Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new integration test job to the CI workflow to improve test coverage by running integration tests in the build pipeline.
Key changes:
- Added a new
integrationjob to the GitHub Actions workflow - Configured the job to build the project and run integration tests using Go
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
48a516c to
0e0ef9f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
0e0ef9f to
ea4838d
Compare
ea4838d to
84890ed
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
84890ed to
a7e64a6
Compare
a7e64a6 to
31f586d
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 7 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
31f586d to
8a9ee83
Compare
8a9ee83 to
1af3e23
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 11 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
1af3e23 to
f6a5b11
Compare
f6a5b11 to
8a835c3
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
8a835c3 to
991c714
Compare
991c714 to
a041e1f
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 10 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
a041e1f to
9e58257
Compare
|
Downgrade to 6.12.44 (from #74) |
9e58257 to
8a0a1fc
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Makefile
Outdated
| OS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]') | ||
| ARCH ?= $(shell uname -m) | ||
| export PLATFORM ?= $(OS)/$(ARCH) |
There was a problem hiding this comment.
The variable name OS may conflict with environment variables or built-in variables in some shells. Consider renaming it to HOST_OS for clarity and consistency with the HOST_OS variable used in the docker-bake.hcl file.
| OS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]') | |
| ARCH ?= $(shell uname -m) | |
| export PLATFORM ?= $(OS)/$(ARCH) | |
| HOST_OS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]') | |
| ARCH ?= $(shell uname -m) | |
| export PLATFORM ?= $(HOST_OS)/$(ARCH) |
8a0a1fc to
43cb047
Compare
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
43cb047 to
45a4574
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Makefile
Outdated
| build: | ||
| @echo "$(WHALE) $@" | ||
| HOST_OS=$(OS) ARCH=$(ARCH) $(BUILDX) bake |
There was a problem hiding this comment.
The build target exports ARCH=$(ARCH) from uname -m (e.g., x86_64, aarch64) into docker-bake.hcl, but the bake file’s ARCH variable is used as a Docker/Go arch (amd64/arm64). This mismatch makes kernelArch() return unknown (and may set GOARCH to an invalid value), breaking builds. Normalize ARCH before passing it (e.g., map x86_64->amd64, aarch64/arm64->arm64), or pass a separate variable for kernel arch vs Go/Docker arch.
docker-bake.hcl
Outdated
|
|
||
| target "_common" { | ||
| args = { | ||
| TARGETARCH = ARCH |
There was a problem hiding this comment.
_common.args forcibly sets TARGETARCH = ARCH. Buildx already provides TARGETARCH based on the build platform; overriding it with a custom variable (defaulting to amd64) will produce incorrect artifacts on non-amd64 runners unless every workflow explicitly sets ARCH. If you need a separate knob for kernel naming, consider not overriding TARGETARCH and instead pass only KERNEL_ARCH, or ensure ARCH is always set to amd64/arm64 in all callers (including CI).
| TARGETARCH = ARCH |
|
|
||
| - name: Build remaining artifacts (initrd and shim) | ||
| run: | | ||
| echo "Building host and guest binaries:" |
There was a problem hiding this comment.
This step runs docker buildx bake host-binaries guest-binaries without setting ARCH (or HOST_OS). Because docker-bake.hcl defaults ARCH to amd64 and also overrides TARGETARCH, the arm64 matrix job will build amd64 guest artifacts (notably nerdbox-initrd), causing VM startup/tests to fail. Export ARCH/HOST_OS for this step (or stop overriding TARGETARCH in the bake file so Buildx can set it correctly).
| echo "Building host and guest binaries:" | |
| echo "Building host and guest binaries:" | |
| if [ "${{ matrix.arch }}" = "x86_64" ]; then | |
| export ARCH=amd64 | |
| else | |
| export ARCH=arm64 | |
| fi | |
| export HOST_OS=linux | |
| echo "Using ARCH=${ARCH}, HOST_OS=${HOST_OS}" |
| - name: Start containerd | ||
| shell: bash | ||
| run: | | ||
| echo "Starting containerd..." | ||
|
|
||
| # Start containerd in background with logging | ||
| sudo nohup containerd > /var/log/containerd/containerd.log 2>&1 & | ||
| CONTAINERD_PID=$! | ||
|
|
||
| echo "Containerd started with PID: $CONTAINERD_PID" | ||
|
|
||
| # Save PID for cleanup | ||
| echo "$CONTAINERD_PID" | sudo tee /var/run/containerd.pid | ||
|
|
||
| # Wait for containerd to be ready | ||
| echo "Waiting for containerd to be ready..." | ||
| for i in {1..30}; do | ||
| if sudo ctr version >/dev/null 2>&1; then | ||
| echo "Containerd is ready!" | ||
| break | ||
| fi | ||
| if [ $i -eq 30 ]; then | ||
| echo "Error: Containerd failed to start within 30 seconds" | ||
| echo "Containerd logs:" | ||
| sudo cat /var/log/containerd/containerd.log | ||
| exit 1 | ||
| fi | ||
| echo "Waiting... ($i/30)" | ||
| sleep 1 | ||
| done |
There was a problem hiding this comment.
Starting containerd with sudo nohup containerd ... & is likely to conflict with any existing containerd already running on the runner (default socket /run/containerd/containerd.sock), and the health check (ctr version) will succeed even if it’s talking to the pre-existing daemon. To make the installed version deterministic, start containerd on an isolated socket/address (and point ctr to it) or stop/disable the preinstalled service before starting the downloaded binary.
| # Construct download URL | ||
| TARBALL="containerd-${VERSION}-linux-${ARCH}.tar.gz" | ||
| URL="https://github.com/containerd/containerd/releases/download/v${VERSION}/${TARBALL}" | ||
|
|
||
| # Download containerd | ||
| curl -fsSL -o "/tmp/${TARBALL}" "${URL}" | ||
|
|
||
| echo "Downloaded containerd tarball to /tmp/${TARBALL}" | ||
| ls -lh "/tmp/${TARBALL}" |
There was a problem hiding this comment.
The downloaded containerd tarball is installed without any integrity verification (checksum/signature). For supply-chain safety, verify the archive against published checksums (or use a provenance-verified source) before extracting as root.
Makefile
Outdated
| # Detect local platform; 'linux' or 'darwin' | ||
| OS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]') | ||
| ARCH ?= $(shell uname -m) | ||
| export PLATFORM ?= $(OS)/$(ARCH) | ||
|
|
||
| LDFLAGS_x86_64_Linux = -lkrun | ||
| LDFLAGS_aarch64_Linux = -lkrun | ||
| LDFLAGS_arm64_Darwin = -L/opt/homebrew/lib -lkrun |
There was a problem hiding this comment.
OS is now normalized to lowercase ("linux"/"darwin"), but later logic still relies on title-cased OS keys (e.g., LDFLAGS_*_Linux/LDFLAGS_*_Darwin and ifeq ($(OS),Darwin)). With the new OS value, $(LDFLAGS_$(ARCH)_$(OS)) will not resolve and the Darwin codesign blocks will never run. Consider either keeping OS in the original casing, or updating the LDFLAGS variable names and all OS comparisons to match the lowercase convention.
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
45a4574 to
5d56f95
Compare
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
5d56f95 to
9efaabd
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
|
|
||
| function "kernelArch" { | ||
| params = [] | ||
| result = ARCH == "amd64" ? "x86_64" : (ARCH == "arm64" ? "arm64" : "unknown") |
There was a problem hiding this comment.
kernelArch() only handles ARCH values amd64 and arm64. If ARCH is set to common host values like x86_64 or aarch64, it returns "unknown", which will later make the kernel build fail (e.g., missing kernel/config-<version>-unknown). Consider either accepting x86_64/aarch64 here (mapping aarch64 -> arm64) or returning ARCH by default instead of "unknown" so local builds don’t break when ARCH comes from uname -m.
| result = ARCH == "amd64" ? "x86_64" : (ARCH == "arm64" ? "arm64" : "unknown") | |
| result = ARCH == "amd64" || ARCH == "x86_64" ? "x86_64" : (ARCH == "arm64" || ARCH == "aarch64" ? "arm64" : ARCH) |
| # Start containerd in background with logging | ||
| sudo nohup containerd > /var/log/containerd/containerd.log 2>&1 & | ||
| CONTAINERD_PID=$! | ||
|
|
||
| echo "Containerd started with PID: $CONTAINERD_PID" | ||
|
|
||
| # Save PID for cleanup | ||
| echo "$CONTAINERD_PID" | sudo tee /var/run/containerd.pid | ||
|
|
There was a problem hiding this comment.
CONTAINERD_PID=$! here captures the PID of the backgrounded sudo process, not the actual containerd daemon PID. This makes /var/run/containerd.pid misleading and can break any cleanup logic that relies on it. Consider starting containerd via sudo sh -c and writing the real child PID, or drop PID-file creation and rely on pgrep/pkill consistently.
| # Start containerd in background with logging | |
| sudo nohup containerd > /var/log/containerd/containerd.log 2>&1 & | |
| CONTAINERD_PID=$! | |
| echo "Containerd started with PID: $CONTAINERD_PID" | |
| # Save PID for cleanup | |
| echo "$CONTAINERD_PID" | sudo tee /var/run/containerd.pid | |
| # Start containerd in background with logging and save its PID | |
| sudo sh -c 'nohup containerd > /var/log/containerd/containerd.log 2>&1 & echo $! > /var/run/containerd.pid' | |
| CONTAINERD_PID=$(sudo cat /var/run/containerd.pid) | |
| echo "Containerd started with PID: $CONTAINERD_PID" | |
| # PID is saved for cleanup in /var/run/containerd.pid |
| - name: Checkout code | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
|
|
There was a problem hiding this comment.
This composite action performs its own actions/checkout, but both callers in this PR (ci.yml and build-kernel.yml) already check out the repo before invoking it. That duplicates work and can also override any checkout options the caller intended (sparse checkout, submodules, custom path, etc.). Prefer removing checkout from the action and requiring callers to checkout, or make it explicitly optional via an input/flag.
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| with: | ||
| containerd_version: ${{ needs.setup.outputs.containerd-version }} | ||
| architecture: ${{ matrix.arch == 'x86_64' && 'amd64' || 'arm64' }} | ||
|
|
There was a problem hiding this comment.
The integration workflow starts a containerd daemon via ./.github/actions/setup-containerd, but the current go test ./integration/... suite doesn’t appear to talk to containerd (it exercises VM + ttrpc APIs directly). If containerd isn’t required, consider removing this setup to reduce CI time/complexity; if it is required, consider adding/adjusting integration tests so the dependency is validated (otherwise failures here may be confusing and unrelated to the tests).
| - name: Validate containerd is running | |
| run: | | |
| echo "Validating containerd is running and responsive..." | |
| # Check containerd version via ctr; this will fail clearly if containerd is not healthy | |
| sudo ctr version |
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
Signed-off-by: Austin Vazquez <austin.vazquez@docker.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| kernel_version=$(grep -E '^kernel [0-9.]+$' .github/.tool-versions | sed -E 's/^kernel ([0-9.]+)$/\1/') | ||
| echo "kernel-version=${kernel_version}" >> $GITHUB_OUTPUT | ||
| containerd_version=$(grep -E '^containerd [0-9.]+$' .github/.tool-versions | sed -E 's/^containerd ([0-9.]+)$/\1/') | ||
| echo "containerd-version=${containerd_version}" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
This step will silently set empty outputs if the grep doesn’t match (because there’s no set -e/validation). That would cause downstream jobs to use empty version strings. Consider enabling set -euo pipefail and explicitly failing when kernel_version or containerd_version is empty.
| kernel_version=$(grep -E '^kernel [0-9.]+$' .github/.tool-versions | sed -E 's/^kernel ([0-9.]+)$/\1/') | |
| echo "kernel-version=${kernel_version}" >> $GITHUB_OUTPUT | |
| containerd_version=$(grep -E '^containerd [0-9.]+$' .github/.tool-versions | sed -E 's/^containerd ([0-9.]+)$/\1/') | |
| echo "containerd-version=${containerd_version}" >> $GITHUB_OUTPUT | |
| set -euo pipefail | |
| kernel_version="$(awk '/^kernel [0-9.]+$/ {print $2}' .github/.tool-versions)" | |
| if [ -z "${kernel_version}" ]; then | |
| echo "Failed to determine kernel version from .github/.tool-versions" >&2 | |
| exit 1 | |
| fi | |
| echo "kernel-version=${kernel_version}" >> "${GITHUB_OUTPUT}" | |
| containerd_version="$(awk '/^containerd [0-9.]+$/ {print $2}' .github/.tool-versions)" | |
| if [ -z "${containerd_version}" ]; then | |
| echo "Failed to determine containerd version from .github/.tool-versions" >&2 | |
| exit 1 | |
| fi | |
| echo "containerd-version=${containerd_version}" >> "${GITHUB_OUTPUT}" |
| arch: arm64 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 |
There was a problem hiding this comment.
build-kernels checks out the repo, but the referenced ./.github/actions/build-kernel composite action also performs a checkout. This duplicates work and can be confusing if different checkout options are needed. Consider removing one of the checkouts (either rely on the workflow checkout or have the action assume the workspace is already checked out).
| - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
|
|
There was a problem hiding this comment.
This workflow checks out the repo, but the ./.github/actions/build-kernel composite action also checks out the repo, resulting in a redundant checkout. Consider keeping checkout in one place (workflow or action) to reduce runtime and avoid inconsistent checkout behavior.
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| @@ -0,0 +1,3 @@ | |||
| golang 1.25.8 | |||
There was a problem hiding this comment.
The Go version in .github/.tool-versions (used by CI via go-version-file) differs from the Go version pinned in the Dockerfile (GO_VERSION). This can lead to CI/test results not matching Docker-based builds. Consider aligning these versions (or documenting why they intentionally differ).
No description provided.