Skip to content

Gsettles/etcd mcr v2 - #4250

Closed
gsettles01 wants to merge 301 commits into
flatcar:mainfrom
microsoft:gsettles/etcd-mcr-v2
Closed

Gsettles/etcd mcr v2#4250
gsettles01 wants to merge 301 commits into
flatcar:mainfrom
microsoft:gsettles/etcd-mcr-v2

Conversation

@gsettles01

Copy link
Copy Markdown

Summary

Move ACL's default etcd image from quay.io/coreos/etcd to mcr.microsoft.com/oss/v2/etcd-io/etcd, retaining v3.5.16 and existing service behavior. MCR v2 provides v3.5.16 and v3.5.22 for AMD64 and ARM64. Update the entrypoint to /usr/bin/etcd.

Change Log

  • Update ETCD_IMAGE_URL in etcd-member.service.
  • Change the wrapper entrypoint from /usr/local/bin/etcd to /usr/bin/etcd.

Type of Change

  • Image build change
  • Configuration change

Does this affect the image build?

  • Yes

Associated Issues

Related PRs

Test Methodology

  • Wrapper syntax and git diff --check pass.
  • AMD64 build, boot, service contract, persistence, v2 API, image overrides, and mTLS passed.
  • Quay control and MCR v2 each passed five targeted Kola tests. Quay-blocked direct and three-test runs passed without fallback.
  • Targeted ARM64 passed without Secure Boot. PR CI and full ARM64 Secure Boot remain pending.

Merge Checklist

  • Relevant local Kola tests pass
  • PR image build and CI pass
  • Ready to merge

Flatcar Buildbot and others added 30 commits October 21, 2025 11:09
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Adding this to fix console issues on Scaleway's instances

Signed-off-by: Tristan Bringuier <tristan.bringuier@enix.fr>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: Tristan Bringuier <tristan.bringuier@enix.fr>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
 rclone was previously called from the Mantle image but it's not the
 case anymore because we need some environment variables (CHANNEL, ARCH,
 etc.)

 Let's switch to the `rclone` Docker image.

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
This pulls in flatcar/init#136 to prevent the
default network setup to conflict with TUN/TAP device configuration
from other tools.

Signed-off-by: Kai Lueke <kailuke@microsoft.com>
Exclude TUN devices from default systemd-networkd setup
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Flatcar Buildbot <buildbot@flatcar-linux.org>
Upgrade mantle container image to latest HEAD in flatcar-4459
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Maxime de Roucy <maxime.deroucy@claranet.com>
Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
Signed-off-by: flatcar-ci <infra+ci@flatcar-linux.org>
Signed-off-by: Christian Baumann <thechristschn@gmail.com>
Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
It's from Gentoo commit b4c450b220406a895ed093b19b92241746408a66.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
It's from Gentoo commit 107cc22593c97542852ee68c564554c2fbfcdf20.

Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
This has been raised in current CI.

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
ci-automation/release.sh: &#39;the input device is not a TTY&#39;
jiria and others added 26 commits July 1, 2026 17:33
In RPM build mode, copy the image's rpmdb.sqlite out as an IC sidecar
artifact (acl_production_image_rpmdb.sqlite) alongside the VHD so package
state is preserved for downstream image-customization steps.

Also tighten RPM database existence checks to test for the rpmdb.sqlite
file directly instead of the var/lib/rpm directory in build_sysext and
rpm_install.sh.

Original-PR: 27776

Co-authored-by: Lanze Liu <lanzeliu@microsoft.com>
Adds a docs page covering how to enable kdump on ACL, and fixes an
inaccurate addon path in the build script comments.

- Add `acl/docs/kdump.md` — enable/disable steps, verification, dump
  collection, and how kdump is wired into the image.
- Link the new page from `acl/docs/README.md`.
- Fix stale comments in `build_library/rpm/uki_install.sh` that pointed
  at the non-existent `EFI/Linux/acl.efi.extra.d/`. The ACL UKI is
  `vmlinuz-<kernel_version>.efi`, so the addon must go in the
  version-specific `EFI/Linux/vmlinuz-<kver>.efi.extra.d/`.

Original-PR: 27971

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-reset (#21)

The support-UKI-mode-by-restoring-firstboot-addon patch hardcoded the UKI
addon dir as /boot/EFI/Linux/acl.efi.extra.d. ACL UKIs now use UAPI naming
(vmlinuz-<version>.efi), so that path never exists - is_uki_mode() always
returned false and flatcar-reset silently skipped re-arming the firstboot
(Ignition) addon on UKI images.

Derive the dir from $(uname -r) so it matches the actual UKI name. All three
uses (is_uki_mode, --stop cleanup, restore) reference the variable, so the
single change fixes the whole flow. Bump coreos-init.spec Release 3 -> 4.

Original-PR: 27985

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Select the QEMU VM boot timeout by architecture instead of a single fixed
180s, fixing flaky arm64 QEMU smoke-test boot failures.

Emulated arm64 (TCG) VMs boot far slower than native amd64. Across recent
builds the "Qemu VM Boot" smoke test runs ~19-28s on amd64 but clusters near
180-250s on arm64, producing marginal-timeout boot failures at the 180s ceiling.

- validate/validate_common.sh: add per-arch defaults VM_BOOT_TIMEOUT_AMD64=100
  and VM_BOOT_TIMEOUT_ARM64=300; VM_BOOT_TIMEOUT now defaults to empty and a new
  resolve_boot_timeout() (called at the top of validate_main) picks the value
  from BOARD. An explicit VM_BOOT_TIMEOUT env var or --boot-timeout flag still
  overrides.
- build_rpm_image.sh: default left empty; only forwards --boot-timeout to the
  validate script when explicitly set, keeping validate_common.sh the single
  source of truth.
- Update help/usage docs in the three affected scripts.

Original-PR: 27944

Co-authored-by: Jiri Appl <Jiri.Appl@microsoft.com>
…23)

Enable acl.kdump and acl.kdump.grub as enforcing kola tests, with
bootloader/platform exceptions: acl.kdump requires UKI boot (addon-based
crashkernel, so GRUB is excepted), and acl.kdump.grub targets GRUB images
only (excepted on UKI and on azure where /oem/grub.cfg does not persist).

Also harden the crash kernel config in build_image_util.sh:
- dracut_args now exclude "setup-root ignition" so the crash kernel avoids
  dm-verity /usr mounts that trigger emergency.target on aarch64.
- Add KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices" to avoid
  SMP hang on aarch64 and ensure stable device access post-panic.

Original-PR: 27990

Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
… cleaned up (#24)

The Azure smoke test provisions a throwaway VM in its own resource group
and is meant to delete it when the run ends. That delete was silently a
no-op, so RGs leaked.

The pipeline passes buildId / adoProject / arch as --tag values, which
validate_common.sh parses into RESOURCE_TAGS. It then sources
validate_azure.sh, whose top-level `RESOURCE_TAGS=(createdBy=...)` line
overwrote that list, so the RG was tagged only createdBy / purpose /
creationTime. The per-run cleanup deletes RGs matching
buildId && adoProject && arch, matched nothing, and the RG survived.

Make the default assignment conditional so it only seeds createdBy when
no tags were parsed instead of overwriting. The buildId / adoProject /
arch tags now stay on the RG, so the per-run cleanup deletes it
immediately. Standalone use (no --tag) still gets the createdBy default.

Original-PR: 28041

Co-authored-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Add GitHub templates following the pattern used in microsoft/azurelinux:
- PR template with summary, changelog, type of change, test methodology, and merge checklist
- Bug report issue template with environment details
- Feature request issue template

Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
)

- Convert bug report and feature request to GitHub issue forms (.yml) with
  required, structured fields (arch/platform dropdowns, regression, severity)
- Fix feature request label: feature-request (nonexistent) -> enhancement
- Add config.yml with blank_issues_enabled: false to require picking a template
- PR template unchanged

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#30)

Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
#37)

mantle PR microsoft/azure-container-linux-mantle#32 adds ExcludeDistros: [acl]
to acl.kdump and acl.kdump.grub (AB#22249), so kola no longer selects them on
ACL. kola_enforcing.yaml still listed acl.kdump as enforced with only a
bootloader: [grub] exception, so on the QEMU/amd64 UKI leg with the 'default'
kola filter evaluate_test_results.sh reported it as an enforced test NOT
SELECTED and failed the stage.

Comment out both entries (with the original exception rules preserved) so they
can be restored once the mantle-side ExcludeDistros is dropped.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The pr: trigger only matched aclmain, so PRs targeting release branches
(e.g. release/3.0) got no validation build. Add a release/* wildcard to
the branch include list.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b2e9b3a2-6af7-4aec-b523-faac80674783
* rpm: skip build-time-only mercurial, subversion and go-md2man

These three are mapped to RPM names in the package catalog but are
installed in no image and no sysext - mercurial and subversion are
version control clients only ever used at build time, and go-md2man
generates man pages during package builds.

Confirmed against the packages.txt artefacts of a production build
(amd64 and arm64, base image plus every sysext): none of the three
appears in any of them.

Map them to SKIP so the catalog reflects reality.

No functional change to any shipped artefact.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611

* rpm: drop ncompress and gflags from the image

Both are installed in the production base image today, and neither is
used.

ncompress provides the legacy .Z compress/uncompress pair. It is a
direct RDEPEND of Flatcar's coreos-base/coreos manifest, which is how it
reaches the image, but nothing in ACL invokes it. The only reverse
dependency in Azure Linux is perl-Archive-Extract-Z-uncompress in the
extended repository, which we do not ship.

gflags reaches the image only through coreos-base/update_engine, which
is already SKIPped in this catalog because ACL does not ship
update_engine. Its only Azure Linux reverse dependencies are rocksdb and
glog, neither of which is installed.

This removes two packages from the base image. Nothing else in the
catalog or in acl/ references either name.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
The package catalog maps app-admin/ignition and sys-apps/ignition to the
RPM name "ignition", but Azure Linux 3 ships no package by that name -
only ignition-flatcar. Nothing provides, obsoletes or requires the name
"ignition" in any of the base, ms-oss, extended, cloud-native or
ms-non-oss repositories.

The build still works today only because dnf5 resolves the unmatched
spec to the single available ignition-* package. That is incidental
behaviour, not something the catalog should depend on: it hides the
mistake, and it stops being correct on any release where a package
literally named "ignition" exists.

Name the RPM explicitly.

Verified against a production build: build_image passes the literal
string "ignition" to dnf5, and ignition-flatcar-2.22.0-5 is listed under
the transaction's top-level "Installing:" section, so the substitution is
performed by dnf5 rather than by a dependency or a Provides.

No functional change - the same package is installed either way.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
Azure Linux ships xz-compressed RPM payloads, but rpm only advertises the
rpmlib(PayloadIsXz) capability when built with the lzma USE flag, which is
off by default upstream. Without it, installing those packages fails with a
missing-dependency error.

Set the flags in the SDK target profile rather than in Dockerfile.sdk-update
so they apply both when a fresh SDK image is bootstrapped and when an
existing one is updated. Also enable bzip2 for rpmlib(PayloadIsBzip2), and
pin caps, which is needed to apply file capabilities from Azure Linux
packages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8d938d41-62cb-43ad-9422-864d07815eb2
* fix: use Azure Linux containerd config for RPM images

Use the containerd2 RPM configuration as the containerd configuration
source in RPM builds, so containerd no longer ignores the intended config.

- Preserve the Flatcar configuration asset for Portage builds.
- Relocate the Azure Linux config from /etc/containerd/config.toml to
  /usr/share/containerd/config.toml (only /usr survives sysext capture).
- Enable SELinux in the relocated CRI configuration.
- Keep RPM-specific behavior in a dedicated mangle helper.

Original-PR: 28557

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e

* fix: keep the Azure Linux containerd unit in RPM mode

RPM-mode sysexts were copying the Flatcar containerd files over the ones
installed by the Azure Linux RPM, which replaced the RPM unit and dropped
its OOMScoreAdjust=-999. The previous commit then replaced the Flatcar
config too, so neither the unit-level nor the config-level (oom_score)
OOM protection survived.

Stop copying any Flatcar files in RPM mode and keep the unit and config
shipped by the RPM. The ACL-specific behaviour the Flatcar unit provided
is layered back on as a containerd.service.d/10-acl.conf drop-in:

  - point ExecStart at the config relocated under /usr/share, since a
    sysext cannot provide /etc/containerd/config.toml, and keep the
    CONTAINERD_CONFIG indirection so tests can swap in the cgroupfs
    variant via their own drop-in
  - Type=notify and RestartSec=5
  - the /run/docker/libcontainerd socket symlink docker.service expects
  - the resource limits from the upstream unit

The RPM does not run its %post at sysext build time, so the
multi-user.target.wants enablement symlink is created explicitly, and
config-cgroupfs.toml is generated from the relocated config to match
PORTAGE mode.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3
)

* acl/docs: add guide for preloading container images into ACL images

Documents how to bake OCI container images into the containerd content
store of an ACL image with the Azure Linux Image Customizer, so they are
present on first boot without a registry pull.

The primary flow runs the image's own containerd inside the
postCustomization chroot to pull and pin the images directly, requiring no
host-side containerd, no version matching, and no intermediate tarball. An
offline variant that hydrates a data root out of band is documented for
air-gapped builds.

The guide lists the x64 and Arm64 ACL Marketplace SKUs and links to the
Image Customizer documentation for exporting an image version as a VHD.

The output is emitted as vhd-fixed so it can be uploaded into a managed
disk and published as an Azure Compute Gallery image version, which the
guide also covers.

It also records the workarounds needed for ACL: a separate build directory
to avoid an overlayfs ELOOP, a pinned Image Customizer tag, SSL_CERT_FILE
pointing at the trust bundle in /usr, and numeric chown.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* acl/docs: address review feedback on containerd preload guide

- Replace fixed sleeps with check-loops when starting and stopping
  containerd, and fail fast if it exits during startup.
- Explain why the chown/chmod on the containerd data root are
  deliberately non-recursive.
- Clarify that ACL's factory passwd lives under /usr/share/distro/etc
  and is not materialized at /etc until first boot.
- Reframe the verification section around cost, and state the
  concessions the local boot check makes.
- Publish to a gallery via a page blob and --os-vhd-uri rather than an
  intermediate managed disk.
- Inline the offline variant's host-side hydration steps and use an
  inline content: script instead of referring to an unnamed file.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* acl/docs: correct first-boot claim in containerd preload guide

The local boot check does not exercise ACL's provisioning path. The UKI's
baked-in command line carries neither ignition.firstboot nor
flatcar.oem.id=azure -- both come from UKI addons on the ESP that booting with
-kernel/-initrd bypasses -- so the boot takes the subsequent-boot path and no
provisioning agent runs.

Drop the unsupported claim that surviving images prove /var is not reset during
provisioning, and note that forcing the two arguments does not help either:
waagent starts but cannot mount the OVF DVD or reach the wireserver, so
provisioning still never completes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* acl/docs: correct local boot check caveat with verified addon behaviour

The previous note named the wrong kernel argument. ACL uses Flatcar's
flatcar.first_boot=detected, not ignition.firstboot, so the earlier experiment
never actually triggered Ignition.

Verified against the ESP of a customized image: firstboot.addon.efi and
oem.addon.efi are installed in EFI/Linux/<uki>.efi.extra.d/ and inject
flatcar.first_boot=detected and flatcar.oem.id=azure respectively. They are
intact after customization; -kernel/-initrd simply bypasses systemd-stub, which
is what merges them.

Driving the real first-boot path locally does not work: Ignition resolves the
azure platform and blocks on IMDS, and ignition-fetch.service has no timeout, so
the boot hangs in the initrd and never reaches multi-user.target. Document that
bypassing the addons is what makes the local check usable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* acl/docs: correct the stale-image cause for rootfs detection failure

The MCR :latest tag does point at a current release (1.5.0-2). The failure was
a locally cached image -- docker run does not re-pull a tag that is already
present. Recommend docker pull, or pinning, rather than blaming the registry.

Also note that a fix for the ELOOP mount overlap is in flight upstream.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* acl/docs: use the latest Image Customizer tag instead of pinning

The latest tag on MCR points at a current release, so pinning is unnecessary.
Add an explicit docker pull, since docker run reuses a cached tag, and note
that 1.5.0 is the minimum for ACL support if a pin is wanted for
reproducibility.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* docs(acl): read preload image list from a separate file

Move the container image references out of preload.sh and into
staging/images.txt, one reference per line with support for blank
lines and # comments.

The Image Customizer bind-mounts the config file's parent directory
at /_imageconfigs inside the chroot while scripts run, so the list is
read from there directly -- no additionalFiles entry or in-image
cleanup is needed.

Applied to both the online script and the offline appendix variant.

Verified with an Image Customizer run against the ACL production
image: both listed images land in the output image's containerd
metadata store.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* docs(acl): clarify debug log shows cached images

Co-authored-by: jiria <18746096+jiria@users.noreply.github.com>

* docs(acl): address review feedback on containerd preload guide

- Note that the containerd store is keyed by image reference, so the
  sandbox (pause) image must match what the runtime requests; ACL ships
  no sandbox_image setting, so document how to check the effective value.
- Use consistent staging/out/ host paths for the artifact throughout.
- Create mount points with mkdir -p before mounting.
- Run the offline hydration block under a single sudo shell so that $! is
  containerd's own PID; backgrounding sudo made the shutdown wait hang
  because sudo kill does not terminate the wrapper.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

* docs(acl): note containerd's default pause image reference

Co-authored-by: jiria <18746096+jiria@users.noreply.github.com>

* docs(acl): correct sandbox image lookup for containerd 2.x

containerd 2.x removed the sandbox_image key under io.containerd.grpc.v1.cri,
so the documented grep returned nothing on ACL. The setting is now
pinned_images.sandbox under io.containerd.cri.v1.images. ACL does not pin it,
so the effective value is containerd's compiled-in default
registry.k8s.io/pause:3.10.1 rather than an MCR reference.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: jiria <18746096+jiria@users.noreply.github.com>
Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5
…g, LUKS initramfs modules (#33)

* ado: Readd es-metadata.yml

* feat(acl-t): add parallel ACL Template build path

* Comments addressed.

* Testing verification 0722

* Exempt nfs

* 0723 verifications.

* Comments addressed.

* Correct linux.ntp exemption reason: timesyncd loses via unit Conflicts, not %post

The AzL 3.0 chrony.spec %post only runs daemon-reload/systemd_post/start;
the actual suppression mechanism is Conflicts=systemd-timesyncd.service in
the upstream chronyd.service that AzL packages verbatim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Document imageVariants matching and selection semantics in the schema header

Two non-obvious behaviors now spelled out where contributors copy from:
imageVariants values match exactly (unlike the other list keys; 'acl' is
a substring of 'acl-t'), and a rule constrained only by imageVariants
drops the test from kola selection on that variant rather than just
forgiving it at evaluation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Comments addressed.

---------

Co-authored-by: Jiri Appl <jiria@microsoft.com>
Co-authored-by: Lanze Liu <lanzeliu@microsoft.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Harden ARM64 Azure provisioning validation

* Validate repro resource group names

* Address Azure provisioning review feedback

* Scope Azure VM cleanup to subscription

* Skip diagnostics for SKU fallback

* fix: validate full Azure gallery image IDs

* refactor: narrow Azure provisioning hardening scope
Request TSV output from Azure CLI so serial-console newlines are emitted as real line breaks instead of JSON escape sequences.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(validate): retry transient Azure VM provisioning errors

Classify provisioning timeouts, allocation failures, and quota exhaustion as retryable VM creation errors so the SKU/region fallback advances to the next candidate. Keep unrelated Azure failures fatal and add focused classifier coverage.

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>

* fix(validate): isolate Azure VM fallback attempts

Provision each retryable candidate in a fresh resource group so failed VM, NIC, disk, deployment, and public-IP resources cannot race the next attempt. Add orchestration coverage for cleanup, exhaustion, region transitions, and sourced-test isolation.

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>

* fix(validate): capture failed Azure VM boot logs

Before deleting a retryable failed VM resource group, best-effort enable managed boot diagnostics and print a bounded serial-log tail. Keep diagnostics non-fatal so missing VM resources or unavailable logs cannot block fallback.

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>

* fix(validate): bound Azure provisioning timeouts

Track OS provisioning timeouts separately from capacity errors, stop after two distinct Azure SKU families, and preserve accurate mixed-failure reporting. Make failed boot-log capture jq-free and robust to Azure CLI warnings, simplify region setup, and isolate stateful tests.

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>

* fix(validate): refine Azure VM fallback retries

* fix(validate): preserve create-time boot diagnostics

* fix(validate): parse diagnostics storage hash

* fix(validate): harden Azure fallback cleanup

* refactor(validate): simplify Azure fallback flow

Consolidate boot diagnostics on the create-time storage path, split fallback state handling into focused helpers, and document the regression test suite.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(validate): scope exhausted fallback cleanup

Target asynchronous resource-group deletion to AZ_SUB_ID and clean the final reused resource group when all VM candidates are exhausted.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(validate): preserve cleanup diagnostics

Capture and log Azure CLI stderr when resource-group cleanup scheduling fails so authorization and subscription errors remain actionable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(validate): address fallback review feedback

Restore direct VM creation calls and explicit result state, preserve no-cleanup fallback behavior, skip timed-out SKU families immediately, harden boot diagnostics SAS handling, and avoid cleanup of uncreated resource groups.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(validate): scope Azure VM resources

Pass AZ_SUB_ID explicitly when creating the VM resource group, public IP, and boot diagnostics storage account so provisioning and cleanup use the same subscription.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…t SBOMs (#51)

* fix(rpm): emit NEVRA and drop gpg-pubkey from the image package list

* fix(rpm): route build_sysext package lists through rpm_query_packages

* fix comment drift

* address review comments

- rpm_query_manifest: wrap RPM_MANIFEST_QUERY_FORMAT in the same
  %|ARCH?{...}:{}| guard used by rpm_query_packages, so gpg-pubkey no longer
  reaches the SPDX SBOM as a package with (none) for VENDOR, EPOCH, ARCH and
  SOURCERPM. Both producers now apply one rule for what counts as a package.

- build_sysext cleanup(): also remove .rpm-base.tmp and .rpm-all.tmp. cleanup
  runs at L168 before either snapshot is taken, so a stale NVRA-format base
  left behind by a crashed run can no longer be diffed against a NEVRA-format
  .rpm-all.tmp and report every epoch-bearing package as sysext-added.

- rpm_query_packages: replace the hedge in the comment with rpm's own test.
  Pubkey headers carry no ARCH tag, and rpm rejects a gpg-pubkey entry that
  does have one (lib/keystore.cc). Also drop the needless line continuation.
Add an opt-in container_logreader_t domain for log collectors that need read-only access to host and audit logs without using spc_t. Keep container_t as the default and deny log mutation permissions.

Signed-off-by: Sean Dougherty <sdougherty@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#53)

* fix(sdk): return a single version tag when a commit has multiple tags

`get_git_version()` used the raw output of `git tag --points-at HEAD`,
which prints one line per tag. Two ACL releases were cut from the same
`aclmain` commit (3.0.20260706-3.0-1153684 and 3.0.20260809-3.0-1179296),
so the OS version became a two-line string.

That multi-line value flowed into `create_versionfile` and into the
container name derived by `run_sdk_container`, producing:

  Error response from daemon: Invalid container name
  (flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684
  3.0.20260809-3.0-1179296), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed

which failed "Build ACL Base Image" on every RPM image leg (amd64 and
aarch64, Azure and QEMU).

Pick the highest version tag deterministically with `sort -V | tail -n 1`,
and clamp `git describe` to one line. Also clamp `vernum_from_version` and
`build_id_from_version`, whose `sed -n ...p` emits one line per match, so
no caller-supplied version can reintroduce a multi-line container name.

Single-tag behaviour is unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(sdk): select the version tag without a pipeline

Review feedback: `git describe --tags | head -n 1` made the fallback branch
always exit 0, so a `git describe` failure (rc 128) would no longer abort
callers such as `run_sdk_container`, which runs under `set -e` and does a
plain `os_version=$(get_git_version)` assignment.

Use `git for-each-ref --count=1 --sort=-v:refname` to pick the highest tag
directly, and leave `git describe --tags` unpiped so its exit status still
propagates. `git describe` only ever prints one line, so the `head -n 1`
clamp was unnecessary.

Verified `for-each-ref` returns the same tag as `sort -V | tail -n 1` for
the real failing tag pair (3.0.20260706-3.0-1153684 and
3.0.20260809-3.0-1179296), that single-tag and untagged-HEAD behaviour is
unchanged, and that a git failure now yields rc 128 again.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add read-only systemd journal mmap support, retain canonical container-selinux audit-log semantics, document safe mounts and MCS behavior, and clarify enforcing-by-default configuration. Tracks automated validation in AB#23492.
Add a customer-facing reference for ACL container workload domains, privilege boundaries, CRI and MCS requirements, journal DAC, audit behavior, and troubleshooting guidance. Includes the reviewed follow-ups previously tracked in #63.\n\nAB#23415
Move the default etcd image from Quay to MCR v2. Update the wrapper entrypoint to /usr/bin/etcd to match the MCR v2 image layout.
Copilot AI lite review requested due to automatic review settings August 31, 2026 17:42
@gsettles01 gsettles01 closed this Aug 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Azure Container Linux (ACL) scripts/overlays across multiple areas, including the stated etcd container image migration plus a broad set of SDK/CI, package overlay, and platform/build-system changes.

Changes:

  • Switch etcd-member default image to MCR v2 and update the container entrypoint path.
  • Update Gentoo/Flatcar overlays and kernel/config content (packages, patches, manifests).
  • Add/adjust ACL-specific build plumbing, docs, CI vendor testing, and repo metadata/licensing.

Reviewed changes

Copilot reviewed 153 out of 434 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
SUPPORT.md Add support/issue filing doc
sdk_container/src/third_party/portage-stable/virtual/zlib/zlib-1.3.1.ebuild Add virtual/zlib ebuild
sdk_container/src/third_party/portage-stable/virtual/zlib/zlib-1.3.1-r1.ebuild Add revbump virtual/zlib ebuild
sdk_container/src/third_party/portage-stable/virtual/zlib/metadata.xml Add virtual/zlib metadata
sdk_container/src/third_party/portage-stable/virtual/openssh/openssh-0-r1.ebuild Adjust KEYWORDS for openssh virtual
sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.9_p2-r4.ebuild Use virtual/zlib; adjust PATCHES
sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-9.8_p1-r4.ebuild Use virtual/zlib; patchset changes
sdk_container/src/third_party/portage-stable/net-misc/openssh/openssh-10.0_p1.ebuild Use virtual/zlib
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/openssh-9.8_p1-musl-connect.patch Remove obsolete musl patch
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.9_p2/0003-Rebuild-config-files-if-Makefile-changes.patch Add upstream backport patch
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.9_p1/0003-gss-serv.c-needs-sys-param.h.patch Remove obsolete backport patch
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.8_p1/0004-upstream-correct-keyword-from-Yatao-Su-via-GHPR509.patch Add upstream doc backport patch
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/9.8_p1/0003-Cast-to-sockaddr-in-systemd-interface.patch Add musl/systemd cast backport
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0005-Add-fcntl.h-to-includes.patch Add include fix backport patch
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0004-Only-set-PAM_RHOST-if-the-remote-host-is-not-UNKNOWN.patch Add PAM_RHOST slowdown fix
sdk_container/src/third_party/portage-stable/net-misc/openssh/files/10.1_p1/0003-Don-t-copy-native-host-keys-for-hostbased-test.patch Add CI hostkey handling fix
sdk_container/src/third_party/portage-stable/dev-python/pyelftools/pyelftools-0.32.ebuild Add pyelftools ebuild
sdk_container/src/third_party/portage-stable/dev-python/pyelftools/metadata.xml Add pyelftools metadata
sdk_container/src/third_party/portage-stable/dev-python/pyelftools/Manifest Add pyelftools distfile manifest
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.6.9999.ebuild Update zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.5.9999.ebuild Update zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.9999.ebuild Update zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.4.ebuild KEYWORDS/zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.4.3.ebuild KEYWORDS/zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.9999.ebuild Update zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.6.ebuild KEYWORDS/zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.3.5.ebuild KEYWORDS/zlib dep; docs build native
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.9999.ebuild Update zlib dep
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.2.6.ebuild Update zlib dep
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.9999.ebuild Update zlib dep
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.19.ebuild KEYWORDS/zlib dep adjustments
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-3.0.18.ebuild Update zlib dep
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.1.1w.ebuild KEYWORDS/zlib dep adjustments
sdk_container/src/third_party/portage-stable/dev-libs/openssl/openssl-1.0.2u-r1.ebuild KEYWORDS/zlib dep adjustments
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.4 Add GNU/Hurd mapping
sdk_container/src/third_party/portage-stable/dev-libs/openssl/files/gentoo.config-1.0.2 Add GNU/Hurd mapping
sdk_container/src/third_party/portage-stable/dev-libs/libfmt/metadata.xml Add libfmt metadata
sdk_container/src/third_party/portage-stable/dev-libs/libfmt/libfmt-11.1.4.ebuild Add libfmt ebuild
sdk_container/src/third_party/portage-stable/dev-lang/lua/metadata.xml Add lua metadata
sdk_container/src/third_party/portage-stable/dev-lang/lua/lua-5.1.5-r200.ebuild Add lua ebuild and USE gating
sdk_container/src/third_party/portage-stable/dev-lang/lua/files/lua-5.1.4-test.patch Fix lua test math API
sdk_container/src/third_party/portage-stable/dev-lang/lua/files/5.1/0002-Fix-stack-overflow-in-vararg-functions.patch Add CVE patch
sdk_container/src/third_party/portage-stable/dev-lang/lua/files/5.1/0001-extern_C.patch Add C++ ABI patch
sdk_container/src/third_party/portage-stable/dev-cpp/toml11/toml11-4.4.0.ebuild Add toml11 ebuild
sdk_container/src/third_party/portage-stable/dev-cpp/toml11/metadata.xml Add toml11 metadata
sdk_container/src/third_party/portage-stable/dev-cpp/toml11/Manifest Add toml11 distfile manifest
sdk_container/src/third_party/portage-stable/app-eselect/eselect-lua/metadata.xml Add eselect-lua metadata
sdk_container/src/third_party/portage-stable/app-eselect/eselect-lua/eselect-lua-4-r1.ebuild Add eselect-lua ebuild
sdk_container/src/third_party/portage-stable/app-crypt/rpm-sequoia/metadata.xml Add rpm-sequoia metadata
sdk_container/src/third_party/portage-stable/app-arch/rpm/metadata.xml Add rpm metadata
sdk_container/src/third_party/portage-stable/app-arch/rpm/Manifest Add rpm distfile manifest
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-no-hardened.patch Drop -fhardened override
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-musl-compat.patch musl glob compat patch
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-6.0.0-fix-build-without-sequoia.patch Fix no-sequoia build regression
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.20.1-no-hardened.patch Drop -fhardened override
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.20.0-libdir.patch Adjust rpm config dir
sdk_container/src/third_party/portage-stable/app-arch/rpm/files/rpm-4.19.1.1-musl-compat.patch musl glob compat patch
sdk_container/src/third_party/portage-stable/app-arch/dnf5/metadata.xml Add dnf5 metadata
sdk_container/src/third_party/portage-stable/app-arch/dnf5/Manifest Add dnf5 distfile manifest
sdk_container/src/third_party/portage-stable/app-arch/dnf5/files/dnf5-5.1.11-optional-modulemd.patch Make modulemd optional
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-sources/Manifest Bump stable patchset tarball
sdk_container/src/third_party/coreos-overlay/sys-kernel/coreos-modules/files/commonconfig-6.12 Enable CONFIG_MEMCG_V1
sdk_container/src/third_party/coreos-overlay/sys-kernel/bootengine/bootengine-9999.ebuild Update bootengine EGIT_COMMIT
sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use Enable systemd boot/ukify; rpm flags
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use Adjust intel-microcode USE
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask Mask OpenSSL >=3.5
sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords Accept openssh-10.2_p1 keywords
sdk_container/src/third_party/coreos-overlay/net-libs/librepo/metadata.xml Add librepo metadata
sdk_container/src/third_party/coreos-overlay/net-libs/librepo/Manifest Add librepo distfile manifest
sdk_container/src/third_party/coreos-overlay/net-libs/librepo/librepo-1.18.1.ebuild Add librepo ebuild
sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/metadata.xml Add libsolv metadata
sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/Manifest Add libsolv distfile manifest
sdk_container/src/third_party/coreos-overlay/dev-libs/libsolv/libsolv-0.7.30.ebuild Add libsolv ebuild
sdk_container/src/third_party/coreos-overlay/dev-libs/libcomps/metadata.xml Add libcomps metadata
sdk_container/src/third_party/coreos-overlay/dev-libs/libcomps/Manifest Add libcomps distfile manifest
sdk_container/src/third_party/coreos-overlay/coreos/sysext/docker/usr/lib/systemd/system/docker.service Update containerd socket path
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-apps/systemd Add udevd syscall filter drop-in
sdk_container/src/third_party/coreos-overlay/coreos-base/update_engine/update_engine-9999.ebuild Update update_engine EGIT_COMMIT
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-nutanix/oem-nutanix-0.0.1.ebuild Add Nutanix OEM package
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-nutanix/metadata.xml Add Nutanix OEM metadata
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/var-chrony.conf Adjust chrony tmpfiles + keys
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/sysext-enable.conf Add tmpfiles symlink enabling
sdk_container/src/third_party/coreos-overlay/coreos-base/oem-azure/files/manglefs.sh Install sysext-enable + RPM hook
sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-init/coreos-init-9999.ebuild Switch to backport branch/commit
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/vmware/uki.cfg Add VMware UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/stackit/uki.cfg Add STACKIT UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/scaleway/uki.cfg Add Scaleway UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/scaleway/grub.cfg.frag Add Scaleway GRUB console frag
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/qemu/uki.cfg Add QEMU UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/proxmoxve/uki.cfg Add Proxmox VE UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/packet/uki.cfg Add Packet/Equinix Metal UKI args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/openstack/uki.cfg Add OpenStack UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/gce/uki.cfg Add GCE UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/azure/uki.cfg Add Azure UKI args; omit autologin
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/files/ami/uki.cfg Add AWS/AMI UKI addon args
sdk_container/src/third_party/coreos-overlay/coreos-base/common-oem-files/common-oem-files-0-r11.ebuild Add nutanix; add uki USE gate
sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/Manifest Bump NSS tarball in manifest
sdk_container/src/third_party/coreos-overlay/app-misc/ca-certificates/ca-certificates-3.120.1-r1.ebuild Switch NSS source + paths
sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-9999.ebuild Remove 9999 hv-daemons ebuild
sdk_container/src/third_party/coreos-overlay/app-emulation/hv-daemons/hv-daemons-6.12.74.ebuild Add versioned hv-daemons ebuild
sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files/etcd-wrapper Change etcd container entrypoint
sdk_container/src/third_party/coreos-overlay/app-admin/etcd-wrapper/files/etcd-member.service Switch ETCD_IMAGE_URL to MCR
sdk_container/.repo/manifests/version.txt Update Flatcar version metadata
sdk_container/.repo/manifests/mantle-container Change mantle image reference
run_sdk_container Pass additional env into SDK
NOTICE Update product attribution text
MAINTAINERS.md Remove maintainer list file
LICENSE-BSD-3-CLAUSE Add BSD-3-Clause license text
LICENSE Replace with MIT license text
code-of-conduct.md Remove old CNCF CoC file
CODE_OF_CONDUCT.md Add Microsoft OSS CoC pointer
ci-automation/vendor-testing/stackit.sh Add STACKIT vendor test runner
ci-automation/vendor-testing/qemu.sh Add optional kola --debug flag
ci-automation/vendor-testing/qemu_update.sh Add optional kola --debug flag
ci-automation/tapfile_helper_lib.sh Change markdown verdict formatting
ci-automation/garbage_collect.sh Add STACKIT env passthrough
ci-automation/garbage_collect_cloud.sh Add ore stackit gc; remove equinixmetal
changelog/updates/2026-02-20-linux-6.12.74-update.md Add kernel changelog entry
changelog/updates/2026-02-17-linux-6.12.73-update.md Add kernel changelog entry
changelog/updates/2026-02-16-ca-certificates-3.120.1-update.md Add CA certs changelog entry
changelog/updates/2026-02-12-openssh.md Add OpenSSH update entry
changelog/updates/2026-01-28-openssl.md Add OpenSSL update entry
changelog/updates/2026-01-18-linux-6.12.66-update.md Add kernel changelog entry
changelog/updates/2026-01-12-linux-6.12.65-update.md Add kernel changelog entry
changelog/updates/2026-01-12-ca-certificates-3.120-update.md Add CA certs changelog entry
changelog/updates/2026-01-09-linux-6.12.64-update.md Add kernel changelog entry
changelog/updates/2025-12-13-linux-6.12.62-update.md Add kernel changelog entry
changelog/updates/2025-12-08-ca-certificates-3.119-update.md Add CA certs changelog entry
changelog/updates/2025-12-07-linux-6.12.61-update.md Add kernel changelog entry
changelog/updates/2025-12-02-linux-6.12.60-update.md Add kernel changelog entry
changelog/updates/2025-11-25-linux-6.12.59-update.md Add kernel changelog entry
changelog/updates/2025-11-24-ca-certificates-3.118.1-update.md Add CA certs changelog entry
changelog/updates/2025-11-14-linux-6.12.58-update.md Add kernel changelog entry
changelog/updates/2025-11-07-runc-containerd.md Add runc/containerd update entry
changelog/updates/2025-10-20-linux-6.12.54-update.md Add kernel changelog entry
changelog/updates/2025-10-07-linux-6.12.51-update.md Add kernel changelog entry
changelog/updates/2025-10-06-ca-certificates-3.117-update.md Add CA certs changelog entry
changelog/updates/2025-09-22-ca-certificates-3.116-update.md Add CA certs changelog entry
changelog/updates/2025-09-20-linux-6.12.48-update.md Add kernel changelog entry
changelog/security/2026-02-12-openssh.md Add OpenSSH CVE entry
changelog/security/2025-11-07-runc-containerd.md Add runc/containerd CVE entry
changelog/changes/2025-11-05-nutanix.md Add Nutanix change entry
changelog/changes/2025-10-20-scaleway.md Add Scaleway change entry
changelog/changes/2025-09-16-scaleway.md Add Scaleway change entry
changelog/bugfixes/2025-11-05-fix-modprobe-via-udevd.md Add udev modprobe bugfix entry
changelog/bugfixes/2025-10-27-tun-interface-exclusion.md Add networking bugfix entry
changelog/bugfixes/2025-10-20-microcode-updates.md Add microcode bugfix entry
changelog/bugfixes/2025-10-10-flatcar-extensions.md Add extensions bugfix entry
changelog/bugfixes/2025-10-08-macos-hvf-accel.md Add macOS HVF bugfix entry
changelog/bugfixes/2025-09-19-kernel-config-memcg-v1.md Add memcg v1 bugfix entry
build_standalone_sysexts Add standalone sysext build script
build_library/sysext_mangle_docker-flatcar Add RPM-mode pruning/hooks
build_library/sysext_mangle_containerd-flatcar Add RPM-mode handling path
build_library/sbsign_util.sh RPM-mode libdir + skip signing
build_library/rpm/sysext/sysext_mangle_nvidia-driver-cuda-open Add RPM sysext mangle wrapper
build_library/rpm/sysext/sysext_mangle_nvidia-driver-cuda Add RPM sysext mangle wrapper
build_library/rpm/sysext/sysext_mangle_nvidia-container-toolkit Relocate config via tmpfiles
build_library/rpm/build_sysext Add RPM sysext build sourcing
build_library/rpm/additional_files/run-dracut.sh Add dracut wrapper for RPM
build_library/rpm/additional_files/dracut-acl-selinux-toggle/module-setup.sh Add dracut module setup
build_library/rpm/additional_files/dracut-acl-selinux-toggle/acl-selinux-toggle.service Add initrd SELinux toggle unit
build_library/rpm/additional_files/audit-rules.service Add placeholder audit service
build_library/rpm/additional_files/99-fips.conf Add dracut FIPS config
build_library/release_util.sh Generalize artifact name checks
build_library/qemu_template.sh Improve arm64 accel selection
build_library/portage/bashrc Ensure os-release exists in chroot
build_library/disk_layout.json Switch root partition type token
build_library/check_root Ignore specific symlinks at check
acl/tests/run-secureboot-test.sh Add Secure Boot validation test
acl/tests/run-container-test.sh Add container runtime smoke test
acl/SPECS/stress-ng/stress-ng.signatures.json Add stress-ng signature file
acl/SPECS/selinux-policy/selinux-policy.signatures.json Add selinux-policy signatures
acl/SPECS/selinux-policy/modules_targeted.conf Add SELinux module list
acl/SPECS/selinux-policy/Makefile.devel Add SELinux Makefile.devel
acl/SPECS/selinux-policy/container_contexts Add container SELinux contexts
acl/SPECS/selinux-policy/booleans_targeted.conf Add SELinux booleans config
acl/SPECS/selinux-policy/0061-container-Allow-log-reader-to-map-journals.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0060-container-Add-log-reader-domain.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0059-container-Drop-unqualified-etc-dir-filetrans-to-conta.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0054-docker-Add-hugepage-and-system-cronjob-support-for-i.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0052-docker-Read-PMD-mappable-transparent-hugepage-size.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0049-lvm-Minor-fix-for-systemd-veritysetup.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0048-getty-Minor-fx.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0047-udev-Minor-fixes-for-udevadm.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0044-loging-Silence-network-denials-if-logging_syslog_can.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0043-systemd-Add-log-env-to-systemd-machine-id-setup.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0042-systemd-allow-reading-dev-cpu-0-msr.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0040-systemd-allow-systemd-hostnamed-and-systemd-rfkill-t.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0039-Fix-mislabeling-of-etc-shadow.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0029-systemd-Fix-dac_override-use-in-systemd-machine-id-s.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0028-kmod-fix-for-run-modprobe.d.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0026-Temporary-workaround-for-memory.pressure-labeling-is.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0024-systemd-tmpfiles-create-root-and-root-.ssh.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0023-systemd-tmpfiles-loadkeys-Read-var_t-symlinks.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0022-irqbalance-Dontaudit-net_admin.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0021-systemd-Minor-fixes.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0019-sysnet-The-ip-command-reads-various-files-in-usr-sha.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0018-unconfined-Add-user-namespace-creation.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0014-Add-additional-Fedora-policy-compatibility.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0013-modutils-Temporary-fix-for-mkinitrd-dracut.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0012-systemd-Fix-run-systemd-shutdown-handling.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0009-domain-Unconfined-can-transition-to-other-domains.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0006-container-docker-Fixes-for-containerd-and-kubernetes.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0005-Temp-kubernetes-fix.patch Add SELinux policy patch
acl/SPECS/selinux-policy/0003-Set-default-login-to-unconfined_u.patch Add SELinux policy patch
acl/SPECS/sdnotify-proxy/sdnotify-proxy.signatures.json Add sdnotify-proxy signatures
acl/SPECS/microcode_ctl/microcode_ctl.signatures.json Add microcode_ctl signatures
acl/SPECS/microcode_ctl/enable-wildcards-in-tar.patch Add microcode_ctl patch
acl/SPECS/lksctp-tools/sctp_test-check-strdup-return-in-append_addr.patch Add lksctp-tools patch
acl/SPECS/lksctp-tools/lksctp-tools.signatures.json Add lksctp-tools signatures
acl/SPECS/libbsd/libbsd.signatures.json Add libbsd signatures
acl/SPECS/libbsd/libbsd-cdefs.h Add libbsd header overlay
acl/SPECS/libbsd/libbsd-0.12.2.tar.xz.asc Add libbsd upstream signature
acl/SPECS/Judy/README.Fedora Add Judy license note
acl/SPECS/Judy/Judy.signatures.json Add Judy signatures
acl/SPECS/Judy/Judy-1.0.4-test-shared.patch Add Judy test patch
acl/SPECS/coreos-init/coreos-init.signatures.json Add coreos-init signatures
acl/SPECS/bootengine/bootengine.signatures.json Add bootengine signatures
acl/SPECS/bootengine/0001-modify-tests.patch Add bootengine test patch
acl/sdk-cache/hash-paths.conf Define SDK cache hash scope
acl/sdk-cache/cache-version Add SDK cache salt/version file
acl/README.md Add ACL top-level README
acl/packages.yaml Add ACL RPM package list
acl/docs/testing.md Add ACL testing documentation
acl/docs/sysexts.md Add sysext documentation
acl/docs/README.md Add ACL docs index
acl/docs/platforms.md Add supported platforms doc
.pipelines/github-pr-validation.yml Add ADO PR validation entrypoint
.gitignore Ignore test/build artifacts
.github/workflows/portage-stable-packages-list Add virtual/zlib to list
.github/workflows/kernel-apply-patch.sh Update kernel apply automation
.github/pull_request_template.md Add PR template
.github/ISSUE_TEMPLATE/feature_request.yml Add feature request template
.github/ISSUE_TEMPLATE/config.yml Disable blank issues
.github/CODEOWNERS Update codeowners team
.config/CredScanSuppressions.json Add CredScan suppression config

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@@ -1 +1 @@
ghcr.io/flatcar/mantle:git-03c3e3d8e8d132a6753c2e9cb205d32ff31564df
mantle:latest
Comment on lines +9 to +12
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
ctr image pull mcr.microsoft.com/azurelinux/base/nginx:1 > /dev/null
ctr run --detach --net-host mcr.microsoft.com/azurelinux/base/nginx:1 nginx
sleep 2
Comment thread acl/docs/sysexts.md
- **Scenario-specific**:
- `docker`

Sysexts are defined in `sysexts.yaml` with a required `mode` field. **Embedded** sysexts (e.g. `containerd`) are placed directly in the image and activated at boot. **Standalone** sysexts are built separately and downloaded on demand. Package names can be RPM names (e.g. `cuda-open`) or portage-style names (e.g. `app-containers/docker`) — the build system tries direct RPM installation first and falls back to the catalog. The `archs` field controls which architectures to build for; omitting it builds for all. An optional mangle script (`build_library/sysext_mangle_<name>` or `build_library/rpm/sysexts/sysext_mangle_<name>`) can relocate files that RPMs install outside `/usr`.
@@ -14,7 +14,7 @@ RestartSec=10s
TimeoutStartSec=0
LimitNOFILE=40000

Environment="ETCD_IMAGE_URL=quay.io/coreos/etcd"
Environment="ETCD_IMAGE_URL=mcr.microsoft.com/oss/v2/etcd-io/etcd"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.