* Use latest kernel in linuxkit
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Parallelize kernel source compression
This surpringly saves a lot of time:
M1: from 340 to 90 seconds
Intel: from 527 to 222 seconds (2 cores 4 threads)
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Add buildx target
buildx can use remote builders and automatically generate the multiarch manifest.
A properly configured builder is required :
First create docker context for the remote builders :
$ docker context create node-<arch> --docker "host=ssh://<user>@<host>"
Then create a buildx configuration using the remote builders:
$ docker buildx create --name kernel_builder --platform linux/amd64
$ docker buildx create --name kernel_builder --node node-arm64 --platform linux/arm64 --append
$ docker buildx use kernel_builder
$ docker buildx ls
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Add a PLATFORMS variable to declare platforms needed for buildx
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Make image name customizable
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Do not tag use the architecture suffix for images built with buildx
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
* Add make kconfigx to upgrade configs using buildx
To update configuration for 5.10 kernels use :
make -C kernel KERNEL_VERSIONS=5.10.104 kconfigx
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
---------
Signed-off-by: Frédéric Dalleau <frederic.dalleau@docker.com>
bpfilter is not meant to be used at all at this point. Only the module's
boilerplate is available on upstream kernels.
Signed-off-by: Quentin Deslandes <qde@naccy.de>
The kernel config is derived from the 5.12 kernel
config we used to have
We explicitly enable RANDOMIZE_KSTACK_OFFSET_DEFAULT
which is off by default.
Signed-off-by: Rolf Neugebauer <rn@rneugeba.io>
CONFIG_BPFILTER is aimed to provide a replacement for netfilter.
When CONFIG_BPFILTER is enabled, the kernel tries to contact a user mode helper
for each iptable rule update. However the implementation of this helper has not
been upstreamed yet. The communication thus fails and the kernel then falls back
to netfilter.
As a result, the rule update takes more than ten times the duration of the
netfilter implementation alone.
This has been reported by Docker Desktop users for whom it can take minutes to
start a container sharing a few hundred ports. https://github.com/for-mac/issues/5668
More details on the situation is described in https://lwn.net/Articles/822744/.
Signed-off-by: Frederic Dalleau <frederic.dalleau@docker.com>
The bcc portion of the build had been disabled because it wasn't
building. Now that bcc is building again, add it back to the list of
default targets in the kernel build.
Signed-off-by: Krister Johansen <krister.johansen@oracle.com>
This moves up to bcc 0.20.0 and builds on the latest 3.13 Alpine base
image. It uses libelf from Alpine, which allows us to drop a number of
the patches we were carrying and reduce the number of steps taken in the
bcc build.
This builds for me on a branch of tip against 5.11.x, 5.10.x,
5.10.x-dbg, and 5.4.x on x86_65. I have not had a chance to attempt
this on other platforms due to lack of hardware.
Signed-off-by: Krister Johansen <krister.johansen@oracle.com>
Declare KERNEL_SOURCE as an environment variable so it
get's picked up in kernel-source-info
fixes#3653
Signed-off-by: Rolf Neugebauer <rn@rneugeba.io>
5.4.x is the only kernel left which does not have
WireGuard in tree and it people should be using more
recent kernels. Remove the now special case for
compiling out of tree WireGuard.
Signed-off-by: Rolf Neugebauer <rn@rneugeba.io>
