Build custom snapshots with Docker on Linux - #89
Merged
Conversation
Installed automatically by the as-a-bot app.
Adds scripts/build-snapshot-from-dockerfile.sh: builds the Dockerfile for linux/riscv64 with Apple's container CLI (BuildKit runs RUN steps under riscv64 emulation), exports the flattened rootfs with the tar exporter, and swaps it in for the Alpine minirootfs of build-default-snapshot.sh — same overlay, same vpod-native boot, same --snapshot-save capture. Details worth knowing: - BuildKit's tar exporter rewrites absolute symlink targets to include the per-platform directory (/bin/sh -> /linux_riscv64/bin/busybox); the script points them back at the root, otherwise every busybox applet dangles and the guest panics on init. - Python warm-start (shim + pydaemon + pyrunner) is applied only when the built image contains python3; other images produce shell-only snapshots instead of failing the build. - Setup markers are matched anchored at line start, and a kernel panic during the finalize boot aborts the build instead of shipping a panicked machine state. - Prints a ready-to-paste registry/catalog.json entry (sha256 + size). Verified end to end with FROM alpine:3.23 + apk add python3 nodejs git + COPY: the resumed snapshot answers cat/python3(-shim)/node/git probes over --snapshot-load --setup. Signed-off-by: Lars Trieloff <lars@trieloff.net>
…ction prefix handling
Three pieces that fell out of taking a node image through the full pipeline: - aot-snapshot.sh gains --workload custom with repeatable --trace-cmd steps: images whose hot code is not python/apk (or that do not even contain them) trace their own workload instead of failing the stock gates. build-snapshot-from-dockerfile.sh chains it via --aot. - run_setup.rs: VPOD_SETUP_PATIENCE env multiplies the per-step instruction budget (default 1, unchanged). Heavy runtimes exceed the default window under aot-trace instrumentation; the custom AOT pass sets 25 instead of every caller paying for a bigger default. - guest/entropy/vpod_seed_entropy.c: deterministic emulation produces no jitter entropy, so the guest crng never initializes and blocking getrandom() hangs forever — node/V8 blocks at startup (python never does, which is why the stock images never hit it; observed as ~20 CPU-hours inside one node -e). The finalize boot now seeds AND credits the crng (RNDADDENTROPY) from host randomness baked into the overlay, deleted before capture, hard-gated by a marker. Inherent snapshot caveat documented in the helper: all resumes share captured RNG state; fresh per-resume entropy would need emulator support. Measured on the demo image (node+git+python trace): 1432 translated pages; 506M of 4.4B guest insns (11.4%) retire through AOT blocks at 450 insns/dispatch on a mixed workload, 0 without. Signed-off-by: Lars Trieloff <lars@trieloff.net>
Member
|
Thanks for this PR and the Linux compatibility! I tested the new FROM alpine:3.23.0
RUN apk add --no-cache --no-scripts ca-certificates python3 uv bashBuild cost (from a local macos)
Performances at runtime
I'll take care of the CI (but seems to be github related) and merge it |
Contributor
Author
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
linux/riscv64root filesystem on LinuxcontainerCLI as the macOS builderbuild-custom-snapshot.shStack
Depends on #79. That branch was rebased onto the latest
origin/mainfirst; the Linux support is the single top commit857f55a. Until #79 merges, GitHub's comparison also shows its prerequisite changes.Verification
sh -n scripts/build-custom-snapshot.shsh -n scripts/aot-snapshot.shscripts/build-custom-snapshot.sh --helpBuilder: dockerand reports missing Docker/tooling cleanlygit diff --checkA full snapshot build was not run in the Amp orb because Docker is not installed there.