Merge pull request #2350 from rn/multi-arch

Grand conversion to multi-arch manifests

Makefile

@@ -5,7 +5,7 @@ all: default
 VERSION="0.0" # dummy for now
 GIT_COMMIT=$(shell git rev-list -1 HEAD)
 
-GO_COMPILE=linuxkit/go-compile:a1e3cd3a54b1ad683b555655282272d0eb27ee40
+GO_COMPILE=linuxkit/go-compile:7cac05c5588b3dd6a7f7bdb34fc1da90257394c7
 
 MOBY?=bin/moby
 LINUXKIT?=bin/linuxkit

README.md

@@ -70,8 +70,9 @@ Currently supported platforms are:
 
 #### Running the Tests
 
-The test suite uses [`rtf`](https://github.com/linuxkit/rtf)
-To install this you should use `make bin/rtf && make install`.
+The test suite uses [`rtf`](https://github.com/linuxkit/rtf) To
+install this you should use `make bin/rtf && make install`. You will
+also need to install `expect` on your system as some tests use it.
 
 To run the test suite:
 
@@ -103,6 +104,8 @@ generate its specified output. You can run the output with `linuxkit run file`.
 The yaml file specifies a kernel and base init system, a set of containers that are built into the generated image and started at boot time. You can specify the type
 of artifact to build with the `moby` tool eg `moby build -output vhd linuxkit.yml`.
 
+If you want to build your own packages, see this [document](docs/packages.md).
+
 ### Yaml Specification
 
 The yaml format specifies the image to be built:

blueprints/docker-for-mac/base.yml

@@ -3,25 +3,25 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/vpnkit-expose-port:e2b49a6c56fbf876ea24f0a5ce4ccae5f940d1be # install vpnkit-expose-port and vpnkit-iptables-wrapper on host
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/vpnkit-expose-port:fa4ab4ac78b83fe392e39b861b4114c3bb02d170 # install vpnkit-expose-port and vpnkit-iptables-wrapper on host
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   # support metadata for optional config in /var/config
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: binfmt
-    image: linuxkit/binfmt:257b5174a8e33bc62d5448cc026d72cae3713628
+    image: linuxkit/binfmt:472eeba777d056c5f98fe074aa0f581c67ccc7ff
   # Format and mount the disk image in /var/lib/docker
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib"]
   # create docker dir on mounted drive if it doesn't exist
   - name: mkdir-docker
@@ -45,41 +45,41 @@ onboot:
         - /var:/host_var
     command: ["sh", "-c", "mv -v /host_var/log /host_var/lib && ln -vs /var/lib/log /host_var/log"]
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   # Enable acpi to shutdown on power events
   - name: acpid
-    image: linuxkit/acpid:1966310cb75e28ffc668863a6577ee991327f918
+    image: linuxkit/acpid:79e5c20de96e1633c9c40935b99dde45aefba37b
   # Enable getty for easier debugging
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
         - INSECURE=true
   # Run ntpd to keep time synchronised in the VM
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   # VSOCK to unix domain socket forwarding. Forwards guest /var/run/docker.sock
   # to a socket on the host.
   - name: vsudd
-    image: linuxkit/vsudd:adad4b6ab7529b6b95339eb0752b0c81a218d185
+    image: linuxkit/vsudd:d40f65855dfc4fe4740ba5fb5d3282cbc2131715
     binds:
         - /var/run:/var/run
     command: ["/vsudd", "-inport", "2376:unix:/var/run/docker.sock"]
   # vpnkit-forwarder forwards network traffic to/from the host via VSOCK port 62373. 
   # It needs access to the vpnkit 9P coordination share 
   - name: vpnkit-forwarder
-    image: linuxkit/vpnkit-forwarder:9c1545e7b093d1210118de7661d7346393ec195b
+    image: linuxkit/vpnkit-forwarder:42d80758e3b6a9f58cdfd25e53c775eebe951669
     binds:
         - /var/vpnkit:/port
     net: host
     command: ["/vpnkit-forwarder", "-vsockPort", "62373"]
   # Monitor for image deletes and invoke a TRIM on the container filesystem
   - name: trim-after-delete
-    image: linuxkit/trim-after-delete:2a5fcbe080cd4a45bd75c2ea3856c069475d706d
+    image: linuxkit/trim-after-delete:8e7aea3dc87bbb72cf56e62d8b8861ff93946480
   # When the host resumes from sleep, force a clock resync
   - name: host-timesync-daemon
-    image: linuxkit/host-timesync-daemon:e6c15e6ef75d302c1c22827bac249598fb365a83
+    image: linuxkit/host-timesync-daemon:625a906f2c3d9a3a2b8c856f062bc6c0d6b526bd
 
 trust:
     org:

blueprints/lcow.yml

@@ -3,8 +3,8 @@ kernel:
   cmdline: "console=ttyS0"
   tar: none
 init:
-  - linuxkit/init-lcow:439515abb07a6c91ff4e1accf9b1f705d192d881
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init-lcow:73860235d61b9c039728931555c03cb6f575b5e0
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 trust:
   org:
     - linuxkit

docs/packages.md

@@ -0,0 +1,101 @@
+# LinuxKit packages
+
+LinuxKit packages a container images which are pull using the `moby`
+tool and assembled into bootable Linux images. LinuxKit comes with a
+number of [packages](../pkg) which are core part of LinuxKit, but
+users can add their own packages to the YAML files.
+
+All LinuxKit packages are:
+- Signed with Docker Content Trust.
+- Multi-arch manifests to work on multiple architectures.
+- Derived from well-known (and signed) sources for repeatable builds.
+- Build with multi-stage builds to minimise their size.
+
+
+## Building packages
+
+### Prerequisites
+
+Before you can build packages you need:
+- Docker version 17.06 or newer. If you are on a Mac you also need
+  `docker-credential-osxkeychain.bin`, which comes with Docker for Mac.
+- `make`, `notary`, `base64`, `jq`, and `expect`
+- A custom copy of `manifest-tool` which you can build with `make
+  bin/manifest-tool`. `manifest-tool` must be in your path.
+
+Further, when building packages you need to be logged into hub with
+`docker login` as some of the tooling extracts your hub credentials
+during the build.
+
+### Build packages as a maintainer
+
+If you have write access to the `linuxkit` organisation on hub, you
+should also be set up with signing keys for packages and your signing
+key should have a passphrase, which we call `<passphrase>` throughout.
+
+All official LinuxKit packages are multi-arch manifests and most of
+them are available for amd64 and aarm64. Official images *must* be
+build on both architectures and they must be build *in sequence*, i.e.,
+they can't be build in parallel.
+
+To build a package on an architecture:
+
+```
+DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE="<passphrase>" make
+```
+
+This will:
+- Build a local images as `linuxkit/<image>:<hash>-<arch>`
+- Push it to hub
+- Sign it with your key
+- Create a manifest called `linuxkit/<image>:<hash>` (note no `-<arch>`)
+- Push the manifest to hub
+- Sign the manifest
+
+If you repeat the same on another architecture, a new manifest will be
+pushed and signed containing the previous and the new
+architecture. The YAML files should consume the package as:
+`linuxkit/<image>:<hash>`.
+
+
+Since it is not very good to have your passphrase in the clear (or
+even stashed in your shell history), we recommend using a password
+manager with a CLI interface, such as LastPass or `pass`. You can then
+invoke `make` like this (for LastPass):
+
+```
+DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE=$(lpass show <key> --password) make
+```
+
+### Build packages as a developer
+
+If you want to develop packages or test them locally, it is best to
+override the hub organisation used. You may also want to disable
+signing while developing. A typical example would be:
+
+```
+make ORG=wombat NOTRUST=1 tag
+```
+
+This will create a local image: `wombat/<image>:<hash>-<arch>` which
+you can use in your local YAML files for testing. If you need to test
+on other systems you can push the image to your hub account and pull
+from a different system by issuing:
+
+```
+make ORG=wombat NOTRUST=1 push
+```
+
+This will push both `wombat/<image>:<hash>-<arch>` and
+`wombat/<image>:<hash>` to hub.
+
+Finally, if you are tired of the long hashes you can override the hash
+with:
+
+```
+make ORG=wombat NOTRUST=1 HASH=foo push
+```
+
+and this will create `wombat/<image>:foo-<arch>` and
+`wombat/<image>:foo` for use in your YAML files.
+

docs/vendoring.md

@@ -22,7 +22,7 @@ docker run -it --rm \
 -v $(pwd):/go/src/github.com/linuxkit/linuxkit \
 -w /go/src/github.com/linuxkit/linuxkit/src/cmd/linuxkit \
 --entrypoint /go/bin/vndr \
-linuxkit/go-compile:a1e3cd3a54b1ad683b555655282272d0eb27ee40
+linuxkit/go-compile:7cac05c5588b3dd6a7f7bdb34fc1da90257394c7
 ```
 
 To update a single dependency:
@@ -32,7 +32,7 @@ docker run -it --rm \
 -v $(pwd):/go/src/github.com/linuxkit/linuxkit \
 -w /go/src/github.com/linuxkit/linuxkit/src/cmd/linuxkit \
 --entrypoint /go/bin/vndr \
-linuxkit/go-compile:a1e3cd3a54b1ad683b555655282272d0eb27ee40
+linuxkit/go-compile:7cac05c5588b3dd6a7f7bdb34fc1da90257394c7
 github.com/docker/docker
 ```
 

examples/aws.yml

@@ -2,23 +2,23 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
     binds:
      - /var/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx

examples/azure.yml

@@ -2,20 +2,20 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub

examples/docker.yml

@@ -2,31 +2,31 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/docker"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: docker
     image: docker:17.06.0-ce-dind
     capabilities:

examples/gcp.yml

@@ -2,27 +2,27 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
     binds:
      - /var/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx

examples/getty.yml

@@ -2,24 +2,24 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     # to make insecure with passwordless root login, uncomment following lines
     #env:
     # - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)

examples/minimal.yml

@@ -2,16 +2,16 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
 trust:

examples/node_exporter.yml

@@ -2,18 +2,18 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: node_exporter
     image: linuxkit/node_exporter:a058fe1c6a4440a9689022a9fd7cffdcfd56d52c
 trust:

examples/packet.yml

@@ -2,20 +2,20 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub

examples/redis-os.yml

@@ -4,16 +4,16 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: redis

examples/sshd.yml

@@ -2,27 +2,27 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: rngd1
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
     command: ["/sbin/rngd", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub

examples/swap.yml

@@ -2,33 +2,33 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/external"]
   - name: swap
-    image: linuxkit/swap:b6d447b55da3c28bdd8a3f4e30fb42c1fa0157bb
+    image: linuxkit/swap:3881b1e0fadb7765d2fa85d03563c887ab9335a6
     # to use unencrypted swap, use:
     # command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G"]
     command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G", "--encrypt"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: nginx
     image: nginx:alpine
     capabilities:

examples/tpm.yml

@@ -3,24 +3,24 @@ kernel:
   cmdline: "console=tty0 console=ttyS0"
 init:
   - linuxkit/init:d049e7b2074da5cd699a27defb47eb101142455d
-  - linuxkit/runc:d5cbeb95bdafedb82ad2cf11cff1a5da7fcae630
-  - linuxkit/containerd:e33e0534d6fca88e1eb86897a1ea410b4a5d722e
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:4b7b8bb024cebb1bbb9c8026d44d7cbc8e202c41
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: tss
-    image: linuxkit/tss:51d73be868e12af76965f5682ed59309c19972b6
+    image: linuxkit/tss:7f7d8d3d76d764e3130dd92f52c4944908c8bd80
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)

examples/vmware.yml

@@ -2,22 +2,22 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: nginx
     image: nginx:alpine
     capabilities:

examples/vpnkit-forwarder.yml

@@ -2,12 +2,12 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: mount-vpnkit
     image: alpine:3.6
@@ -19,15 +19,15 @@ onboot:
     command: ["sh", "-c", "mkdir /host_var/vpnkit && mount -v -t 9p -o trans=virtio,dfltuid=1001,dfltgid=50,version=9p2000 port /host_var/vpnkit"]
 services:
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
   - name: vpnkit-forwarder
-    image: linuxkit/vpnkit-forwarder:9c1545e7b093d1210118de7661d7346393ec195b
+    image: linuxkit/vpnkit-forwarder:42d80758e3b6a9f58cdfd25e53c775eebe951669
     binds:
         - /var/vpnkit:/port
     net: host
     command: ["/vpnkit-forwarder"]
   - name: vpnkit-expose-port
-    image: linuxkit/vpnkit-forwarder:9c1545e7b093d1210118de7661d7346393ec195b
+    image: linuxkit/vpnkit-forwarder:42d80758e3b6a9f58cdfd25e53c775eebe951669
     net: none
     binds:
         - /var/vpnkit:/port

examples/vsudd.yml

@@ -2,16 +2,16 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: vsudd
-    image: linuxkit/vsudd:adad4b6ab7529b6b95339eb0752b0c81a218d185
+    image: linuxkit/vsudd:d40f65855dfc4fe4740ba5fb5d3282cbc2131715
     binds:
         - /run/containerd/containerd.sock:/run/containerd/containerd.sock
     command: ["/vsudd",

examples/vultr.yml

@@ -2,27 +2,27 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
     binds:
      - /var/config/ssh/authorized_keys:/root/.ssh/authorized_keys
   - name: nginx

kernel/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS kernel-build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS kernel-build
 RUN apk add \
     argp-standalone \
     automake \

kernel/Makefile

@@ -26,6 +26,17 @@ DIRTY=$(shell  git update-index -q --refresh && git diff-index --quiet HEAD -- $
 endif
 endif
 
+# Path to push-manifest.sh
+PUSH_MANIFEST:=$(shell git rev-parse --show-toplevel)/scripts/push-manifest.sh
+
+ARCH := $(shell uname -m)
+ifeq ($(ARCH), x86_64)
+SUFFIX=-amd64
+endif
+ifeq ($(ARCH), aarch64)
+SUFFIX=-arm64
+endif
+
 TAG=$(HASH)$(DIRTY)
 
 REPO?=https://github.com/linuxkit/linuxkit
@@ -58,20 +69,22 @@ push:
 define kernel
 
 build_$(2)$(3): Dockerfile Makefile $(wildcard patches-$(2)/*) $(wildcard kernel_config-$(2)*) kernel_config.debug
-	docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) || \
+	docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) || \
 		docker build \
 			--build-arg KERNEL_VERSION=$(1) \
 			--build-arg KERNEL_SERIES=$(2) \
 			--build-arg DEBUG=$(3) \
 			$(LABELS) \
-			--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) .
+			--no-cache -t $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) .
 
 push_$(2)$(3): build_$(2)$(3)
 	@if [ x"$(DIRTY)" !=  x ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) || \
-		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) && \
-		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE):$(1)$(3) && \
-		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3))
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) || \
+		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) && \
+		 docker tag $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE):$(1)$(3)$(SUFFIX) && \
+		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE):$(1)$(3)$(SUFFIX) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3)-$(TAG) 1 && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(1)$(3) 1)
 
 show-tag_$(2)$(3):
 	@echo $(ORG)/$(IMAGE):$(1)$(3)-$(TAG)
@@ -82,17 +95,19 @@ show-tags: show-tag_$(2)$(3)
 
 ifneq ($(2), 4.4.x)
 build_perf_$(2)$(3): build_$(2)$(3)
-	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) || \
+	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG)$(SUFFIX) || \
 		docker build -f Dockerfile.perf \
-			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)-$(TAG) \
-	 		--no-cache --network=none $(LABEL) -t $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) .
+			--build-arg IMAGE=$(ORG)/$(IMAGE):$(1)$(3)-$(TAG)$(SUFFIX) \
+			--no-cache --network=none $(LABEL) -t $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG)$(SUFFIX) .
 
 push_perf_$(2)$(3): build_perf_$(2)$(3)
 	@if [ x"$(DIRTY)" != x ]; then echo "Your repository is not clean. Will not push image"; exit 1; fi
-	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) || \
-		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) && \
-		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) $(ORG)/$(IMAGE_PERF):$(1)$(3) && \
-		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3))
+	DOCKER_CONTENT_TRUST=1 docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG)$(SUFFIX) || \
+		(DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG)$(SUFFIX) && \
+		 docker tag $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG)$(SUFFIX) $(ORG)/$(IMAGE_PERF):$(1)$(3)$(SUFFIX) && \
+		 DOCKER_CONTENT_TRUST=1 docker push $(ORG)/$(IMAGE_PERF):$(1)$(3)$(SUFFIX) && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3)-$(TAG) 1 && \
+		 $(PUSH_MANIFEST) $(ORG)/$(IMAGE_PERF):$(1)$(3) 1)
 
 build: build_perf_$(2)$(3)
 push: push_perf_$(2)$(3)
@@ -106,4 +121,6 @@ endef
 #
 $(eval $(call kernel,4.9.40,4.9.x))
 $(eval $(call kernel,4.9.40,4.9.x,_dbg))
+ifneq ($(ARCH), aarch64)
 $(eval $(call kernel,4.4.79,4.4.x))
+endif

linuxkit.yml

@@ -2,15 +2,15 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 onshutdown:
   - name: shutdown
@@ -18,11 +18,11 @@ onshutdown:
     command: ["/bin/echo", "so long and thanks for all the fish"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: nginx
     image: nginx:alpine
     capabilities:

pkg/Makefile

@@ -7,4 +7,10 @@ push:
 tag:
 	@set -e; for d in $(DIRS); do make -C "$$d" tag; done
 
+forcetag:
+	@set -e; for d in $(DIRS); do make -C "$$d" forcetag; done
+
+show-tag:
+	@set -e; for d in $(DIRS); do make -C "$$d" show-tag; done
+
 clean: ;

pkg/acpid/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:2e362f4459ba4491655061cccdd2fcc7a2de5eb3 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
@@ -6,7 +6,7 @@ RUN apk add --no-cache --initdb -p /out \
     busybox
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/alpine:2e362f4459ba4491655061cccdd2fcc7a2de5eb3 AS mirror2
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror2
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     busybox-initscripts

pkg/auditd/Dockerfile

@@ -1,10 +1,10 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 RUN apk add abuild gcc git
 
 ADD build.sh /
 RUN adduser -D -G abuild builder && sudo -u builder /build.sh
 
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 COPY --from=build /home/builder/*apk /
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/

pkg/binfmt/Dockerfile

@@ -1,10 +1,10 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS qemu
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS qemu
 RUN apk add \
     qemu-aarch64 \
     qemu-arm \
     qemu-ppc64le
 
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/binfmt/Makefile

@@ -1,4 +1,5 @@
 IMAGE=binfmt
 DEPS=main.go $(wildcard etc/binmft.d/*)
+ARCHES=x86_64
 
 include ../package.mk

pkg/ca-certificates/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 as alpine
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 as alpine
 
 RUN apk add ca-certificates
 

pkg/containerd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:cb6a0b2b068d892996ebadae999d9baf6e08be5b as alpine
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 as alpine
 RUN \
   apk add \
   btrfs-progs-dev \

pkg/dhcpcd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \

pkg/extend/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
@@ -15,7 +15,7 @@ RUN apk add --no-cache --initdb -p /out \
     && true
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/format/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
@@ -14,7 +14,7 @@ RUN apk add --no-cache --initdb -p /out \
     && true
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/getty/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:4248059c38452217ff63853869df36034a890401 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \

pkg/host-timesync-daemon/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:2e362f4459ba4491655061cccdd2fcc7a2de5eb3 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev git
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/host-timesync-daemon/Makefile

@@ -1,5 +1,6 @@
 IMAGE=host-timesync-daemon
 DEPS=$(wildcard *.go)
 NETWORK=1
+ARCHES=x86_64
 
 include ../package.mk

pkg/init-lcow/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:77c8dfc5860012c869a19d7a2c68e701469692c8 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \
@@ -7,7 +7,7 @@ RUN apk add --no-cache --initdb -p /out \
     musl
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/alpine:77c8dfc5860012c869a19d7a2c68e701469692c8 AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 ENV OPENGCS_REPO=https://github.com/Microsoft/opengcs
 ENV OPENGCS_COMMIT=e248b10d8dae94ffaa59fae15245b4e7b6c56fbb
 RUN apk add --no-cache build-base curl git go musl-dev

pkg/init-lcow/Makefile

@@ -1,4 +1,5 @@
 IMAGE=init-lcow
 NETWORK=1
+ARCHES=x86_64
 
 include ../package.mk

pkg/init/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 RUN apk add --no-cache --initdb alpine-baselayout make gcc musl-dev
 
 ADD usermode-helper.c .
@@ -11,7 +11,7 @@ COPY init.go /go/src/init/
 COPY vendor /go/src/init/vendor/
 RUN go-compile.sh /go/src/init/
 
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out alpine-baselayout busybox musl
 

pkg/metadata/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:2e362f4459ba4491655061cccdd2fcc7a2de5eb3 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/mkimage/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \

pkg/mkimage/Makefile

@@ -1,4 +1,5 @@
 IMAGE=mkimage
 DEPS=mkimage.sh
+ARCHES=x86_64
 
 include ../package.mk

pkg/mount/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
@@ -9,7 +9,7 @@ RUN apk add --no-cache --initdb -p /out \
     && true
 RUN rm -rf /out/etc/apk /out/lib/apk /out/var/cache
 
-FROM linuxkit/alpine:488aa6f5dd2d8121a3c5c5c7a1ecf97c424b96ac AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/node_exporter/Makefile

@@ -1,3 +1,6 @@
 IMAGE=node_exporter
+# Can't pull with content trust. Skip for now
+# https://github.com/linuxkit/linuxkit/issues/2349
+ARCHES=SKIP
 
 include ../package.mk

pkg/open-vm-tools/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \

pkg/open-vm-tools/Makefile

@@ -1,3 +1,4 @@
 IMAGE=open-vm-tools
+ARCHES=x86_64
 
 include ../package.mk

pkg/openntpd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \

pkg/package.mk

@@ -17,6 +17,25 @@ DIRTY:=$(shell git update-index -q --refresh && git diff-index --quiet HEAD -- $
 endif
 endif
 
+# Makefiles can specify specific architectures they compile for. Default: all
+ifeq ($(ARCHES),)
+ARCHES:=x86_64 aarch64
+endif
+
+ARCH := $(shell uname -m)
+ifeq ($(ARCH), x86_64)
+SUFFIX=-amd64
+endif
+ifeq ($(ARCH), aarch64)
+SUFFIX=-arm64
+endif
+
+ifneq ($(filter $(ARCH),$(ARCHES)),)
+REAL:=-y
+else
+REAL:=-n
+endif
+
 TAG:=$(ORG)/$(IMAGE):$(HASH)$(DIRTY)
 
 REPO?=https://github.com/linuxkit/linuxkit
@@ -34,6 +53,9 @@ BASE_DEPS=Dockerfile Makefile
 # Get a release tag, if present
 RELEASE:=$(shell git tag -l --points-at HEAD)
 
+# Path to push-manifest.sh
+PUSH_MANIFEST:=$(shell git rev-parse --show-toplevel)/scripts/push-manifest.sh
+
 ifdef NETWORK
 NET_OPT=
 else
@@ -46,30 +68,51 @@ export DOCKER_CONTENT_TRUST=1
 endif
 endif
 
+tag: tag$(REAL)
+forcetag: forcetag$(REAL)
+push: push$(REAL)
+forcepush: forcepush$(REAL)
+
 show-tag:
 	@echo $(TAG)
 
-tag: $(BASE_DEPS) $(DEPS)
-	docker pull $(TAG) || docker build $(LABELS) $(NET_OPT) -t $(TAG) $(SOURCE)
+tag-y: $(BASE_DEPS) $(DEPS)
+	docker pull $(TAG)$(SUFFIX) || \
+	docker build $(LABELS) $(NET_OPT) -t $(TAG)$(SUFFIX) $(SOURCE)
 
-forcetag: $(BASE_DEPS) $(DEPS)
-	docker build $(LABELS) $(NET_OPT) -t $(TAG) $(SOURCE)
+forcetag-y: $(BASE_DEPS) $(DEPS)
+	docker build $(LABELS) $(NET_OPT) -t $(TAG)$(SUFFIX) $(SOURCE)
 
 check-dirty:
 ifneq ($(DIRTY),)
 	$(error Your repository is not clean. Will not push package image)
 endif
 
-push: tag check-dirty
-	docker pull $(TAG) || docker push $(TAG)
+push-y: tag-y check-dirty
+	docker pull $(TAG)$(SUFFIX) || \
+		(docker push $(TAG)$(SUFFIX) && \
+		 $(PUSH_MANIFEST) $(TAG) $(DOCKER_CONTENT_TRUST))
 ifneq ($(RELEASE),)
-	docker tag $(TAG) $(ORG)/$(IMAGE):$(RELEASE)
-	docker push $(ORG)/$(IMAGE):$(RELEASE)
+	docker tag $(TAG)$(SUFFIX) $(ORG)/$(IMAGE):$(RELEASE)$(SUFFIX)
+	docker push $(ORG)/$(IMAGE):$(RELEASE)$(SUFFIX)
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(RELEASE) $(DOCKER_CONTENT_TRUST)
 endif
 
-forcepush: forcetag check-dirty
-	docker push $(TAG)
+forcepush-y: forcetag-y check-dirty
+	docker push $(TAG)$(SUFFIX)
+	$(PUSH_MANIFEST) $(TAG) $(DOCKER_CONTENT_TRUST)
 ifneq ($(RELEASE),)
-	docker tag $(TAG) $(ORG)/$(IMAGE):$(RELEASE)
-	docker push $(ORG)/$(IMAGE):$(RELEASE)
+	docker tag $(TAG)$(SUFFIX) $(ORG)/$(IMAGE):$(RELEASE)
+	docker push $(ORG)/$(IMAGE):$(RELEASE)$(SUFFIX)
+	$(PUSH_MANIFEST) $(ORG)/$(IMAGE):$(RELEASE) $(DOCKER_CONTENT_TRUST)
 endif
+
+# If not supported for an arch, print a message
+tag-n:
+	$(info This package does not work on $(ARCH). Ignored)
+forcetag-n:
+	$(info This package does not work on $(ARCH). Ignored)
+push-n:
+	$(info This package does not work on $(ARCH). Ignored)
+forcepush-n:
+	$(info This package does not work on $(ARCH). Ignored)

pkg/qemu-ga/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN mkdir -p /out/var/run
 RUN apk add --no-cache --initdb -p /out \

pkg/rngd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:c23813875499d85163dc358fc6370c9de650df57 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go gcc musl-dev linux-headers
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/rngd/Makefile

@@ -1,4 +1,5 @@
 IMAGE=rngd
 DEPS:=$(wildcard cmd/rngd/*.go) $(shell find cmd/rngd/vendor)
+ARCHES=x86_64
 
 include ../package.mk

pkg/runc/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:a39a433162a873519910a07beeb3e8db22529956 as alpine
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 as alpine
 RUN \
   apk add \
   bash \

pkg/sshd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:4248059c38452217ff63853869df36034a890401 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \

pkg/swap/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \

pkg/sysctl/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/sysfs/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev
 ENV GOPATH=/go PATH=$PATH:/go/bin

pkg/trim-after-delete/Dockerfile

@@ -1,5 +1,5 @@
 # We need the `fstrim` binary:
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
 RUN apk add --no-cache --initdb -p /out \
     alpine-baselayout \

pkg/tss/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:43c139f87122e94af5fac9a9d1d96f0292ca1c0b AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 
 ENV TROUSERS_COMMIT de57f069ef2297d6a6b3a0353e217a5a2f66e444
 ENV TPM_TOOLS_COMMIT bdf9f1bc8f63cd6fc370c2deb58d03ac55079e84

pkg/tss/Makefile

@@ -1,6 +1,7 @@
 IMAGE=tss
 NETWORK=1
 DEPS=$(wildcard upload/out/*) $(wildcard upload/out/etc/*) $(wildacrd upload/src/savedeps/*) $(wildcard upload/src/glibc_stubs/*)
+ARCHES=x86_64
 
 include ../package.mk
 

pkg/vpnkit-expose-port/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS build
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS build
 
 RUN apk add --no-cache go musl-dev git build-base
 ENV GOPATH=/go PATH=$PATH:/go/bin 

pkg/vpnkit-expose-port/Makefile

@@ -1,6 +1,7 @@
 IMAGE=vpnkit-expose-port
 DEPS=$(wildcard *.go)
 NETWORK=1
+ARCHES=x86_64
 
 include ../package.mk
 

pkg/vpnkit-forwarder/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev git build-base
 ENV GOPATH=/go PATH=$PATH:/go/bin 

pkg/vpnkit-forwarder/Makefile

@@ -1,5 +1,6 @@
 IMAGE=vpnkit-forwarder
 DEPS=$(wildcard *.go)
 NETWORK=1
+ARCHES=x86_64
 
 include ../package.mk

pkg/vsudd/Dockerfile

@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:9bcf61f605ef0ce36cc94d59b8eac307862de6e1 AS mirror
+FROM linuxkit/alpine:87a0cd10449d72f374f950004467737dbf440630 AS mirror
 
 RUN apk add --no-cache go musl-dev git build-base
 ENV GOPATH=/go PATH=$PATH:/go/bin 

pkg/vsudd/Makefile

@@ -1,5 +1,6 @@
 IMAGE=vsudd
 DEPS=$(wildcard *.go)
 NETWORK=1
+ARCHES=x86_64
 
 include ../package.mk

projects/compose/compose-dynamic.yml

@@ -2,28 +2,28 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/docker"]
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: docker
     image: docker:17.06.0-ce-dind
     capabilities:

projects/compose/compose-static.yml

@@ -2,28 +2,28 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/docker"]
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: docker
     image: docker:17.06.0-ce-dind
     capabilities:

projects/etcd/etcd.yml

@@ -3,27 +3,27 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:12348442d56c2ee9abf13ff38dff2e36b515bd1e
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/etcd"]
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: node_exporter
     image: linuxkit/node_exporter:a058fe1c6a4440a9689022a9fd7cffdcfd56d52c
   - name: etcd

projects/etcd/prom-us-central1-f.yml

@@ -8,12 +8,12 @@ init:
   - mobylinux/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: rngd
     image: mobylinux/rngd:3dad6dd43270fa632ac031e99d1947f20b22eec9

projects/ima-namespace/ima-namespace.yml

@@ -2,20 +2,20 @@ kernel:
   image: linuxkit/kernel-ima:4.11.1-186dd3605ee7b23214850142f8f02b4679dbd148
   cmdline: "console=ttyS0 console=tty0 page_poison=1 ima_appraise=enforce_ns"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
   - linuxkit/ima-utils:dfeb3896fd29308b80ff9ba7fe5b8b767e40ca29
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: nginx
     image: nginx:alpine
     capabilities:

projects/kubernetes/kube-master.yml

@@ -2,24 +2,24 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mounts
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/"]
   - name: var
     image: library/alpine:3.6
@@ -28,15 +28,15 @@ onboot:
       - /var/lib:/var/lib
 services:
   - name: getty
-    image: linuxkit/getty:18c468293c583eb5f275a068b686d55969f1b736
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
   - name: docker
     image: docker:17.06.0-ce-dind
     capabilities:

projects/kubernetes/kube-node.yml

@@ -2,24 +2,24 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: sysfs
-    image: linuxkit/sysfs:006a65b30cfdd9d751d7ab042fde7eca2c3bc9dc
+    image: linuxkit/sysfs:3ae01a25583ee37a5ff8b09a0e569cb4bd8cf2e9
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mounts
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/"]
   - name: var
     image: library/alpine:3.6
@@ -28,15 +28,15 @@ onboot:
       - /var/lib:/var/lib
 services:
   - name: getty
-    image: linuxkit/getty:18c468293c583eb5f275a068b686d55969f1b736
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: sshd
-    image: linuxkit/sshd:5dc5c3c4470c85f6c89f0e26b9d477ae4ff85a3c
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
   - name: docker
     image: docker:17.06.0-ce-dind
     capabilities:

projects/logging/examples/logging.yml

@@ -3,19 +3,19 @@ kernel:
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
   - linuxkit/init:12348442d56c2ee9abf13ff38dff2e36b515bd1e # with runc, logwrite, startmemlogd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
   - linuxkit/memlogd:9b5834189f598f43c507f6938077113906f51012
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: nginx
     image: nginx:alpine
     capabilities:

projects/memorizer/memorizer.yml

@@ -3,15 +3,15 @@ kernel:
   cmdline: "console=ttyS0 page_poison=1"
 init:
   - linuxkit/init:059b2bb4b6efa5c58cf53fed4d0ea863521959fc
-  - linuxkit/runc:4a35484aa6f90a1f06cdf1fb36f7056926a084b9
-  - linuxkit/containerd:b6ffbb669248e3369081a6c4427026aa968a2385
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
 trust:

projects/miragesdk/examples/fdd.yml

@@ -2,23 +2,23 @@ kernel:
   image: linuxkit/kernel:4.9.34
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
   - samoht/fdd
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
 files:
   - path: etc/init.d/020-fdd-init
     mode: "0700"

projects/miragesdk/examples/mirage-dhcp.yml

@@ -2,12 +2,12 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcp-client
     image: miragesdk/dhcp-client:22aa9d527820534295a8cd59901c0c5197af6585
     net: host
@@ -28,9 +28,9 @@ onboot:
      - /lib:/lib     # for ifconfig
 services:
   - name: sshd
-    image: linuxkit/sshd:dc98a72c1d1285c30f2db176252f3ce2bf645d5b
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
 files:

projects/okernel/examples/okernel_simple.yaml

@@ -2,20 +2,20 @@ kernel:
   image: linuxkit/okernel:latest
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
 services:
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
   - name: sshd
-    image: linuxkit/sshd:dc98a72c1d1285c30f2db176252f3ce2bf645d5b
+    image: linuxkit/sshd:505a985d7bd7a90f15eca9cb4dc6ec92789d51a0
 files:
   - path: root/.ssh/authorized_keys
     source: ~/.ssh/id_rsa.pub

projects/shiftfs/shiftfs.yml

@@ -2,23 +2,23 @@ kernel:
   image: linuxkitprojects/kernel-shiftfs:4.11.4-881a041fc14bd95814cf140b5e98d97dd65160b5
   cmdline: "console=ttyS0 console=tty0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: nginx
     image: nginx:alpine
     capabilities:

projects/swarmd/swarmd.yml

@@ -2,38 +2,38 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
-  - linuxkit/ca-certificates:67acf038c44bb191ebb704ec7bb39a1524052cdf
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
+  - linuxkit/ca-certificates:e44b0a66df5a102c0e220f0066b0d904710dcb10
 onboot:
   - name: sysctl
-    image: linuxkit/sysctl:d1a43c7c91e92374766f962dc8534cf9508756b0
+    image: linuxkit/sysctl:184c914d23a017062d7b53d7fc1dfaf47764bef6
     binds:
      - /etc/sysctl.d/01-swarmd.conf:/etc/sysctl.d/01-swarmd.conf
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
   - name: format
-    image: linuxkit/format:efafddf9bc6165b5efaf09c532c15a1100a10e61
+    image: linuxkit/format:158d992b7bf7ab984100c697d7e72161ea7d7382
   - name: mount
-    image: linuxkit/mount:a738ccad4e3e009b7c5f541226e9232a6287fa5d
+    image: linuxkit/mount:4fe245efb01384e42622c36302e13e386bbaeb08
     command: ["/usr/bin/mountie", "/var/lib/swarmd"]
   - name: metadata
-    image: linuxkit/metadata:c3871ac5838e052ddb33248ceb95f86e4569aec4
+    image: linuxkit/metadata:cec86f3e1c260c9eafefa80c262fceb40c182ddf
 services:
   - name: getty
-    image: linuxkit/getty:58620cff1b0bf8b5d144d087602115e996f18a02
+    image: linuxkit/getty:2c841cdc34396e3fa8f25b62d112808f63f16df6
     env:
      - INSECURE=true
   - name: qemu-ga
-    image: linuxkit/qemu-ga:585e4f0161a4df7583d5e0479d7621040c1ee140
+    image: linuxkit/qemu-ga:7c845bfb09ec6807fc15bfd93ce5d5fcc591e999
     binds:
       - /dev/vport0p1:/dev/vport0p1
   - name: rngd
-    image: linuxkit/rngd:704e8d8b046e89d8fa86400cb106d8c58950b873
+    image: linuxkit/rngd:b2f4bdcb55aa88a25c86733e294628614504f383
   - name: ntpd
-    image: linuxkit/openntpd:2874b66c9fa51fa5b4d11c8b50441eb94ee22a5a
+    image: linuxkit/openntpd:0d7befc79842849d0b88d6c3b64200e340d7cf67
   - name: weave
     image: weaveworks/weave:2.0.1@sha256:2d70caac7db33365482cc923d40ff8d3ec1238ae7fe06a00b3dde310d09f226e # Must match swarmd/Dockerfile
     command: ["/bin/sh", "/home/weave/weaver-wrapper"]

scripts/push-manifest.sh

@@ -0,0 +1,108 @@
+#! /bin/sh
+
+set -e
+
+# This script pushes a multiarch manifest for packages and signs it.
+#
+# The TARGET must be of the form <org>/<image>:<tag> and this is what
+# the manifest is pushed to. It assumes that there is are images of
+# the form <org>/<image>:<tag>-<arch> already on hub.
+#
+# If TRUST is not set, the manifest will not be signed.
+#
+# For signing, DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE must be set.
+
+# This should all be replaced with 'docker manifest' once it lands.
+
+TARGET=$1
+TRUST=$2
+
+REPO=$(echo "$TARGET" | cut -d':' -f1)
+TAG=$(echo "$TARGET" | cut -d':' -f2)
+
+# Work out credentials. On macOS they are needed for manifest-tool and
+# we need them for notary on all platforms.
+case $(uname -s) in
+    Darwin)
+        CRED=$(echo "https://index.docker.io/v1/" | /Applications/Docker.app/Contents/Resources/bin/docker-credential-osxkeychain.bin get)
+        USER=$(echo "$CRED" | jq -r '.Username')
+        PASS=$(echo "$CRED" | jq -r '.Secret')
+        MT_ARGS="--username $USER --password $PASS"
+        ;;
+    Linux)
+        CRED=$(cat ~/.docker/config.json | jq -r '.auths."https://index.docker.io/v1/".auth' | base64 -d -)
+        USER=$(echo $CRED | cut -d ':' -f 1)
+        PASS=$(echo $CRED | cut -d ':' -f 2-)
+        # manifest-tool can use docker credentials directly
+        MT_ARGS=
+        ;;
+    *)
+        echo "Unsupported platform"
+        exit 1
+        ;;
+esac
+
+# Push manifest list
+OUT=$(manifest-tool $MT_ARGS push from-args \
+                    --ignore-missing \
+                    --platforms linux/amd64,linux/arm64 \
+                    --template "$TARGET"-ARCH \
+                    --target "$TARGET")
+
+echo "$OUT"
+if [ -z "$TRUST" ]; then
+    echo "Not signing $TARGET"
+    exit 0
+fi
+
+# Extract sha256 and length from the manifest-tool output
+SHA256=$(echo "$OUT" | cut -d' ' -f2 | cut -d':' -f2)
+LEN=$(echo "$OUT" | cut -d' ' -f3)
+
+# Notary requires a PTY for username/password so use expect for that.
+export NOTARY_DELEGATION_PASSPHRASE="$DOCKER_CONTENT_TRUST_REPOSITORY_PASSPHRASE"
+NOTARY_CMD="notary -s https://notary.docker.io -d $HOME/.docker/trust addhash \
+             -p docker.io/$REPO $TAG $LEN --sha256 $SHA256 \
+             -r targets/releases"
+
+echo '
+spawn '"$NOTARY_CMD"'
+set pid [exp_pid]
+set timeout 60
+expect {
+    timeout {
+        puts "Expected username prompt"
+        exec kill -9 $pid
+        exit 1
+    }
+    "username: " {
+        send "'"$USER"'\n"
+    }
+}
+expect {
+    timeout {
+        puts "Expected password prompt"
+        exec kill -9 $pid
+        exit 1
+    }
+    "password: " {
+        send "'"$PASS"'\n"
+    }
+}
+expect {
+    timeout {
+        puts "Expected password prompt"
+        exec kill -9 $pid
+        exit 1
+    }
+    eof {
+    }
+}
+set waitval [wait -i $spawn_id]
+set exval [lindex $waitval 3]
+exit $exval
+' | expect -f -
+
+echo
+echo "New signed multi-arch image: $REPO:$TAG"
+echo

src/cmd/linuxkit/run_qemu.go

@@ -19,7 +19,7 @@ import (
 
 // QemuImg is the version of qemu container
 const (
-	QemuImg       = "linuxkit/qemu:8c07b24790ac5162dfc129791f8afeace159ca20"
+	QemuImg       = "linuxkit/qemu:4eb19447a221052654276cdf57effa20b672b081"
 	defaultFWPath = "/usr/share/ovmf/bios.bin"
 )
 

test/cases/000_build/000_outputs/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: dhcpcd
-    image: linuxkit/dhcpcd:17423c1ccced74e3c005fd80486e8177841fe02b
+    image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 trust:
   org:

test/cases/010_platforms/000_qemu/000_run_kernel/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/000_qemu/010_run_iso/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/000_qemu/020_run_efi/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/000_qemu/030_run_qcow/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/000_qemu/040_run_raw/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/000_qemu/100_container/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/010_platforms/010_hyperkit/000_run_kernel/test.yml

@@ -2,11 +2,11 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "10"]
 trust:
   org:

test/cases/010_platforms/010_hyperkit/010_acpi/test.yml

@@ -2,12 +2,12 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
-  - linuxkit/containerd:1ff17c0908bed91a7bff252fba2e3d360d05a3de
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
+  - linuxkit/containerd:7c986fb7df33bea73b5c8097b46989e46f49d875
 services:
   - name: acpid
-    image: linuxkit/acpid:1966310cb75e28ffc668863a6577ee991327f918
+    image: linuxkit/acpid:79e5c20de96e1633c9c40935b99dde45aefba37b
 trust:
   org:
     - linuxkit

test/cases/020_kernel/000_config_4.4.x/test-kernel-config.yml

@@ -2,13 +2,13 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: check-kernel-config
-    image: linuxkit/test-kernel-config:a48f774499238130f0facefab9e3c6999da5d45b
+    image: linuxkit/test-kernel-config:d58766bb6c0def3df9e6ffc645ee11677f127faa
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/001_config_4.9.x/test-kernel-config.yml

@@ -2,13 +2,13 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: check-kernel-config
-    image: linuxkit/test-kernel-config:a48f774499238130f0facefab9e3c6999da5d45b
+    image: linuxkit/test-kernel-config:d58766bb6c0def3df9e6ffc645ee11677f127faa
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/010_kmod_4.9.x/kmod.yml

@@ -2,8 +2,8 @@ kernel:
   image: linuxkit/kernel:4.9.40
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: check
     image: kmod-test
@@ -13,7 +13,7 @@ onboot:
     capabilities:
      - all
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/110_namespace/000_kernel-4.4.x/010_veth/010_echo-tcp-ipv4-short-1con-single-reverse/test-ns.yml

@@ -2,17 +2,17 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: test-ns
-    image: linuxkit/test-ns:321a9314c3f8b1ce748525b393dd633c48945216
+    image: linuxkit/test-ns:8e93e61e46ebcb302761eca0180e4c7f43e60bcf
     command: ["/bin/sh", "/runp-runc-net.sh", "1", "-l", "5", "-i", "15", "-ip", "4", "-p", "tcp", "-s", "-c", "1", "-r"]
     mounts: # for runc
     - type: cgroup
       options: ["rw"]
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/110_namespace/000_kernel-4.4.x/010_veth/010_echo-tcp-ipv4-short-1con-single/test-ns.yml

@@ -2,17 +2,17 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: test-ns
-    image: linuxkit/test-ns:321a9314c3f8b1ce748525b393dd633c48945216
+    image: linuxkit/test-ns:8e93e61e46ebcb302761eca0180e4c7f43e60bcf
     command: ["/bin/sh", "/runp-runc-net.sh", "1", "-l", "5", "-i", "15", "-ip", "4", "-p", "tcp", "-s", "-c", "1"]
     mounts: # for runc
     - type: cgroup
       options: ["rw"]
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/110_namespace/000_kernel-4.4.x/010_veth/011_echo-tcp-ipv4-short-10con-single-reverse/test-ns.yml

@@ -2,17 +2,17 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: test-ns
-    image: linuxkit/test-ns:321a9314c3f8b1ce748525b393dd633c48945216
+    image: linuxkit/test-ns:8e93e61e46ebcb302761eca0180e4c7f43e60bcf
     command: ["/bin/sh", "/runp-runc-net.sh", "1", "-l", "5", "-i", "15", "-ip", "4", "-p", "tcp", "-s", "-c", "10"]
     mounts: # for runc
     - type: cgroup
       options: ["rw"]
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/110_namespace/000_kernel-4.4.x/010_veth/011_echo-tcp-ipv4-short-10con-single/test-ns.yml

@@ -2,17 +2,17 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: test-ns
-    image: linuxkit/test-ns:321a9314c3f8b1ce748525b393dd633c48945216
+    image: linuxkit/test-ns:8e93e61e46ebcb302761eca0180e4c7f43e60bcf
     command: ["/bin/sh", "/runp-runc-net.sh", "1", "-l", "5", "-i", "15", "-ip", "4", "-p", "tcp", "-s", "-c", "10"]
     mounts: # for runc
     - type: cgroup
       options: ["rw"]
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org:

test/cases/020_kernel/110_namespace/000_kernel-4.4.x/010_veth/012_echo-tcp-ipv4-short-5con-multi-reverse/test-ns.yml

@@ -2,17 +2,17 @@ kernel:
   image: linuxkit/kernel:4.4.79
   cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:e3e376881faced5a890b6ceb3e8e899cbfd04ecd
-  - linuxkit/runc:842318b6ab524783554428c89a27d95af7bd2844
+  - linuxkit/init:906e174b3f2e07f97d6fd693a2e8518e98dafa58
+  - linuxkit/runc:90e45f13e1d0a0983f36ef854621e3eac91cf541
 onboot:
   - name: test-ns
-    image: linuxkit/test-ns:321a9314c3f8b1ce748525b393dd633c48945216
+    image: linuxkit/test-ns:8e93e61e46ebcb302761eca0180e4c7f43e60bcf
     command: ["/bin/sh", "/runp-runc-net.sh", "5", "-l", "5", "-i", "15", "-ip", "4", "-p", "tcp", "-s", "-c", "5"]
     mounts: # for runc
     - type: cgroup
       options: ["rw"]
   - name: poweroff
-    image: linuxkit/poweroff:3845c4d64d47a1ea367806be5547e44594b0fa91
+    image: linuxkit/poweroff:1e9876c682c74d0602b7647c628bb0875fb13998
     command: ["/bin/sh", "/poweroff.sh", "3"]
 trust:
   org: