commit 2c0c43cebe5a5f9cc86843c244da2651ac3b46d6
parent 68da3fd54e3eaf499fca4d2a8247d9bb1c12390a
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Sat, 11 Apr 2026 15:12:07 +0200
cleanup and fixup docker tasks
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 25 insertions(+), 22 deletions(-)
diff --git a/apps/talos_cluster/continuwuity/Dockerfile b/apps/talos_cluster/continuwuity/Dockerfile
@@ -1,7 +1,7 @@
# Wraps the upstream continuwuity scratch-based image with a shell (debian:12-slim)
# so that Velero pre/post backup hooks can freeze the process via SIGSTOP/SIGCONT.
# {"$imagepolicy": "flux-system:forgejo-continuwuity-main"}
-FROM forgejo.ellis.link/continuwuation/continuwuity:main@sha256:070b2f916bef7d542171acd0add0a28efd6af9c9bff83c64b26a289637477d9d AS upstream
+FROM forgejo.ellis.link/continuwuation/continuwuity:main@sha256:a31118e10a3e4d48a7b67de690c72ea8f3198ace7fc6f25b77c85eaec1f2ce64 AS upstream
# Build ldb and sst_dump from the exact RocksDB version continuwuity uses (10.10.1)
# so MANIFEST format is guaranteed compatible for recovery operations.
diff --git a/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy b/apps/talos_cluster/jenkins/seeds/jobs/gitops_multiarch_builds.groovy
@@ -10,7 +10,7 @@ pipelineJob('gitops-multiarch-builds') {
}
parameters {
- choiceParam('BUILD_IMAGE', ['matrix-backup', 'continuwuity', 'blog', 'bookwyrm', 'all'], 'Which image(s) to build')
+ choiceParam('BUILD_IMAGE', ['all', 'matrix-backup', 'continuwuity', 'blog', 'bookwyrm'], 'Which image(s) to build')
}
definition {
@@ -37,6 +37,12 @@ pipelineJob('gitops-multiarch-builds') {
value: jenkins-operator-slave-jenkins.jenkins.svc.cluster.local:50000
- name: JENKINS_URL
value: http://jenkins-operator-http-jenkins.jenkins.svc.cluster.local:8080/
+ resources:
+ requests:
+ cpu: 100m
+ memory: 256Mi
+ limits:
+ memory: 512Mi
volumeMounts:
- name: workspace
mountPath: /home/jenkins/agent
@@ -47,6 +53,13 @@ pipelineJob('gitops-multiarch-builds') {
env:
- name: DOCKER_TLS_CERTDIR
value: ""
+ resources:
+ requests:
+ cpu: 2000m
+ memory: 6Gi
+ limits:
+ cpu: 4000m
+ memory: 12Gi
volumeMounts:
- name: workspace
mountPath: /home/jenkins/agent
@@ -86,6 +99,8 @@ pipelineJob('gitops-multiarch-builds') {
triggers {
githubPush()
+ // pollSCM as fallback in case the GitHub webhook is not reachable
+ pollSCM('H/15 * * * *')
cron('H 3 * * *')
}
@@ -122,29 +137,17 @@ pipelineJob('gitops-multiarch-builds') {
exit 1
fi
- # Register QEMU binfmt handlers for cross-platform builds
+ # Register QEMU binfmt handlers so the kernel can run arm64 binaries
+ # on this amd64 node. The F-flag keeps the interpreter fd open kernel-side
+ # so it persists even after the container exits.
docker run --rm --privileged --platform linux/amd64 \\
tonistiigi/binfmt:qemu-v8.1.5 --install all
- # Build a custom BuildKit image with the correctly-named QEMU emulator.
- # BuildKit's getEmulator() calls exec.LookPath("buildkit-qemu-aarch64")
- # — the binary MUST have the "buildkit-" prefix, not "qemu-aarch64".
- # Source: tonistiigi/binfmt:buildkit-* (the buildkit variant) ships
- # pre-built static x86_64 binaries with the correct naming convention.
- mkdir -p /tmp/buildkit-ctx
- cat > /tmp/buildkit-ctx/Dockerfile << 'BKEOF'
-FROM tonistiigi/binfmt:buildkit-v10.2.1-64 AS binfmt
-
-FROM moby/buildkit:buildx-stable-1
-COPY --from=binfmt /buildkit-qemu-aarch64 /usr/bin/buildkit-qemu-aarch64
-COPY --from=binfmt /buildkit-qemu-arm /usr/bin/buildkit-qemu-arm
-BKEOF
-
- docker build --platform linux/amd64 -t buildkit-qemu:local /tmp/buildkit-ctx/
-
- # Create docker-container buildx builder using the custom BuildKit image
+ # Create docker-container buildx builder.
+ # moby/buildkit:buildx-stable-1 already ships buildkit-qemu-aarch64 so
+ # no custom image is needed — the per-arch digest bug in Dockerfiles was
+ # the root cause of the earlier "Invalid ELF image" failures, not QEMU.
docker buildx create --name multiarch-builder --driver docker-container \\
- --driver-opt image=buildkit-qemu:local \\
--platform linux/amd64,linux/arm64 2>/dev/null || true
docker buildx use multiarch-builder
docker buildx inspect --bootstrap
diff --git a/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile b/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile
@@ -23,7 +23,7 @@ RUN CGO_ENABLED=0 GOARCH=${TARGETARCH} \
# Runtime stage — distroless/static has no shell, no libc, minimal attack surface.
# {"$imagepolicy": "flux-system:gcr-distroless-static-nonroot"}
-FROM gcr.io/distroless/static:nonroot@sha256:64c43684e6d2b581d1eb362ea47b6a4defee6a9cac5f7ebbda3daa67e8c9b8e6
+FROM gcr.io/distroless/static:nonroot@sha256:e3f945647ffb95b5839c07038d64f9811adf17308b9121d8a2b87b6a22a80a39
COPY --from=builder /matrix-backup /matrix-backup
