image-builder: build umoci from source to fix arm64 CI runner crash

Ubuntu's apt umoci (0.4.7) crashes on the self-hosted arm64 runner with
"fatal error: lfstack.push invalid packing" while unpacking Fedora's OCI
base image. The image-builder is an amd64 image, so it runs under qemu on
the arm64 runner, and the emulated process inherits the host's 52-bit-VA
high addresses that the old Go in apt's umoci mis-packs in lfstack. Build
umoci v0.5.0 from source with the Go 1.25 toolchain already installed
(Go >=1.21 handles high virtual addresses correctly). Only Fedora uses
umoci (OCI base); the other distros use debootstrap/pacstrap.

[skip ci]
This commit is contained in:
Bug Bounty Zip
2026-06-13 07:57:12 +08:00
parent ed54e99482
commit ddfda4de88

View File

@@ -27,10 +27,17 @@ RUN mkdir -p /root/go/src/github.com/lxc/ && \
rm -rf /root/go/src /root/go/pkg
# Fedora 41+ base images ship as OCI archives; distrobuilder's fedora-http
# downloader unpacks them with umoci/skopeo.
# downloader unpacks them with umoci/skopeo. Ubuntu's apt umoci (0.4.7) is
# built with an old Go that crashes under qemu on the self-hosted arm64 runner
# ("fatal error: lfstack.push invalid packing"), because the emulated amd64
# process inherits the host's 52-bit-VA high addresses. Build umoci from source
# with the Go toolchain installed above (>=1.21 packs high addresses correctly).
RUN apt-get update && apt-get install -y --no-install-recommends \
umoci skopeo \
skopeo \
&& rm -rf /var/lib/apt/lists/*
RUN go install github.com/opencontainers/umoci/cmd/umoci@v0.5.0 && \
cp /root/go/bin/umoci /usr/local/bin/umoci && \
rm -rf /root/go/pkg
WORKDIR /build