Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@rucoder
Copy link
Contributor

@rucoder rucoder commented Jul 9, 2025

Description

#5028: "Fix parallel build and add an option to Makefile to enable it (disabled by default)"
#5046: "Makefile: Remove buildkit options for manifest command"
#5044: "Upgrade Linuxkit to 1.7.0"
#5037: "Fix 'unauthenticated pull rate limit reached' problem"
#5013: "Bump up linuxkit version to 1.6.2 to avoid race in parallel build"
#4993: "Create linuxkit-builder manually to support parallel build"
#5004: "Bump up linuxkit version to 1.6.1 to avoid race in parallel build"
#4972: "Remove EVE_REL from tags"
#4966: "Fixes VirtualBox EVE VM onboarding"
#4939: "Fix broken run-* targets for dirty builds"
#4925: "Avoid reevaluation of Linuxkit target"
#4871: "Fix image .yq modifiers parsing"
#4865: "Fix errors in Makefile"
#4821: "Makefile: set csum off for qemu tap"
#4805: "Fix targets and scripts that were not taking REGISTRY into account"

How to test and validate this PR

"Too many requests" especially "too many unauthenticated requests" should not appear on CI

Checklist

  • I've provided a proper description
  • I've added the proper documentation
  • I've tested my PR on amd64 device
  • I've tested my PR on arm64 device
  • I've written the test verification instructions
  • I've set the proper labels to this PR

For backport PRs (remove it if it's not a backport):

  • I've added a reference link to the original PR
  • PR's title follows the template

And the last but not least:

  • I've checked the boxes above, or I've provided a good reason why I didn't
    check them.

Please, check the boxes above after submitting the PR in interactive mode.

rene added 2 commits July 9, 2025 08:56
LINUXKIT_ORG_TARGET was not taking into account on some make targets and
by the tools/makerootfs.sh and tools/parse-pkgs.sh scripts. Even when using
linuxkit show-tag, it's important to take LINUXKIT_ORG_TARGET into account.
Otherwise, make eve will fail when using a custom REGISTRY value.

Signed-off-by: Renê de Souza Pinto <[email protected]>
(cherry picked from commit c469671)
When using a custom registry (through REGISTRY variable) not all images
must be already pushed, so make sure we have the right dependencies
listed for rootfs image so they can be built if not present in the
registry.

Signed-off-by: Renê de Souza Pinto <[email protected]>
(cherry picked from commit 0b0114a)
@rucoder rucoder changed the base branch from master to 14.5-stable July 9, 2025 09:10
@rucoder rucoder force-pushed the rucoder/fix-docker-14.5 branch from 80c5816 to d36ca2f Compare July 9, 2025 09:53
christoph-zededa and others added 14 commits July 9, 2025 10:44
otherwise the following happens:
```
[pillar] root@linuxkit-525400123456:/$ dhcpcd eth1
no such user dhcpcd
dhcpcd-9.4.1 starting
DUID 00:01:00:01:2f:b7:43:ac:52:54:00:12:34:57
eth1: IAID 00:12:34:57
eth1: soliciting a DHCP lease
eth1: checksum failure from 192.168.100.1
eth1: soliciting an IPv6 router
eth1: checksum failure from 192.168.100.1
eth1: probing for an IPv4LL address
control command: dhcpcd -U -4 eth1
control_free: No such file or directory
eth1: using IPv4LL address 169.254.197.56
eth1: adding route to 169.254.0.0/16
eth1: adding default route
forked to background, child pid 4294
```

`eth1: checksum failure from 192.168.100.1`
if csum is deactivated then there is no more checksum failure

A workaround for older EVEs is to run the following on the host:
```
sudo ethtool -K tap0 tx-checksumming off
```

Signed-off-by: Christoph Ostarek <[email protected]>
(cherry picked from commit d9e49d1)
- Move PLATFORM definition to main Makefile and define it bofor it is
  used. Currently TARGPLAT was never set to empty string
- Use $(first-word) to get only the first modifier for platforms like
  nvidia-jp5. The second file images/modifiers/jp5.yq is ignored by
  tools/compose-image-yml.sh but it is not expected to be passed at all

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 02784a5)
Commit 02784a5 fixed the parsing of
rootfs*.yml file names to look for modifier files, avoiding that an
output .yml file of the form:

images/out/rootfs-kvm-nvidia-jp6.yml

Would look for kvm.yq, nvidia.yq and jp6.yq (wrongly) modifiers. However,
the changes in this commit made the parser to only consider first parsed
word, breaking the following example into only kvm.yq modifier (missing
nvidia-jp6.yq).

This commit fixes the parser to correct look for .yml files in one of the
following forms:

- images/out/rootfs-<HV>.yml
- images/out/rootfs-<HV>-<PLATFORM>.yml
- images/out/rootfs-<PLATFORM>.yml

Modifier files are searched in images/modifiers directory. For instance,

images/out/rootfs-kvm-nvidia-jp6.yml

Will correct look for modifiers of the following form:

- images/modifiers/kvm.yq
- images/modifiers/kvm-nvidia-jp6.yq
- images/modifiers/nvidia-jp6.yq

Returning only modifiers (files) that exist.

Signed-off-by: Renê de Souza Pinto <[email protected]>
(cherry picked from commit 29c3baa)
LK was stored as build-tools/bin/linuxkit so there was no way
to detect its version without target reevaluation

This commit stores LK as build-tools/bin/linuxkit-$(LINUXKIT_VERSION)
so there is no need for FORCE anymore

we still keep a symlink to build-tools/bin/linuxkit because some scripts assume
LK executable name to be 'linuxkit'

- also group all LK related vars and targets together
- remove obsolete pkg/kernel target

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit f9f1fff)
All run-* targets must not build any artifacts because it causes an update
of ./dist/<arch>/current symbolic link and thus run-* target cannot find artifacts
anymore. Instead all references to artifacts in run-* targets must be relative
to 'current'. It was not a problem if changes were committed because new build directory
did not contain current time but in case of dirty builds new directory was created every time

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit f6c9d82)
Ensures VirtualBox EVE VMs can onboard correctly by setting the SMBIOS serial number.

Also includes minor fixes to network configuration for the VMs.
Moreover, added the current makefile target as a dependency to live-% so when we run ```make live-vdi``` the current symlink will point to the latest build that contains the vdi image. When then we run run-live-vb we use the current symlink directory to create the vbox VM

Signed-off-by: Othonas Soultatos <[email protected]>
(cherry picked from commit 7160726)
QEMU_OPTS_NET1 is now used as a variable also to VBoxmanage so in order to prevent misunderstandings, it is changed to IPS_NET

Signed-off-by: Othonas Soultatos <[email protected]>
(cherry picked from commit 6cd8b0b)
We had a strange logic, where if the HEAD commit has a tag on it, *and* it is the highest
semver tag available, then instead of building and pushing packages with the usual
tree hash and also adding the tag, we actually override the usual and force the tag.
This is strange and bad in two ways.

First, it means that even if nothing changes, it forced a rebuild of every single package. Which is silly. We want to use the existing ones, and just add the tag.
Second, it means that we did it only for the most recent semver. So if we already have 15.2.0 and 14.5.0, then 15.3.0 would trigger this behaviour, but 14.5.1 would not? That makes no sense.

This eliminates it. From this point forward, every tag that is on HEAD gets --release to add the tag.

Signed-off-by: Avi Deitcher <[email protected]>
(cherry picked from commit 3f291cf)
LK 1.6.0 has problem starting builder container if being run concurrently
This bug prevents us from implementing parallel builds for EVE

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 475aa24)
Linuxkit tries to create docker builder container if it doesn't exist.
It works fine for -j 1 but fails for parallel build. LK tries to create or update the
builder concurrently and fails. To avoid a race we create builder manually

- the builder name is hard-coded and is linuxkit-builder
- override context name for `linuxkit pkg build` so it doesn't try
to create a builder by itself
- ensure-builder target checks if the container exists and of required version
- docker prune operation cannot be executed concurrently, use flock to handle that
this is especially important for CI build with PRUNE=1 set

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit e0726b6)
- 1.6.2. has a fix for concurrent access to git index and improvements
for builder update procedure

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 1426c58)
- action/docker-login stores credential in ~/.docker/config.json. In theory this file should be mounted
into linuxkit-builder container but I did not know about it. Dut to that fact buildkit was running unauthenticated
- upgrade to linuxkit 1.6.5 that has fixes for a race in builder creation and cache access
- mount /etc/buildkit/buildkitd.toml that MAY define a mirror to speedup the build. LK doens't do it
other wise we could remove the whole block for manual creation of buildkit runner

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 23bcfde)
This version has many important fixes
1. Import of Docker credentials
2. --builder-config can pass a buildkitd.toml to a builder container

So we do not need an ensure-builder target anymore. It was very useful
for debugging Docker login / mirror related issues but I hope it is gone
for good.

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 784dc03)
When available, buildkit configuration is passed to linuxkit using the
--builder-config parameter. However, this parameter doesn't exist for
manifest command, so let's make sure to not use it when LINUXKIT_PKG_TARGET
is equal to manifest.

Signed-off-by: Renê de Souza Pinto <[email protected]>
(cherry picked from commit fe8706c)
rucoder added 2 commits July 9, 2025 10:44
For parallel build buildkit builder may be used by many instances of
Linuxkit. We must not remove it after each package is built.

Instead we remove this builder once when creating a lock file. It is a measure to
prevent outdated builders to be used

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 3450c39)
We can enable parallel build from Makefile to avoid changing GHA
For now we set NCORES to 1 but we'll change it to $(nproc) in future
wehn Linuxkit will have a fix for concurrent cache access

Signed-off-by: Mikhail Malyshev <[email protected]>
(cherry picked from commit 2792365)
@rucoder rucoder force-pushed the rucoder/fix-docker-14.5 branch from d36ca2f to e603d19 Compare July 9, 2025 10:46
@rucoder rucoder changed the title [14.5-stable] Backport patches to fix dockerhub authentication problems [14.5-stable] Backport all bug fixes to Makefile Jul 9, 2025
Copy link
Contributor

@rene rene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I went through the commits, I don't see anything else to add... LGTM...

@rucoder
Copy link
Contributor Author

rucoder commented Jul 9, 2025

I went through the commits, I don't see anything else to add... LGTM...

I did git difftool master -- Makefile and only changes for new features were not integrated

@OhmSpectator OhmSpectator merged commit ef32482 into lf-edge:14.5-stable Jul 9, 2025
33 of 42 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants