* add riscv64 kernels to kernel/Makefile and kernel/Dockerfile.*, riscv64 kernel config, bump alpine version for kernel builds
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* update bcc to v0.32.0 to include needed fixes
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* bump kernel builder alpine base to version including llvm19
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* in kernel-bcc, automatically determine python path
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* in kernel-perf, suppress newer gcc errors
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* riscv path in kernel build was incorrect
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* remove bcc compilation from kernel
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* update usages of kernel/6.6.13 to kernel/6.6.71
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* next run of updating kernel config
Signed-off-by: Avi Deitcher <avi@deitcher.net>
* update test dependencies on kernel hash version
Signed-off-by: Avi Deitcher <avi@deitcher.net>
---------
Signed-off-by: Avi Deitcher <avi@deitcher.net>
Arguably the long term fix is to introduce a check for links in the
documentation with tools like markdown-link-check.
Signed-off-by: Zixuan James Li <p359101898@gmail.com>
It is not easy to use cross-platform build with CGO enabled so lets
allow build without cgo for darwin and use virtualization framework only
if we built with CGO.
Signed-off-by: Petr Fedchenkov <giggsoff@gmail.com>
This allows multiple build flavors for a single codebase, without
sacrificing reproducible builds. The build-args are set in build.yml,
which is typically under the source control (if it is not, then no
reproducible builds are possible anyways). Meaning that mutating
build-args would result in setting "dirty" flag.
Intended use of this commit is to switch between build flavors by
specifying a different yaml file (presumably also under the version
control) by `-build-yml` option.
Because it is impossible to build a final image from packages in
cache, the test for this feature relies on the `RUN echo $build-arg`
output during the `pkg build` process.
Signed-off-by: Yuri Volchkov <yuri@zededa.com>
After the runc security advisory[1] the default cgroup device
whitelist was changed.
In previous versions every container had "rwm" (read, write, mknod)
for every device ("a" for all). Typically this was overridden by
container engines like Docker. In LinuxKit we left the permissive
default.
In recent `runc` versions the default allow-all rule was removed,
so a container can only access a device if it is specifically
granted access, which LinuxKit handles via a device: entry.
However it is inconvenient for pkg/format, pkg/mount, pkg/swap
to list all possible block devices up-front. Therefore we add the
ability to grant access to an entire class of device with a single
rule:
```
- path: all
type: b
```
Obviously a paranoid user can still override this with a specific
major/minor number in a device: rule.
[1] https://github.com/opencontainers/runc/security/advisories/GHSA-g54h-m393-cpwq
Signed-off-by: David Scott <dave@recoil.org>
