From df029f4f7a758717821e8b53eb914f4cd108fda9 Mon Sep 17 00:00:00 2001
From: Dimitris Karakasilis <dimitris@spectrocloud.com>
Date: Wed, 17 Jun 2026 12:21:12 +0300
Subject: [PATCH] packaging: optionally fetch static nydus-snapshotter for the
 payload

The kata-deploy payload downloads the nydus-snapshotter host binaries
(containerd-nydus-grpc, nydus-overlayfs) from the upstream per-arch
release asset, which is glibc dynamically linked and fails to exec on
musl-only hosts that have no glibc dynamic loader.

nydus-snapshotter also publishes a statically linked release asset.
Honour the existing STATIC_RUNTIME=yes umbrella flag (which already
builds the kata Go host binaries static) in the nydus component build so
that, with a single flag, the whole host-binary set of the payload is
static and runs on a musl-only host. STATIC_RUNTIME=yes maps to a new
STATIC_NYDUS_SNAPSHOTTER build-arg on the nydus downloader stage of
Dockerfile.components, which selects the linux-static asset.

The static nydus asset is published for amd64 only, so the build fails
fast on other architectures when the flag is set. The default build is
unchanged.

Signed-off-by: Dimitris Karakasilis <dimitris@spectrocloud.com>
Generated-By: Claude Opus 4.8 (1M context) noreply@anthropic.com
---
 .../kata-deploy/Dockerfile.components         | 22 ++++++++++++++++---
 .../kata-deploy-build-components-tarballs.sh  |  7 ++++++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/tools/packaging/kata-deploy/Dockerfile.components b/tools/packaging/kata-deploy/Dockerfile.components
index cc5c1e3a4f..89094c2288 100644
--- a/tools/packaging/kata-deploy/Dockerfile.components
+++ b/tools/packaging/kata-deploy/Dockerfile.components
@@ -7,6 +7,13 @@
 
 FROM alpine:3.22 AS nydus-binary-downloader
 
+# When STATIC_NYDUS_SNAPSHOTTER is set to a non-empty value, download the
+# statically linked release asset (nydus-snapshotter-<ver>-linux-static.tar.gz)
+# instead of the per-arch (dynamically, glibc-linked) one. The static binaries
+# run on musl-only hosts that have no glibc dynamic loader. The static asset is
+# currently published for x86_64/amd64 only.
+ARG STATIC_NYDUS_SNAPSHOTTER=""
+
 COPY versions.yaml /tmp/versions.yaml
 
 RUN \
@@ -18,9 +25,18 @@ RUN \
 	ARCH="$(uname -m)" && \
 	if [ "${ARCH}" = "x86_64" ]; then ARCH=amd64 ; fi && \
 	if [ "${ARCH}" = "aarch64" ]; then ARCH=arm64; fi && \
-	curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" && \
-	tar xvzpf "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz" -C /opt/nydus-snapshotter && \
-	rm "nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"
+	if [ -n "${STATIC_NYDUS_SNAPSHOTTER}" ]; then \
+		if [ "${ARCH}" != "amd64" ]; then \
+			echo "STATIC_NYDUS_SNAPSHOTTER is only supported on amd64 (no static asset is published for ${ARCH})" >&2; \
+			exit 1; \
+		fi; \
+		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-static.tar.gz"; \
+	else \
+		NYDUS_SNAPSHOTTER_TARBALL="nydus-snapshotter-${NYDUS_SNAPSHOTTER_VERSION}-linux-${ARCH}.tar.gz"; \
+	fi && \
+	curl -fOL --progress-bar "${NYDUS_SNAPSHOTTER_REPO}/releases/download/${NYDUS_SNAPSHOTTER_VERSION}/${NYDUS_SNAPSHOTTER_TARBALL}" && \
+	tar xvzpf "${NYDUS_SNAPSHOTTER_TARBALL}" -C /opt/nydus-snapshotter && \
+	rm "${NYDUS_SNAPSHOTTER_TARBALL}"
 
 #### Build binary package
 FROM ubuntu:22.04 AS rust-builder
diff --git a/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh b/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
index 720f47e013..73cb8b30b8 100755
--- a/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
+++ b/tools/packaging/kata-deploy/local-build/kata-deploy-build-components-tarballs.sh
@@ -81,8 +81,15 @@ build_kata_deploy_job_dispatcher() {
 }
 
 build_nydus_snapshotter_for_coco_guest_pull() {
+	# STATIC_RUNTIME=yes is the umbrella flag for a musl-compatible payload: it
+	# builds the kata Go host binaries static (see static-build/shim-v2) and here
+	# pulls the statically linked nydus-snapshotter binaries instead of the
+	# glibc-linked per-arch ones.
+	local static_nydus_snapshotter="${STATIC_RUNTIME:-}"
+
 	docker buildx build \
 		--target nydus-binary-downloader \
+		--build-arg "STATIC_NYDUS_SNAPSHOTTER=${static_nydus_snapshotter}" \
 		--output "type=local,dest=${build_dir}/nydus-snapshotter-out" \
 		-f "${repo_root_dir}/tools/packaging/kata-deploy/Dockerfile.components" \
 		"${repo_root_dir}"