From 156806fd5aa121350d7790ea2450ab53b263fa40 Mon Sep 17 00:00:00 2001 From: lihe Date: Fri, 18 Sep 2026 12:05:12 +0800 Subject: [PATCH 1/2] fix: provide standalone kill in Arc runtime images --- .github/scripts/test-runtime-image.sh | 21 ++++++++++++++------- deployments/Dockerfile.consensus | 6 +++--- deployments/Dockerfile.execution | 6 +++--- 3 files changed, 20 insertions(+), 13 deletions(-) diff --git a/.github/scripts/test-runtime-image.sh b/.github/scripts/test-runtime-image.sh index a6bbcab..82ba8e6 100644 --- a/.github/scripts/test-runtime-image.sh +++ b/.github/scripts/test-runtime-image.sh @@ -4,13 +4,20 @@ set -euo pipefail image_ref="${1:?usage: test-runtime-image.sh IMAGE BINARY}" binary="${2:?usage: test-runtime-image.sh IMAGE BINARY}" +# Match kubectl exec's direct execution: a Bash builtin is not sufficient. +docker run --rm --network none --entrypoint kill "$image_ref" -l TERM + # Use the image's default user and isolated temporary files, never a node volume. docker run --rm --network none --entrypoint /bin/bash "$image_ref" -euxc ' [[ "$(id -u)" == 999 && "$(id -g)" == 999 ]] - for command in bash sh cat touch tail rm mkdir mktemp; do - command -v "$command" + for command in bash sh cat touch tail rm mkdir mktemp ls sleep kill; do + type -P "$command" done test -s /etc/ssl/certs/ca-certificates.crt + test ! -w / + test -w /tmp + test ! -e /tmp/prune.done + test ! -e /tmp/done.done test_dir=$(mktemp -d) # The init script must delete only the discovery key, including on a rerun. @@ -30,18 +37,18 @@ docker run --rm --network none --entrypoint /bin/bash "$image_ref" -euxc ' runmode=$(cat "$test_dir/runmode") if [[ X${runmode} != Xnormal ]]; then if [[ X${runmode} == Xprune ]]; then - touch "$test_dir/prune.done" + touch /tmp/prune.done fi - touch "$test_dir/done.done" + touch /tmp/done.done tail -f /dev/null & child=$! - kill -TERM "$child" + env kill -TERM "$child" status=0 wait "$child" || status=$? [[ "$status" == 143 ]] fi - test -f "$test_dir/prune.done" - test -f "$test_dir/done.done" + test -f /tmp/prune.done + test -f /tmp/done.done /bin/sh -eu -c '\''test "$(cat "$1/runmode")" = prune'\'' sh "$test_dir" exec "/usr/local/bin/$1" --version ' bash "$binary" diff --git a/deployments/Dockerfile.consensus b/deployments/Dockerfile.consensus index d5e917b..89f659a 100644 --- a/deployments/Dockerfile.consensus +++ b/deployments/Dockerfile.consensus @@ -93,13 +93,13 @@ FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base # Bootstrap the HTTPS package sources with the existing certificate bundle. COPY --from=chef /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt -# Kubernetes init/runmode scripts require Bash and coreutils; keep Debian 12 -# compatibility with the builder and the previous distroless runtime. +# Kubernetes init/runmode scripts require Bash, coreutils and standalone kill. +# Keep Debian 12 compatibility with the builder and previous runtime. COPY assets/apt/apt-retry.conf /etc/apt/apt.conf.d/apt-retry.conf COPY assets/apt/debian.sources /etc/apt/sources.list.d/debian.sources RUN rm -f /etc/apt/sources.list && \ apt-get update && \ - apt-get install -y --no-install-recommends bash coreutils libstdc++6 && \ + apt-get install -y --no-install-recommends bash coreutils procps libstdc++6 && \ rm -rf /var/lib/apt/lists/* FROM runtime-base AS release-runtime diff --git a/deployments/Dockerfile.execution b/deployments/Dockerfile.execution index 4c8f3ab..c8be1e8 100644 --- a/deployments/Dockerfile.execution +++ b/deployments/Dockerfile.execution @@ -92,13 +92,13 @@ FROM public.ecr.aws/docker/library/debian:bookworm-slim AS runtime-base COPY --from=chef /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt -# Kubernetes init/runmode scripts require Bash and coreutils; keep Debian 12 -# compatibility with the builder and the previous distroless runtime. +# Kubernetes init/runmode scripts require Bash, coreutils and standalone kill. +# Keep Debian 12 compatibility with the builder and previous runtime. COPY assets/apt/apt-retry.conf /etc/apt/apt.conf.d/apt-retry.conf COPY assets/apt/debian.sources /etc/apt/sources.list.d/debian.sources RUN rm -f /etc/apt/sources.list && \ apt-get update && \ - apt-get install -y --no-install-recommends bash coreutils libstdc++6 && \ + apt-get install -y --no-install-recommends bash coreutils procps libstdc++6 && \ rm -rf /var/lib/apt/lists/* FROM runtime-base AS release-runtime From ee213fbf8eebc353e0ef2aad69bf356fd0d07570 Mon Sep 17 00:00:00 2001 From: lihe Date: Fri, 18 Sep 2026 12:28:31 +0800 Subject: [PATCH 2/2] build: remove inconsistent Debian security mirror --- assets/apt/debian.sources | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/assets/apt/debian.sources b/assets/apt/debian.sources index bb2132c..107452b 100644 --- a/assets/apt/debian.sources +++ b/assets/apt/debian.sources @@ -1,9 +1,9 @@ -# Debian package sources with fallback mirrors for CI reliability -# Uses DEB822 format with multiple URIs - APT tries them in order until one works +# Debian package sources and mirrors for CI reliability +# APT updates each DEB822 URI separately; these are not ordered failover endpoints. # # Mirror selection rationale: # - Primary: deb.debian.org (Fastly CDN, globally distributed) -# - Fallbacks: University mirrors that also mirror debian-security +# - Additional mirrors: Waterloo (main) and xTom (main and security) # # NOTE: Uses HTTPS because HTTP port 80 is blocked by StepSecurity egress policy. # NOTE: The suite "bookworm" must match the Debian version in the Dockerfiles. @@ -17,7 +17,7 @@ Components: main Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg Types: deb -URIs: https://deb.debian.org/debian-security https://mirror.csclub.uwaterloo.ca/debian-security https://mirror.xtom.com/debian-security +URIs: https://deb.debian.org/debian-security https://mirror.xtom.com/debian-security Suites: bookworm-security Components: main Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg