From 3fb782c93c4bba90e7a0ef0ddbca795a43790be0 Mon Sep 17 00:00:00 2001 From: japabu Date: Sat, 10 Oct 2026 08:31:02 +0200 Subject: [PATCH] The guest suite pulls its Debian image from ECR Public's copy of Docker Hub's, by the same digest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Docker Hub's anonymous pull limit refused `guest / suite`'s container pull in the merge queue. Amazon ECR Public mirrors Docker Official Images under `public.ecr.aws/docker/library/` and serves this exact digest anonymously: a manifest HEAD with an anonymous token answered 200 and `docker-content-digest: sha256:a2aa4626…`. The digest is the provenance wherever the bytes come from, since a registry serving other bytes fails the pull, so the fix is the registry prefix and nothing else: no mirror workflow, no package of our own, no credentials and no permissions. nightly's `portability-linux` keeps testing `sid` as it stands, unpinned, from the same mirror. The host-tools issue gains the image's row, admitted because the runner's Ubuntu 24.04 publishes QEMU 8.2.2 and the instrument declares 11.1.1, and a row for Docker, which runs every `container:`: refused, Go, a standing failure that goes with the container. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017cSFvbD35xJ2kGANVdm23C --- .github/workflows/guest.yml | 4 +++- .github/workflows/nightly.yml | 2 +- issues/the-build-runs-host-tools-outside-rust-and-qemu.md | 2 ++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/guest.yml b/.github/workflows/guest.yml index 1eb8c1cb7a5..712965682a4 100644 --- a/.github/workflows/guest.yml +++ b/.github/workflows/guest.yml @@ -22,9 +22,11 @@ jobs: timeout-minutes: 60 # The digest is the instrument's one pin: a dated image names the snapshot # archive it was built from, and `deps` installs QEMU from that archive. + # ECR Public's copy of Docker Hub's image: Docker Hub's anonymous pull limit + # refused it there, and the digest holds whichever registry serves it. # The node ships `crw-rw---- root:kvm` and root opens it. container: - image: debian:sid-20260918@sha256:a2aa46262453eba3f464d8b1c7a8c31db85eb15af180ae34dd400615d7208547 + image: public.ecr.aws/docker/library/debian@sha256:a2aa46262453eba3f464d8b1c7a8c31db85eb15af180ae34dd400615d7208547 options: ${{ inputs.kvm && '--device=/dev/kvm' || '' }} steps: # Before the checkout, which wants git. Three attempts, because the diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 8cd7fbfdc50..cd8871f41be 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -87,7 +87,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 350 container: - image: debian:sid + image: public.ecr.aws/docker/library/debian:sid steps: - name: deps run: | diff --git a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md index d45c5a44edf..04b91b9874a 100644 --- a/issues/the-build-runs-host-tools-outside-rust-and-qemu.md +++ b/issues/the-build-runs-host-tools-outside-rust-and-qemu.md @@ -23,6 +23,8 @@ arrives and is not one. M4 and M5 are stages of `issues/toyos-builds-itself.md`. | the toolchain's own `clang`, `llvm-ar`, `rust-lld` and `llvm-config`, built from `ToyOSOrg/llvm-project` | rustc links every guest binary with `rust-lld`; `clang` compiles the C corpus (`tests/common/compile.rs`) and, with `llvm-ar`, doomgeneric through `cc::Build` (`src/clang.rs`); rustc's bootstrap asks `llvm-config` how to link LLVM | admitted: our fork's C++, which ToyOS can one day build and run; no Rust tool compiles C, `cc::Build` archives with an `ar`, bootstrap reads LLVM through `llvm-config`, and `CLAUDE.md` links everything with `rust-lld` | M5: no host in the loop | | `ovmf-generic`, `qemu-efi-aarch64` | the x86-64 and AArch64 UEFI firmware of CI's guest containers (`src/firmware.rs`), packaged by Debian apart from QEMU | admitted: QEMU's own firmware, and no Rust firmware does its job | the instrument's QEMU carries its own firmware | | `ca-certificates` | the trust store `git` and `curl` verify against in CI's containers | admitted: data both of them need | goes when neither runs there | +| Debian's `sid` image, pulled anonymously from ECR Public's copy of Docker Hub's | the container of `guest.yml`'s suite, pinned to digest `a2aa4626…`, whose dated snapshot archive `deps` installs QEMU from; and of `nightly.yml`'s `portability-linux`, `sid` as it stands | admitted: the runner's Ubuntu 24.04 publishes QEMU 8.2.2 (Launchpad, noble, every pocket) and `.github/qemu-version` declares 11.1.1, which that snapshot archive carries | the runner's own OS carries the declared QEMU, or the build system builds it | +| Docker on the runner | Actions pulls and runs every `container:` image with it, those two jobs' | refused: Go, not C or C++ ToyOS can one day build and run, and Actions runs a `container:` with Docker alone | the container goes with the image row | | the T14's Ubuntu and every tool `src/metal.rs` runs on it over `ssh` | the metal loop, on the T14 and never on a development host | outside the rule: recovery equipment on a test machine, not the build's host | they leave with Ubuntu (`issues/the-machine-updates-itself-without-ubuntu.md`) | | `sh` running `rust/x`, and Python running `x.py` and `bootstrap.py` | every toolchain build (`src/toolchain.rs`) | refused: a Rust tool does it, upstream's bootstrap binary, which builds with stable cargo, fetches its own stage0 (`rust/src/bootstrap/src/core/download.rs`) and needs no Python | `src/toolchain.rs` runs the bootstrap binary | | `curl` in rustc's bootstrap | fetches the stage0 `rust/src/stage0` pins, for a compiler or LLVM build whose build directory lacks it, whichever bootstrap runs | refused: a Rust tool does it, rustup installs the dated beta the pin names, and bootstrap takes a stage0 through `build.rustc` and `build.cargo`, as `src/sysroot.rs` hands it one | no toolchain build fetches with `curl` |