed sleeps with check-loops when starting and stopping containerd, and fail fast if it exits during startup. - Explain why the chown/chmod on the containerd data root are deliberately non-recursive. - Clarify that ACL's factory passwd lives under /usr/share/distro/etc and is not materialized at /etc until first boot. - Reframe the verification section around cost, and state the concessions the local boot check makes. - Publish to a gallery via a page blob and --os-vhd-uri rather than an intermediate managed disk. - Inline the offline variant's host-side hydration steps and use an inline content: script instead of referring to an unnamed file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct first-boot claim in containerd preload guide The local boot check does not exercise ACL's provisioning path. The UKI's baked-in command line carries neither ignition.firstboot nor flatcar.oem.id=azure -- both come from UKI addons on the ESP that booting with -kernel/-initrd bypasses -- so the boot takes the subsequent-boot path and no provisioning agent runs. Drop the unsupported claim that surviving images prove /var is not reset during provisioning, and note that forcing the two arguments does not help either: waagent starts but cannot mount the OVF DVD or reach the wireserver, so provisioning still never completes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct local boot check caveat with verified addon behaviour The previous note named the wrong kernel argument. ACL uses Flatcar's flatcar.first_boot=detected, not ignition.firstboot, so the earlier experiment never actually triggered Ignition. Verified against the ESP of a customized image: firstboot.addon.efi and oem.addon.efi are installed in EFI/Linux/<uki>.efi.extra.d/ and inject flatcar.first_boot=detected and flatcar.oem.id=azure respectively. They are intact after customization; -kernel/-initrd simply bypasses systemd-stub, which is what merges them. Driving the real first-boot path locally does not work: Ignition resolves the azure platform and blocks on IMDS, and ignition-fetch.service has no timeout, so the boot hangs in the initrd and never reaches multi-user.target. Document that bypassing the addons is what makes the local check usable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct the stale-image cause for rootfs detection failure The MCR :latest tag does point at a current release (1.5.0-2). The failure was a locally cached image -- docker run does not re-pull a tag that is already present. Recommend docker pull, or pinning, rather than blaming the registry. Also note that a fix for the ELOOP mount overlap is in flight upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: use the latest Image Customizer tag instead of pinning The latest tag on MCR points at a current release, so pinning is unnecessary. Add an explicit docker pull, since docker run reuses a cached tag, and note that 1.5.0 is the minimum for ACL support if a pin is wanted for reproducibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): read preload image list from a separate file Move the container image references out of preload.sh and into staging/images.txt, one reference per line with support for blank lines and # comments. The Image Customizer bind-mounts the config file's parent directory at /_imageconfigs inside the chroot while scripts run, so the list is read from there directly -- no additionalFiles entry or in-image cleanup is needed. Applied to both the online script and the offline appendix variant. Verified with an Image Customizer run against the ACL production image: both listed images land in the output image's containerd metadata store. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): clarify debug log shows cached images Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> * docs(acl): address review feedback on containerd preload guide - Note that the containerd store is keyed by image reference, so the sandbox (pause) image must match what the runtime requests; ACL ships no sandbox_image setting, so document how to check the effective value. - Use consistent staging/out/ host paths for the artifact throughout. - Create mount points with mkdir -p before mounting. - Run the offline hydration block under a single sudo shell so that $! is containerd's own PID; backgrounding sudo made the shutdown wait hang because sudo kill does not terminate the wrapper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): note containerd's default pause image reference Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> * docs(acl): correct sandbox image lookup for containerd 2.x containerd 2.x removed the sandbox_image key under io.containerd.grpc.v1.cri, so the documented grep returned nothing on ACL. The setting is now pinned_images.sandbox under io.containerd.cri.v1.images. ACL does not pin it, so the effective value is containerd's compiled-in default registry.k8s.io/pause:3.10.1 rather than an MCR reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5
…g, LUKS initramfs modules (#33) * ado: Readd es-metadata.yml * feat(acl-t): add parallel ACL Template build path * Comments addressed. * Testing verification 0722 * Exempt nfs * 0723 verifications. * Comments addressed. * Correct linux.ntp exemption reason: timesyncd loses via unit Conflicts, not %post The AzL 3.0 chrony.spec %post only runs daemon-reload/systemd_post/start; the actual suppression mechanism is Conflicts=systemd-timesyncd.service in the upstream chronyd.service that AzL packages verbatim. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Document imageVariants matching and selection semantics in the schema header Two non-obvious behaviors now spelled out where contributors copy from: imageVariants values match exactly (unlike the other list keys; 'acl' is a substring of 'acl-t'), and a rule constrained only by imageVariants drops the test from kola selection on that variant rather than just forgiving it at evaluation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Comments addressed. --------- Co-authored-by: Jiri Appl <jiria@microsoft.com> Co-authored-by: Lanze Liu <lanzeliu@microsoft.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Harden ARM64 Azure provisioning validation * Validate repro resource group names * Address Azure provisioning review feedback * Scope Azure VM cleanup to subscription * Skip diagnostics for SKU fallback * fix: validate full Azure gallery image IDs * refactor: narrow Azure provisioning hardening scope
Request TSV output from Azure CLI so serial-console newlines are emitted as real line breaks instead of JSON escape sequences. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(validate): retry transient Azure VM provisioning errors Classify provisioning timeouts, allocation failures, and quota exhaustion as retryable VM creation errors so the SKU/region fallback advances to the next candidate. Keep unrelated Azure failures fatal and add focused classifier coverage. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): isolate Azure VM fallback attempts Provision each retryable candidate in a fresh resource group so failed VM, NIC, disk, deployment, and public-IP resources cannot race the next attempt. Add orchestration coverage for cleanup, exhaustion, region transitions, and sourced-test isolation. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): capture failed Azure VM boot logs Before deleting a retryable failed VM resource group, best-effort enable managed boot diagnostics and print a bounded serial-log tail. Keep diagnostics non-fatal so missing VM resources or unavailable logs cannot block fallback. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): bound Azure provisioning timeouts Track OS provisioning timeouts separately from capacity errors, stop after two distinct Azure SKU families, and preserve accurate mixed-failure reporting. Make failed boot-log capture jq-free and robust to Azure CLI warnings, simplify region setup, and isolate stateful tests. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): refine Azure VM fallback retries * fix(validate): preserve create-time boot diagnostics * fix(validate): parse diagnostics storage hash * fix(validate): harden Azure fallback cleanup * refactor(validate): simplify Azure fallback flow Consolidate boot diagnostics on the create-time storage path, split fallback state handling into focused helpers, and document the regression test suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): scope exhausted fallback cleanup Target asynchronous resource-group deletion to AZ_SUB_ID and clean the final reused resource group when all VM candidates are exhausted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): preserve cleanup diagnostics Capture and log Azure CLI stderr when resource-group cleanup scheduling fails so authorization and subscription errors remain actionable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): address fallback review feedback Restore direct VM creation calls and explicit result state, preserve no-cleanup fallback behavior, skip timed-out SKU families immediately, harden boot diagnostics SAS handling, and avoid cleanup of uncreated resource groups. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): scope Azure VM resources Pass AZ_SUB_ID explicitly when creating the VM resource group, public IP, and boot diagnostics storage account so provisioning and cleanup use the same subscription. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…t SBOMs (#51) * fix(rpm): emit NEVRA and drop gpg-pubkey from the image package list * fix(rpm): route build_sysext package lists through rpm_query_packages * fix comment drift * address review comments - rpm_query_manifest: wrap RPM_MANIFEST_QUERY_FORMAT in the same %|ARCH?{...}:{}| guard used by rpm_query_packages, so gpg-pubkey no longer reaches the SPDX SBOM as a package with (none) for VENDOR, EPOCH, ARCH and SOURCERPM. Both producers now apply one rule for what counts as a package. - build_sysext cleanup(): also remove .rpm-base.tmp and .rpm-all.tmp. cleanup runs at L168 before either snapshot is taken, so a stale NVRA-format base left behind by a crashed run can no longer be diffed against a NEVRA-format .rpm-all.tmp and report every epoch-bearing package as sysext-added. - rpm_query_packages: replace the hedge in the comment with rpm's own test. Pubkey headers carry no ARCH tag, and rpm rejects a gpg-pubkey entry that does have one (lib/keystore.cc). Also drop the needless line continuation.
Add an opt-in container_logreader_t domain for log collectors that need read-only access to host and audit logs without using spc_t. Keep container_t as the default and deny log mutation permissions. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#53) * fix(sdk): return a single version tag when a commit has multiple tags `get_git_version()` used the raw output of `git tag --points-at HEAD`, which prints one line per tag. Two ACL releases were cut from the same `aclmain` commit (3.0.20260706-3.0-1153684 and 3.0.20260809-3.0-1179296), so the OS version became a two-line string. That multi-line value flowed into `create_versionfile` and into the container name derived by `run_sdk_container`, producing: Error response from daemon: Invalid container name (flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684 3.0.20260809-3.0-1179296), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed which failed "Build ACL Base Image" on every RPM image leg (amd64 and aarch64, Azure and QEMU). Pick the highest version tag deterministically with `sort -V | tail -n 1`, and clamp `git describe` to one line. Also clamp `vernum_from_version` and `build_id_from_version`, whose `sed -n ...p` emits one line per match, so no caller-supplied version can reintroduce a multi-line container name. Single-tag behaviour is unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(sdk): select the version tag without a pipeline Review feedback: `git describe --tags | head -n 1` made the fallback branch always exit 0, so a `git describe` failure (rc 128) would no longer abort callers such as `run_sdk_container`, which runs under `set -e` and does a plain `os_version=$(get_git_version)` assignment. Use `git for-each-ref --count=1 --sort=-v:refname` to pick the highest tag directly, and leave `git describe --tags` unpiped so its exit status still propagates. `git describe` only ever prints one line, so the `head -n 1` clamp was unnecessary. Verified `for-each-ref` returns the same tag as `sort -V | tail -n 1` for the real failing tag pair (3.0.20260706-3.0-1153684 and 3.0.20260809-3.0-1179296), that single-tag and untagged-HEAD behaviour is unchanged, and that a git failure now yields rc 128 again. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add read-only systemd journal mmap support, retain canonical container-selinux audit-log semantics, document safe mounts and MCS behavior, and clarify enforcing-by-default configuration. Tracks automated validation in AB#23492.
Add a customer-facing reference for ACL container workload domains, privilege boundaries, CRI and MCS requirements, journal DAC, audit behavior, and troubleshooting guidance. Includes the reviewed follow-ups previously tracked in #63.\n\nAB#23415
Move the default etcd image from Quay to MCR v2. Update the wrapper entrypoint to /usr/bin/etcd to match the MCR v2 image layout.
There was a problem hiding this comment.
Pull request overview
This PR updates the Azure Container Linux (ACL) scripts/overlays across multiple areas, including the stated etcd container image migration plus a broad set of SDK/CI, package overlay, and platform/build-system changes.
Changes:
- Switch etcd-member default image to MCR v2 and update the container entrypoint path.
- Update Gentoo/Flatcar overlays and kernel/config content (packages, patches, manifests).
- Add/adjust ACL-specific build plumbing, docs, CI vendor testing, and repo metadata/licensing.
Reviewed changes
Copilot reviewed 153 out of 434 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| SUPPORT.md | Add support/issue filing doc |
| sdk_container/src/third_party/portage-stable/virtual/zlib/zlib-1.3.1.ebuild | Add virtual/zlib ebuild |
| sdk_container/src/third_party/portage-stable/virtual/zlib/zlib-1.3.1-r1.ebuild | Add revbump virtual/zlib ebuild |
| sdk_container/src/third_party/portage-stable/virtual/zlib/metadata.xml | Add virtual/zlib metadata |
| sdk_container/src/third_party/portage-stable/virtual/openssh/openssh-0-r1.ebuild | Adjust KEYWORDS for openssh virtual |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r4.ebuild | Use virtual/zlib; adjust PATCHES |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r4.ebuild | Use virtual/zlib; patchset changes |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild | Use virtual/zlib |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.8_p1-musl-connect.patch | Remove obsolete musl patch |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.9_p2/0003-Rebuild-config-files-if-Makefile-changes.patch | Add upstream backport patch |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.9_p1/0003-gss-serv.c-needs-sys-param.h.patch | Remove obsolete backport patch |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.8_p1/0004-upstream-correct-keyword-from-Yatao-Su-via-GHPR509.patch | Add upstream doc backport patch |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.8_p1/0003-Cast-to-sockaddr-in-systemd-interface.patch | Add musl/systemd cast backport |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0005-Add-fcntl.h-to-includes.patch | Add include fix backport patch |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0004-Only-set-PAM_RHOST-if-the-remote-host-is-not-UNKNOWN.patch | Add PAM_RHOST slowdown fix |
| sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0003-Don-t-copy-native-host-keys-for-hostbased-test.patch | Add CI hostkey handling fix |
| sdk_container/src/third_party/portage-stable/dev-python/pyelftools/pyelftools-0.32.ebuild | Add pyelftools ebuild |
| sdk_container/src/third_party/portage-stable/dev-python/pyelftools/metadata.xml | Add pyelftools metadata |
| sdk_container/src/third_party/portage-stable/dev-python/pyelftools/Manifest | Add pyelftools distfile manifest |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.6.9999.ebuild | Update zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild | Update zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild | Update zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.4.ebuild | KEYWORDS/zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.3.ebuild | KEYWORDS/zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild | Update zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.6.ebuild | KEYWORDS/zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.5.ebuild | KEYWORDS/zlib dep; docs build native |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild | Update zlib dep |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.6.ebuild | Update zlib dep |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild | Update zlib dep |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.19.ebuild | KEYWORDS/zlib dep adjustments |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.18.ebuild | Update zlib dep |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.1.1w.ebuild | KEYWORDS/zlib dep adjustments |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.0.2u-r1.ebuild | KEYWORDS/zlib dep adjustments |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.4 | Add GNU/Hurd mapping |
| sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.2 | Add GNU/Hurd mapping |
| sdk_container/src/third_party/portage-stable/dev-libs/libfmt/metadata.xml | Add libfmt metadata |
| sdk_container/src/third_party/portage-stable/dev-libs/libfmt/libfmt-11.1.4.ebuild | Add libfmt ebuild |
| sdk_container/src/third_party/portage-stable/dev-lang/lua/metadata.xml | Add lua metadata |
| sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.1.5-r200.ebuild | Add lua ebuild and USE gating |
| sdk_container/src/third_party/portage-stable/dev-lang/lua/files/lua-5.1.4-test.patch | Fix lua test math API |
| sdk_container/src/third_party/portage-stable/dev-lang/lua/files/5.1/0002-Fix-stack-overflow-in-vararg-functions.patch | Add CVE patch |
| sdk_container/src/third_party/portage-stable/dev-lang/lua/files/5.1/0001-extern_C.patch | Add C++ ABI patch |
| sdk_container/src/third_party/portage-stable/dev-cpp/toml11/toml11-4.4.0.ebuild | Add toml11 ebuild |
| sdk_container/src/third_party/portage-stable/dev-cpp/toml11/metadata.xml | Add toml11 metadata |
| sdk_container/src/third_party/portage-stable/dev-cpp/toml11/Manifest | Add toml11 distfile manifest |
| sdk_container/src/third_party/portage-stable/app-eselect/eselect-lua/metadata.xml | Add eselect-lua metadata |
| sdk_container/src/third_party/portage-stable/app-eselect/eselect-lua/eselect-lua-4-r1.ebuild | Add eselect-lua ebuild |
| sdk_container/src/third_party/portage-stable/app-crypt/rpm-sequoia/metadata.xml | Add rpm-sequoia metadata |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/metadata.xml | Add rpm metadata |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/Manifest | Add rpm distfile manifest |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-no-hardened.patch | Drop -fhardened override |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-musl-compat.patch | musl glob compat patch |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-fix-build-without-sequoia.patch | Fix no-sequoia build regression |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.20.1-no-hardened.patch | Drop -fhardened override |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.20.0-libdir.patch | Adjust rpm config dir |
| sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.19.1.1-musl-compat.patch | musl glob compat patch |
| sdk_container/src/third_party/portage-stable/app-arch/dnf5/metadata.xml | Add dnf5 metadata |
| sdk_container/src/third_party/portage-stable/app-arch/dnf5/Manifest | Add dnf5 distfile manifest |
| sdk_container/src/third_party/portage-stable/app-arch/dnf5/files/dnf5-5.1.11-optional-modulemd.patch | Make modulemd optional |
| sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest | Bump stable patchset tarball |
| sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 | Enable CONFIG_MEMCG_V1 |
| sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild | Update bootengine EGIT_COMMIT |
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use | Enable systemd boot/ukify; rpm flags |
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use | Adjust intel-microcode USE |
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask | Mask OpenSSL >=3.5 |
| sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords | Accept openssh-10.2_p1 keywords |
| sdk_container/src/third_party/coreos-overlay/net-libs/librepo/metadata.xml | Add librepo metadata |
| sdk_container/src/third_party/coreos-overlay/net-libs/librepo/Manifest | Add librepo distfile manifest |
| sdk_container/src/third_party/coreos-overlay/net-libs/librepo/librepo-1.18.1.ebuild | Add librepo ebuild |
| sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/metadata.xml | Add libsolv metadata |
| sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/Manifest | Add libsolv distfile manifest |
| sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/libsolv-0.7.30.ebuild | Add libsolv ebuild |
| sdk_container/src/third_party/coreos-overlay/dev-libs/libcomps/metadata.xml | Add libcomps metadata |
| sdk_container/src/third_party/coreos-overlay/dev-libs/libcomps/Manifest | Add libcomps distfile manifest |
| sdk_container/src/third_party/coreos-overlay/coreos/sysext/docker/usr/lib/systemd/system/docker.service | Update containerd socket path |
| sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd | Add udevd syscall filter drop-in |
| sdk_container/src/third_party/coreos-overlay/coreos-base/update_engine/update_engine-9999.ebuild | Update update_engine EGIT_COMMIT |
| sdk_container/src/third_party/coreos-overlay/coreos-base/oem-nutanix/oem-nutanix-0.0.1.ebuild | Add Nutanix OEM package |
| sdk_container/src/third_party/coreos-overlay/coreos-base/oem-nutanix/metadata.xml | Add Nutanix OEM metadata |
| sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/var-chrony.conf | Adjust chrony tmpfiles + keys |
| sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/sysext-enable.conf | Add tmpfiles symlink enabling |
| sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs.sh | Install sysext-enable + RPM hook |
| sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild | Switch to backport branch/commit |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/vmware/uki.cfg | Add VMware UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/stackit/uki.cfg | Add STACKIT UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/scaleway/uki.cfg | Add Scaleway UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/scaleway/grub.cfg.frag | Add Scaleway GRUB console frag |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/qemu/uki.cfg | Add QEMU UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/proxmoxve/uki.cfg | Add Proxmox VE UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/packet/uki.cfg | Add Packet/Equinix Metal UKI args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/openstack/uki.cfg | Add OpenStack UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/gce/uki.cfg | Add GCE UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/azure/uki.cfg | Add Azure UKI args; omit autologin |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/ami/uki.cfg | Add AWS/AMI UKI addon args |
| sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/common-oem-files-0-r11.ebuild | Add nutanix; add uki USE gate |
| sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest | Bump NSS tarball in manifest |
| sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild | Switch NSS source + paths |
| sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild | Remove 9999 hv-daemons ebuild |
| sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.74.ebuild | Add versioned hv-daemons ebuild |
| sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files/etcd-wrapper | Change etcd container entrypoint |
| sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files/etcd-member.service | Switch ETCD_IMAGE_URL to MCR |
| sdk_container/.repo/manifests/version.txt | Update Flatcar version metadata |
| sdk_container/.repo/manifests/mantle-container | Change mantle image reference |
| run_sdk_container | Pass additional env into SDK |
| NOTICE | Update product attribution text |
| MAINTAINERS.md | Remove maintainer list file |
| LICENSE-BSD-3-CLAUSE | Add BSD-3-Clause license text |
| LICENSE | Replace with MIT license text |
| code-of-conduct.md | Remove old CNCF CoC file |
| CODE_OF_CONDUCT.md | Add Microsoft OSS CoC pointer |
| ci-automation/vendor-testing/stackit.sh | Add STACKIT vendor test runner |
| ci-automation/vendor-testing/qemu.sh | Add optional kola --debug flag |
| ci-automation/vendor-testing/qemu_update.sh | Add optional kola --debug flag |
| ci-automation/tapfile_helper_lib.sh | Change markdown verdict formatting |
| ci-automation/garbage_collect.sh | Add STACKIT env passthrough |
| ci-automation/garbage_collect_cloud.sh | Add ore stackit gc; remove equinixmetal |
| changelog/updates/2026-02-20-linux-6.12.74-update.md | Add kernel changelog entry |
| changelog/updates/2026-02-17-linux-6.12.73-update.md | Add kernel changelog entry |
| changelog/updates/2026-02-16-ca-certificates-3.120.1-update.md | Add CA certs changelog entry |
| changelog/updates/2026-02-12-openssh.md | Add OpenSSH update entry |
| changelog/updates/2026-01-28-openssl.md | Add OpenSSL update entry |
| changelog/updates/2026-01-18-linux-6.12.66-update.md | Add kernel changelog entry |
| changelog/updates/2026-01-12-linux-6.12.65-update.md | Add kernel changelog entry |
| changelog/updates/2026-01-12-ca-certificates-3.120-update.md | Add CA certs changelog entry |
| changelog/updates/2026-01-09-linux-6.12.64-update.md | Add kernel changelog entry |
| changelog/updates/2025-12-13-linux-6.12.62-update.md | Add kernel changelog entry |
| changelog/updates/2025-12-08-ca-certificates-3.119-update.md | Add CA certs changelog entry |
| changelog/updates/2025-12-07-linux-6.12.61-update.md | Add kernel changelog entry |
| changelog/updates/2025-12-02-linux-6.12.60-update.md | Add kernel changelog entry |
| changelog/updates/2025-11-25-linux-6.12.59-update.md | Add kernel changelog entry |
| changelog/updates/2025-11-24-ca-certificates-3.118.1-update.md | Add CA certs changelog entry |
| changelog/updates/2025-11-14-linux-6.12.58-update.md | Add kernel changelog entry |
| changelog/updates/2025-11-07-runc-containerd.md | Add runc/containerd update entry |
| changelog/updates/2025-10-20-linux-6.12.54-update.md | Add kernel changelog entry |
| changelog/updates/2025-10-07-linux-6.12.51-update.md | Add kernel changelog entry |
| changelog/updates/2025-10-06-ca-certificates-3.117-update.md | Add CA certs changelog entry |
| changelog/updates/2025-09-22-ca-certificates-3.116-update.md | Add CA certs changelog entry |
| changelog/updates/2025-09-20-linux-6.12.48-update.md | Add kernel changelog entry |
| changelog/security/2026-02-12-openssh.md | Add OpenSSH CVE entry |
| changelog/security/2025-11-07-runc-containerd.md | Add runc/containerd CVE entry |
| changelog/changes/2025-11-05-nutanix.md | Add Nutanix change entry |
| changelog/changes/2025-10-20-scaleway.md | Add Scaleway change entry |
| changelog/changes/2025-09-16-scaleway.md | Add Scaleway change entry |
| changelog/bugfixes/2025-11-05-fix-modprobe-via-udevd.md | Add udev modprobe bugfix entry |
| changelog/bugfixes/2025-10-27-tun-interface-exclusion.md | Add networking bugfix entry |
| changelog/bugfixes/2025-10-20-microcode-updates.md | Add microcode bugfix entry |
| changelog/bugfixes/2025-10-10-flatcar-extensions.md | Add extensions bugfix entry |
| changelog/bugfixes/2025-10-08-macos-hvf-accel.md | Add macOS HVF bugfix entry |
| changelog/bugfixes/2025-09-19-kernel-config-memcg-v1.md | Add memcg v1 bugfix entry |
| build_standalone_sysexts | Add standalone sysext build script |
| build_library/sysext_mangle_docker-flatcar | Add RPM-mode pruning/hooks |
| build_library/sysext_mangle_containerd-flatcar | Add RPM-mode handling path |
| build_library/sbsign_util.sh | RPM-mode libdir + skip signing |
| build_library/rpm/sysext/sysext_mangle_nvidia-driver-cuda-open | Add RPM sysext mangle wrapper |
| build_library/rpm/sysext/sysext_mangle_nvidia-driver-cuda | Add RPM sysext mangle wrapper |
| build_library/rpm/sysext/sysext_mangle_nvidia-container-toolkit | Relocate config via tmpfiles |
| build_library/rpm/build_sysext | Add RPM sysext build sourcing |
| build_library/rpm/additional_files/run-dracut.sh | Add dracut wrapper for RPM |
| build_library/rpm/additional_files/dracut-acl-selinux-toggle/module-setup.sh | Add dracut module setup |
| build_library/rpm/additional_files/dracut-acl-selinux-toggle/acl-selinux-toggle.service | Add initrd SELinux toggle unit |
| build_library/rpm/additional_files/audit-rules.service | Add placeholder audit service |
| build_library/rpm/additional_files/99-fips.conf | Add dracut FIPS config |
| build_library/release_util.sh | Generalize artifact name checks |
| build_library/qemu_template.sh | Improve arm64 accel selection |
| build_library/portage/bashrc | Ensure os-release exists in chroot |
| build_library/disk_layout.json | Switch root partition type token |
| build_library/check_root | Ignore specific symlinks at check |
| acl/tests/run-secureboot-test.sh | Add Secure Boot validation test |
| acl/tests/run-container-test.sh | Add container runtime smoke test |
| acl/SPECS/stress-ng/stress-ng.signatures.json | Add stress-ng signature file |
| acl/SPECS/selinux-policy/selinux-policy.signatures.json | Add selinux-policy signatures |
| acl/SPECS/selinux-policy/modules_targeted.conf | Add SELinux module list |
| acl/SPECS/selinux-policy/Makefile.devel | Add SELinux Makefile.devel |
| acl/SPECS/selinux-policy/container_contexts | Add container SELinux contexts |
| acl/SPECS/selinux-policy/booleans_targeted.conf | Add SELinux booleans config |
| acl/SPECS/selinux-policy/0061-container-Allow-log-reader-to-map-journals.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0060-container-Add-log-reader-domain.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0059-container-Drop-unqualified-etc-dir-filetrans-to-conta.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0054-docker-Add-hugepage-and-system-cronjob-support-for-i.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0052-docker-Read-PMD-mappable-transparent-hugepage-size.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0049-lvm-Minor-fix-for-systemd-veritysetup.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0048-getty-Minor-fx.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0047-udev-Minor-fixes-for-udevadm.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0044-loging-Silence-network-denials-if-logging_syslog_can.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0043-systemd-Add-log-env-to-systemd-machine-id-setup.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0042-systemd-allow-reading-dev-cpu-0-msr.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0040-systemd-allow-systemd-hostnamed-and-systemd-rfkill-t.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0039-Fix-mislabeling-of-etc-shadow.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0029-systemd-Fix-dac_override-use-in-systemd-machine-id-s.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0028-kmod-fix-for-run-modprobe.d.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0026-Temporary-workaround-for-memory.pressure-labeling-is.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0024-systemd-tmpfiles-create-root-and-root-.ssh.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0023-systemd-tmpfiles-loadkeys-Read-var_t-symlinks.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0022-irqbalance-Dontaudit-net_admin.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0021-systemd-Minor-fixes.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0019-sysnet-The-ip-command-reads-various-files-in-usr-sha.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0018-unconfined-Add-user-namespace-creation.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0014-Add-additional-Fedora-policy-compatibility.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0013-modutils-Temporary-fix-for-mkinitrd-dracut.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0012-systemd-Fix-run-systemd-shutdown-handling.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0009-domain-Unconfined-can-transition-to-other-domains.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0006-container-docker-Fixes-for-containerd-and-kubernetes.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0005-Temp-kubernetes-fix.patch | Add SELinux policy patch |
| acl/SPECS/selinux-policy/0003-Set-default-login-to-unconfined_u.patch | Add SELinux policy patch |
| acl/SPECS/sdnotify-proxy/sdnotify-proxy.signatures.json | Add sdnotify-proxy signatures |
| acl/SPECS/microcode_ctl/microcode_ctl.signatures.json | Add microcode_ctl signatures |
| acl/SPECS/microcode_ctl/enable-wildcards-in-tar.patch | Add microcode_ctl patch |
| acl/SPECS/lksctp-tools/sctp_test-check-strdup-return-in-append_addr.patch | Add lksctp-tools patch |
| acl/SPECS/lksctp-tools/lksctp-tools.signatures.json | Add lksctp-tools signatures |
| acl/SPECS/libbsd/libbsd.signatures.json | Add libbsd signatures |
| acl/SPECS/libbsd/libbsd-cdefs.h | Add libbsd header overlay |
| acl/SPECS/libbsd/libbsd-0.12.2.tar.xz.asc | Add libbsd upstream signature |
| acl/SPECS/Judy/README.Fedora | Add Judy license note |
| acl/SPECS/Judy/Judy.signatures.json | Add Judy signatures |
| acl/SPECS/Judy/Judy-1.0.4-test-shared.patch | Add Judy test patch |
| acl/SPECS/coreos-init/coreos-init.signatures.json | Add coreos-init signatures |
| acl/SPECS/bootengine/bootengine.signatures.json | Add bootengine signatures |
| acl/SPECS/bootengine/0001-modify-tests.patch | Add bootengine test patch |
| acl/sdk-cache/hash-paths.conf | Define SDK cache hash scope |
| acl/sdk-cache/cache-version | Add SDK cache salt/version file |
| acl/README.md | Add ACL top-level README |
| acl/packages.yaml | Add ACL RPM package list |
| acl/docs/testing.md | Add ACL testing documentation |
| acl/docs/sysexts.md | Add sysext documentation |
| acl/docs/README.md | Add ACL docs index |
| acl/docs/platforms.md | Add supported platforms doc |
| .pipelines/github-pr-validation.yml | Add ADO PR validation entrypoint |
| .gitignore | Ignore test/build artifacts |
| .github/workflows/portage-stable-packages-list | Add virtual/zlib to list |
| .github/workflows/kernel-apply-patch.sh | Update kernel apply automation |
| .github/pull_request_template.md | Add PR template |
| .github/ISSUE_TEMPLATE/feature_request.yml | Add feature request template |
| .github/ISSUE_TEMPLATE/config.yml | Disable blank issues |
| .github/CODEOWNERS | Update codeowners team |
| .config/CredScanSuppressions.json | Add CredScan suppression config |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -1 +1 @@ | |||
| ghcr.io/flatcar/mantle:git-03c3e3d8e8d132a6753c2e9cb205d32ff31564df | |||
| mantle:latest | |||
Comment on lines
+9
to
+12
| iptables -I INPUT -p tcp --dport 80 -j ACCEPT | ||
| ctr image pull mcr.microsoft.com/azurelinux/base/nginx:1 > /dev/null | ||
| ctr run --detach --net-host mcr.microsoft.com/azurelinux/base/nginx:1 nginx | ||
| sleep 2 |
| - **Scenario-specific**: | ||
| - `docker` | ||
|
|
||
| Sysexts are defined in `sysexts.yaml` with a required `mode` field. **Embedded** sysexts (e.g. `containerd`) are placed directly in the image and activated at boot. **Standalone** sysexts are built separately and downloaded on demand. Package names can be RPM names (e.g. `cuda-open`) or portage-style names (e.g. `app-containers/docker`) — the build system tries direct RPM installation first and falls back to the catalog. The `archs` field controls which architectures to build for; omitting it builds for all. An optional mangle script (`build_library/sysext_mangle_<name>` or `build_library/rpm/sysexts/sysext_mangle_<name>`) can relocate files that RPMs install outside `/usr`. |
| @@ -14,7 +14,7 @@ RestartSec=10s | |||
| TimeoutStartSec=0 | |||
| LimitNOFILE=40000 | |||
|
|
|||
| Environment="ETCD_IMAGE_URL=quay.io/coreos/etcd" | |||
| Environment="ETCD_IMAGE_URL=mcr.microsoft.com/oss/v2/etcd-io/etcd" | |||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Move ACL's default etcd image from
quay.io/coreos/etcdtomcr.microsoft.com/oss/v2/etcd-io/etcd, retainingv3.5.16and existing service behavior. MCR v2 providesv3.5.16andv3.5.22for AMD64 and ARM64. Update the entrypoint to/usr/bin/etcd.Change Log
ETCD_IMAGE_URLinetcd-member.service./usr/local/bin/etcdto/usr/bin/etcd.Type of Change
Does this affect the image build?
Associated Issues
Related PRs
Test Methodology
git diff --checkpass.Merge Checklist