Resolves #3028 ### What this PR does Publishes deployable NICo images as `linux/amd64` and `linux/arm64` image indexes from the normal Make targets. - builds and pushes architecture-specific Core base and release images before creating the bare `nico` tag - builds each REST image separately for amd64 and arm64, then creates the bare multi-architecture tag - starts a local registry automatically when the default `localhost:5000` registry is used - applies the same publication pattern to machine-validation and boot-artifact image targets - updates the build documentation with manifest verification steps ### How we verified it Current revision: `2c6304a807e90753476ef5a8b6c98c3c475c5c55` Image publication and runtime evidence was produced from implementation commit `3f57554cad43398794ecfd06c5a62fbc6cd62914`. The follow-up commits update the fresh-host bootstrap and its documentation, make boot-image publication work with the default Docker driver, and pin the privileged binfmt installer by digest. Environment: Apple Silicon macOS, isolated Colima Virtualization Framework profile with Rosetta, 10 CPUs, 16 GiB RAM, 120 GiB disk, Docker 28.3.3, BuildKit 0.23.2, and a local registry on `localhost:5001`. Hands-on verification used the real Make recipes from a clean isolated checkout: ```sh export DOCKER_HOST="unix://${HOME}/.colima/pr3257-rosetta/docker.sock" export IMAGE_REGISTRY=localhost:5001 export IMAGE_TAG=verify-3257-3f57554c-rosetta make -C rest-api docker-build \ IMAGE_REGISTRY="${IMAGE_REGISTRY}" \ IMAGE_TAG="${IMAGE_TAG}" \ REST_IMAGES=nico-mcp make images-core \ IMAGE_REGISTRY="${IMAGE_REGISTRY}" \ IMAGE_TAG="${IMAGE_TAG}" \ VERSION=verify-3257 \ CI_COMMIT_SHORT_SHA=3f57554c ``` The long Core build required restarting the isolated Docker VM and resuming the exact remaining arm64 Buildx and index-creation steps after local Docker storage/runtime instability. No source changes were made during that recovery. Expected result: each bare tag resolves to both Linux platforms, and each selected platform runs the binary built for that architecture. Actual result: ```text localhost:5001/nico:verify-3257-3f57554c-rosetta digest: sha256:6c5df269ff9a83abe7e79ce01f349429d48452426a03512bf8cde69bcdec9ddc platforms: linux/amd64,linux/arm64 localhost:5001/nico-mcp:verify-3257-3f57554c-rosetta digest: sha256:5718f3622e55c386f19652cc0ef441ff8de7568c812ab9925072cd3a0842a871 platforms: linux/amd64,linux/arm64 nico amd64: x86_64; nico-admin-cli --version succeeded nico arm64: aarch64; nico-admin-cli --version succeeded nico-mcp amd64: --help succeeded nico-mcp arm64: --help succeeded ``` The platform and runtime checks were repeated against the preserved registry after restarting the isolated VM. This is hands-on image publication and execution evidence; it is separate from GitHub checks. The fresh-host bootstrap follow-up was exercised separately in the same isolated Linux VM: ```text tonistiigi/binfmt@sha256:400a4873... --install all: linux/amd64 and linux/arm64 registered docker buildx inspect: linux/amd64 and linux/arm64 available docker run --platform linux/amd64 alpine:3.20 uname -m: x86_64 docker run --platform linux/arm64 alpine:3.20 uname -m: aarch64 ``` `bash -n` passed, ShellCheck reported only the two pre-existing SC2016 informational findings, `git diff --check` passed, and the changed manual retained the same 15 pre-existing rumdl findings as the prior revision. The default Docker driver was also used to exercise the boot-image publication pattern added in the final follow-up: separate amd64 and arm64 builds were pushed, `imagetools create` assembled the bare tag, and inspection returned `linux/amd64,linux/arm64`. The documented verification loop printed `PASS` for that index and exited nonzero with `FAIL` for a forced single-platform result. `make -n images-boot-artifacts` and `make -n images-bfb` confirmed both targets use the same per-architecture sequence. The full mkosi artifact generation is covered by CI rather than this local packaging check. ### How to reproduce the verification Prerequisites: Docker with Buildx, an active builder that can build and run both `linux/amd64` and `linux/arm64`, `curl`, `jq`, and enough local Docker storage for the Core build. ```sh git clone https://github.com/kfelternv/infra-controller.git cd infra-controller git checkout 2c6304a docker run -d --rm --name nico-build-registry -p 5001:5000 registry:2 export IMAGE_REGISTRY=localhost:5001 export IMAGE_TAG=verify-3257 make -C rest-api docker-build \ IMAGE_REGISTRY="${IMAGE_REGISTRY}" \ IMAGE_TAG="${IMAGE_TAG}" \ REST_IMAGES=nico-mcp make images-core \ IMAGE_REGISTRY="${IMAGE_REGISTRY}" \ IMAGE_TAG="${IMAGE_TAG}" \ VERSION=verify-3257 \ CI_COMMIT_SHORT_SHA=3f57554c for image in nico nico-mcp; do platforms="$(docker buildx imagetools inspect --raw \ "${IMAGE_REGISTRY}/${image}:${IMAGE_TAG}" | \ jq -r '[.manifests[].platform | select(.os == "linux") | "\(.os)/\(.architecture)"] | unique | sort | join(",")')" test "${platforms}" = "linux/amd64,linux/arm64" printf '%s: %s\n' "${image}" "${platforms}" done for arch in amd64 arm64; do docker run --rm --platform "linux/${arch}" \ --entrypoint /opt/carbide/nico-admin-cli \ "${IMAGE_REGISTRY}/nico:${IMAGE_TAG}" --version docker run --rm --platform "linux/${arch}" \ "${IMAGE_REGISTRY}/nico-mcp:${IMAGE_TAG}" --help done ``` The two platform checks must print `linux/amd64,linux/arm64`; all four runtime commands must exit successfully. --------- Signed-off-by: Kyle Felter <kfelter@nvidia.com>

Uh oh!

Build docker multi-arch containers outside of GitHub actions #3028

Description

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions