From 6cd9c8396981949b6139a4aa4a9b7c65896ef3d1 Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Fri, 30 Oct 2026 18:17:44 +0000 Subject: [PATCH 1/2] ci: Install the monitors from monitors-build releases The e2e tests gathered the monitors from several places: QEMU came from apt, Firecracker, Cloud Hypervisor and hyperlight-unikraft from their upstream releases, virtiofsd from an S3 bucket, and Solo5 was built from source. To resolve that, we created the monitors-build repository, which publishes static builds of all of them, bundled in a single archive per architecture. Therefore, use these archives instead. The workflows set the version of each monitor, now including QEMU and virtiofsd, and a new find-monitors-release action looks up the monitors-build release that bundles these exact versions. The archive extracts to `/opt/urunc`, and the urunc configuration points every monitor there. As a result, the tests now run with a static QEMU v10.1.1 instead of the one Ubuntu provides. Since the archive provides every monitor for both architectures, hyperlight-unikraft is now also installed on arm64, and the Kubernetes test also gets Cloud Hypervisor, hyperlight-unikraft, virtiofsd and, on arm64, QEMU. The packages that only built Solo5 or came with the apt QEMU are no longer installed. The default versions of the monitors were set in vm_test and again in every caller of kind_test. Keep them in the find-monitors-release action instead, so they are set in a single place, and let ci.yml forward any overrides to kind_test as well. Since the action is now part of the e2e environment, a change in it also runs the e2e tests of the pull request. PR: https://github.com/urunc-dev/urunc/pull/1183 Signed-off-by: Charalampos Mainas Reviewed-by: Anastassios Nanos Approved-by: Anastassios Nanos --- .../actions/find-monitors-release/action.yml | 109 ++++++++++++++ .github/workflows/ci.yml | 26 +++- .github/workflows/ci_devel.yml | 15 +- .github/workflows/ci_nightly.yml | 2 - .github/workflows/kind_test.yml | 107 ++++++++++---- .github/workflows/vm_test.yml | 137 ++++++++++-------- 6 files changed, 300 insertions(+), 96 deletions(-) create mode 100644 .github/actions/find-monitors-release/action.yml diff --git a/.github/actions/find-monitors-release/action.yml b/.github/actions/find-monitors-release/action.yml new file mode 100644 index 000000000..3cc0ca758 --- /dev/null +++ b/.github/actions/find-monitors-release/action.yml @@ -0,0 +1,109 @@ +name: Find the monitors-build release +description: > + Find the release of https://github.com/urunc-dev/monitors-build that bundles + the given versions of the monitors and return the URL of its archive for the + given architecture. It also holds the default versions of the monitors for + the e2e tests. +inputs: + firecracker_version: + description: 'Firecracker version (default: v1.7.0)' + required: false + cloud_hypervisor_version: + description: 'Cloud Hypervisor version (default: v50.0)' + required: false + hluk_version: + description: 'hyperlight-unikraft version (default: v0.18.0)' + required: false + solo5_version: + description: 'Solo5 version (default: v0.12.1)' + required: false + qemu_version: + description: 'QEMU version (default: v10.1.1)' + required: false + virtiofsd_version: + description: 'virtiofsd version (default: v1.13.0)' + required: false + arch: + description: 'Architecture of the archive (amd64 or arm64)' + required: true +outputs: + url: + description: 'URL of the archive, which extracts to urunc/ (e.g. /opt/urunc)' + value: ${{ steps.find.outputs.url }} + sha256: + description: 'SHA-256 checksum of the archive' + value: ${{ steps.find.outputs.sha256 }} +runs: + using: composite + steps: + - id: find + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + env: + FIRECRACKER_VERSION: ${{ inputs.firecracker_version }} + CLOUD_HYPERVISOR_VERSION: ${{ inputs.cloud_hypervisor_version }} + HLUK_VERSION: ${{ inputs.hluk_version }} + SOLO5_VERSION: ${{ inputs.solo5_version }} + QEMU_VERSION: ${{ inputs.qemu_version }} + VIRTIOFSD_VERSION: ${{ inputs.virtiofsd_version }} + ARCH: ${{ inputs.arch }} + with: + script: | + // Each release of urunc-dev/monitors-build lists the versions it + // bundles in a fingerprint inside its description, e.g. + // FC-v1.7.0_CLH-v50.0_HLUK-v0.18.0_S5-v0.12.1_VFS-v1.13.0_QM-v10.1.1-9a44e, + // where the last part is the hash of the QEMU configuration. The archive + // with all the monitors of an architecture is named after it. + // + // The default versions of the monitors for the e2e tests. Callers + // forward unset versions as empty strings, which skip an input's + // default, hence the fallbacks. + const wanted = { + FC: process.env.FIRECRACKER_VERSION || 'v1.7.0', + CLH: process.env.CLOUD_HYPERVISOR_VERSION || 'v50.0', + HLUK: process.env.HLUK_VERSION || 'v0.18.0', + S5: process.env.SOLO5_VERSION || 'v0.12.1', + VFS: process.env.VIRTIOFSD_VERSION || 'v1.13.0', + QM: process.env.QEMU_VERSION || 'v10.1.1', + }; + for (const [name, version] of Object.entries(wanted)) { + if (!/^v[0-9]+\.[0-9]+(\.[0-9]+)?$/.test(version)) { + core.setFailed(`Invalid ${name} version: ${version}`); + return; + } + } + const releases = await github.paginate(github.rest.repos.listReleases, { + owner: 'urunc-dev', + repo: 'monitors-build', + }); + // Releases are listed from the newest one. + for (const release of releases) { + const match = //.exec(release.body || ''); + if (release.draft || !match) { + continue; + } + const fingerprint = match[1]; + // Split each part only on its first "-", so that a pre-release + // (e.g. v1.7.0-rc1) does not match its final version, and drop the + // hash after the QEMU version. + const versions = Object.fromEntries(fingerprint.split('_').map(part => { + const [, name, version] = /^([^-]+)-(.+)$/.exec(part) || []; + return [name, name === 'QM' ? version.replace(/-[0-9a-f]{5}$/, '') : version]; + })); + if (!Object.entries(wanted).every(([name, version]) => versions[name] === version)) { + continue; + } + const asset = release.assets.find(a => + a.name === `${fingerprint}-${process.env.ARCH}.tar.gz` && a.state === 'uploaded'); + if (!asset) { + continue; + } + if (!/^sha256:[0-9a-f]{64}$/.test(asset.digest || '')) { + core.setFailed(`${asset.name} of monitors-build ${release.tag_name} has no SHA-256 digest`); + return; + } + core.info(`Using monitors-build ${release.tag_name}: ${fingerprint}`); + core.setOutput('url', asset.browser_download_url); + core.setOutput('sha256', asset.digest.slice('sha256:'.length)); + return; + } + core.setFailed(`No monitors-build release provides ${JSON.stringify(wanted)} for ${process.env.ARCH}`); diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f4d5f787e..f0072ee82 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -14,7 +14,8 @@ on: type: string default: "no" # Optional overrides of the e2e runners and environment versions. An - # empty value selects the default in vm_test.yml. + # empty value selects the default in vm_test.yml, or in the + # find-monitors-release action for the monitors. runners: type: string default: '' @@ -42,6 +43,12 @@ on: solo5_version: type: string default: '' + qemu_version: + type: string + default: '' + virtiofsd_version: + type: string + default: '' hluk_version: type: string default: '' @@ -98,7 +105,8 @@ jobs: # caller ref for non-PR runs (nightly/release), where base.sha is empty. ref: ${{ github.event.pull_request.base.sha || inputs.ref }} # Only set by manual dispatches. PR runs leave them empty, so the base - # branch's e2e code runs with vm_test.yml's default versions. + # branch's e2e code runs with the default versions of vm_test.yml and + # the find-monitors-release action. runners: ${{ inputs.runners }} runc_version: ${{ inputs.runc_version }} containerd_version: ${{ inputs.containerd_version }} @@ -108,6 +116,8 @@ jobs: firecracker_version: ${{ inputs.firecracker_version }} cloud_hypervisor_version: ${{ inputs.cloud_hypervisor_version }} solo5_version: ${{ inputs.solo5_version }} + qemu_version: ${{ inputs.qemu_version }} + virtiofsd_version: ${{ inputs.virtiofsd_version }} hluk_version: ${{ inputs.hluk_version }} secrets: inherit @@ -118,8 +128,12 @@ jobs: uses: ./.github/workflows/kind_test.yml with: ref: ${{ inputs.ref }} - firecracker_version: 'v1.7.0' - solo5_version: 'v0.12.1' + firecracker_version: ${{ inputs.firecracker_version }} + cloud_hypervisor_version: ${{ inputs.cloud_hypervisor_version }} + hluk_version: ${{ inputs.hluk_version }} + solo5_version: ${{ inputs.solo5_version }} + qemu_version: ${{ inputs.qemu_version }} + virtiofsd_version: ${{ inputs.virtiofsd_version }} runc_version: '1.3.0' secrets: inherit @@ -127,7 +141,8 @@ jobs: # test changes in the e2e testing code or environment, re-run the vm_test # with the PR's e2e code. However, do that only when a change in the files # that affect the e2e tests ("tests/*", "Makefile", "script/dm_create.sh", - # ".github/workflows/vm_test.yml") has taken place. + # ".github/workflows/vm_test.yml", ".github/actions/find-monitors-release/*") + # has taken place. detect-test-changes: if: ${{ github.event_name == 'pull_request' && inputs.skip-build != 'yes' }} name: Detect test changes @@ -158,6 +173,7 @@ jobs: 'Makefile', 'script/dm_create.sh', '.github/workflows/vm_test.yml', + '.github/actions/find-monitors-release/', ]; const changed = files.some(f => roots.some(r => f.filename.startsWith(r))); core.setOutput('tests_changed', changed ? 'yes' : 'no'); diff --git a/.github/workflows/ci_devel.yml b/.github/workflows/ci_devel.yml index fa8cd3cae..9c7038791 100644 --- a/.github/workflows/ci_devel.yml +++ b/.github/workflows/ci_devel.yml @@ -13,7 +13,8 @@ on: default: "no" type: string # The e2e runners and environment versions. Leave a field empty to use - # the default in vm_test.yml. + # the default in vm_test.yml, or in the find-monitors-release action for + # the monitors. runners: description: 'Runners for the e2e tests, as a JSON list (e.g. ["ubuntu-24.04"])' required: false @@ -59,6 +60,16 @@ on: required: false default: '' type: string + qemu_version: + description: 'QEMU version for the e2e tests (e.g. v10.1.1)' + required: false + default: '' + type: string + virtiofsd_version: + description: 'virtiofsd version for the e2e tests (e.g. v1.13.0)' + required: false + default: '' + type: string hluk_version: description: 'hyperlight-unikraft version for the e2e tests (e.g. v0.18.0)' required: false @@ -90,5 +101,7 @@ jobs: firecracker_version: ${{ inputs.firecracker_version }} cloud_hypervisor_version: ${{ inputs.cloud_hypervisor_version }} solo5_version: ${{ inputs.solo5_version }} + qemu_version: ${{ inputs.qemu_version }} + virtiofsd_version: ${{ inputs.virtiofsd_version }} hluk_version: ${{ inputs.hluk_version }} secrets: inherit diff --git a/.github/workflows/ci_nightly.yml b/.github/workflows/ci_nightly.yml index d304a2287..3248c9bbb 100644 --- a/.github/workflows/ci_nightly.yml +++ b/.github/workflows/ci_nightly.yml @@ -39,8 +39,6 @@ jobs: name: Kubernetes test uses: ./.github/workflows/kind_test.yml with: - firecracker_version: 'v1.7.0' - solo5_version: 'v0.12.1' runc_version: '1.3.0' urunc_deploy_test: diff --git a/.github/workflows/kind_test.yml b/.github/workflows/kind_test.yml index e02a60192..f4bb4a37c 100644 --- a/.github/workflows/kind_test.yml +++ b/.github/workflows/kind_test.yml @@ -5,12 +5,26 @@ on: ref: type: string default: '' + # Optional overrides of the monitors' versions. An empty value selects + # the default in the find-monitors-release action. firecracker_version: type: string - required: true + default: '' + cloud_hypervisor_version: + type: string + default: '' + hluk_version: + type: string + default: '' solo5_version: type: string - required: true + default: '' + qemu_version: + type: string + default: '' + virtiofsd_version: + type: string + default: '' runc_version: required: true type: string @@ -40,6 +54,18 @@ jobs: with: ref: ${{ inputs.ref }} + # On pull requests, the checkout above is the head of the PR, while GitHub + # loaded this workflow from the merge commit (github.sha). Fetch the local + # actions from the latter, so that they match this workflow. + - name: Checkout the local actions + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + path: .workflow-actions + sparse-checkout: .github/actions/ + sparse-checkout-cone-mode: false + persist-credentials: false + - name: Install kind run: | ARCH=$(uname -m) @@ -85,7 +111,7 @@ jobs: - name: Install dependencies inside kind node run: | docker exec urunc-test-control-plane apt-get update - docker exec urunc-test-control-plane apt-get install -y git wget build-essential libseccomp-dev pkg-config bc + docker exec urunc-test-control-plane apt-get install -y wget - name: Install runc inside kind node run: | @@ -145,7 +171,7 @@ jobs: /usr/local/bin/urunc --version ' - - name: Configure urunc with debug logging + - name: Configure urunc with debug logging and the monitors' paths run: | docker exec urunc-test-control-plane bash -c ' mkdir -p /etc/urunc @@ -153,38 +179,61 @@ jobs: [log] level = "debug" syslog = true - EOF - ' - - name: Install QEMU inside kind node (amd64 only) - if: matrix.arch == 'amd64' - run: | - docker exec urunc-test-control-plane apt-get install -y qemu-system + [monitors.qemu] + path = "/opt/urunc/bin/qemu-system-$(uname -m)" + data_path = "/opt/urunc/share/qemu" + [monitors.firecracker] + path = "/opt/urunc/bin/firecracker" - - name: Install Firecracker inside kind node - run: | - FC_VERSION="${{ inputs.firecracker_version }}" - docker exec urunc-test-control-plane bash -c ' - ARCH=$(uname -m) - echo "Downloading Firecracker version: '"$FC_VERSION"'" - curl -fsSL https://github.com/firecracker-microvm/firecracker/releases/download/'"$FC_VERSION"'/firecracker-'"$FC_VERSION"'-${ARCH}.tgz | tar -xz - install -m 755 release-'"$FC_VERSION"'-${ARCH}/firecracker-'"$FC_VERSION"'-${ARCH} /usr/local/bin/firecracker - firecracker --version + [monitors.cloud-hypervisor] + path = "/opt/urunc/bin/cloud-hypervisor" + + [monitors.hyperlight-unikraft] + path = "/opt/urunc/bin/hluk" + + [monitors.hvt] + path = "/opt/urunc/bin/solo5-hvt" + + [monitors.spt] + path = "/opt/urunc/bin/solo5-spt" + + [extra_binaries.virtiofsd] + path = "/opt/urunc/bin/virtiofsd" + EOF ' - - name: Install Solo5 inside kind node + - name: Find the monitors-build release with these versions + id: monitors + uses: ./.workflow-actions/.github/actions/find-monitors-release + with: + firecracker_version: ${{ inputs.firecracker_version }} + cloud_hypervisor_version: ${{ inputs.cloud_hypervisor_version }} + hluk_version: ${{ inputs.hluk_version }} + solo5_version: ${{ inputs.solo5_version }} + qemu_version: ${{ inputs.qemu_version }} + virtiofsd_version: ${{ inputs.virtiofsd_version }} + arch: ${{ matrix.arch }} + + - name: Install monitors inside kind node + env: + MONITORS_URL: ${{ steps.monitors.outputs.url }} + MONITORS_SHA256: ${{ steps.monitors.outputs.sha256 }} run: | - SOLO5_VERSION="${{ inputs.solo5_version }}" + curl -fsSL -o monitors.tar.gz "${MONITORS_URL}" + echo "${MONITORS_SHA256} monitors.tar.gz" | sha256sum -c - + docker cp monitors.tar.gz urunc-test-control-plane:/monitors.tar.gz + rm -f monitors.tar.gz + # The archive extracts to /opt/urunc, which is where the urunc + # configuration points to. It records the files as owned by the user + # that built it, so let root own them instead. docker exec urunc-test-control-plane bash -c ' - git clone -b "'"$SOLO5_VERSION"'" https://github.com/Solo5/solo5.git - cd solo5 - ./configure.sh && make -j$(nproc) - install -m 755 tenders/hvt/solo5-hvt /usr/local/bin/ - install -m 755 tenders/spt/solo5-spt /usr/local/bin/ - cd .. - rm -rf solo5 - solo5-hvt --version + set -ex + tar --no-same-owner --no-overwrite-dir -C /opt -xzf /monitors.tar.gz + rm -f /monitors.tar.gz + /opt/urunc/bin/firecracker --version + /opt/urunc/bin/solo5-hvt --version ' - name: Add urunc to containerd config diff --git a/.github/workflows/vm_test.yml b/.github/workflows/vm_test.yml index c1f7fd4b0..f7ba0fe64 100644 --- a/.github/workflows/vm_test.yml +++ b/.github/workflows/vm_test.yml @@ -34,6 +34,12 @@ on: solo5_version: type: string default: '' + qemu_version: + type: string + default: '' + virtiofsd_version: + type: string + default: '' hluk_version: type: string default: '' @@ -42,21 +48,18 @@ permissions: contents: read # The default versions of the e2e environment are kept here, next to the steps -# that install them, and the callers only pass overrides. On pull_request -# events, the callers' inputs come from the PR merged into main, so they would -# not match a copy of this workflow loaded from another ref. Callers forward -# unset inputs as empty strings, which skip an input's default, hence the -# fallbacks. +# that install them, and the callers only pass overrides. The monitors are the +# exception, as their defaults are in the find-monitors-release action. On +# pull_request events, the callers' inputs come from the PR merged into main, +# so they would not match a copy of this workflow loaded from another ref. +# Callers forward unset inputs as empty strings, which skip an input's default, +# hence the fallbacks. env: RUNC_VERSION: ${{ inputs.runc_version || '1.3.0' }} CONTAINERD_VERSION: ${{ inputs.containerd_version || '2.3.7' }} CNI_VERSION: ${{ inputs.cni_version || '1.7.1' }} NERDCTL_VERSION: ${{ inputs.nerdctl_version || '2.1.3' }} CRICTL_VERSION: ${{ inputs.crictl_version || 'v1.30.0' }} - FIRECRACKER_VERSION: ${{ inputs.firecracker_version || 'v1.7.0' }} - CLOUD_HYPERVISOR_VERSION: ${{ inputs.cloud_hypervisor_version || 'v50.0' }} - SOLO5_VERSION: ${{ inputs.solo5_version || 'v0.12.1' }} - HLUK_VERSION: ${{ inputs.hluk_version || 'v0.18.0' }} jobs: prepare: @@ -79,8 +82,7 @@ jobs: fi echo "ARCH=${ARCH}" >> "$GITHUB_ENV" for var in RUNC_VERSION CONTAINERD_VERSION CNI_VERSION \ - NERDCTL_VERSION CRICTL_VERSION FIRECRACKER_VERSION \ - CLOUD_HYPERVISOR_VERSION SOLO5_VERSION HLUK_VERSION; do + NERDCTL_VERSION CRICTL_VERSION; do value="${!var}" if ! [[ "$value" =~ ^v?[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then echo "Invalid format for $var: $value" @@ -98,6 +100,19 @@ jobs: with: ref: ${{ inputs.ref }} + # On pull requests, the checkout above can be the base branch (see the + # vm_test job in ci.yml), while GitHub loaded this workflow from the merge + # commit (github.sha). Fetch the local actions from the latter, so that + # they match this workflow. + - name: Checkout the local actions + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + path: .workflow-actions + sparse-checkout: .github/actions/ + sparse-checkout-cone-mode: false + persist-credentials: false + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod @@ -106,10 +121,7 @@ jobs: - name: Install base dependencies run: | sudo apt-get update - sudo apt-get install -y git wget build-essential libseccomp-dev pkg-config bc make qemu-system jq - wget https://s3.nbfc.io/nbfc-assets/github/urunc/bin/virtiofsd - sudo chmod +x virtiofsd - sudo mv virtiofsd /usr/libexec/virtiofsd + sudo apt-get install -y git wget build-essential bc make jq - name: Install runc run: | @@ -245,14 +257,31 @@ jobs: timeout: 20 EOT - - name: Install Firecracker + - name: Find the monitors-build release with these versions + id: monitors + uses: ./.workflow-actions/.github/actions/find-monitors-release + with: + firecracker_version: ${{ inputs.firecracker_version }} + cloud_hypervisor_version: ${{ inputs.cloud_hypervisor_version }} + hluk_version: ${{ inputs.hluk_version }} + solo5_version: ${{ inputs.solo5_version }} + qemu_version: ${{ inputs.qemu_version }} + virtiofsd_version: ${{ inputs.virtiofsd_version }} + arch: ${{ env.ARCH }} + + - name: Install monitors + env: + MONITORS_URL: ${{ steps.monitors.outputs.url }} + MONITORS_SHA256: ${{ steps.monitors.outputs.sha256 }} run: | - SAFE_FC="${FIRECRACKER_VERSION}" - ARCH="$(uname -m)" - release_url="https://github.com/firecracker-microvm/firecracker/releases" - curl -L "${release_url}/download/${SAFE_FC}/firecracker-${SAFE_FC}-${ARCH}.tgz" | tar -xz - sudo mv "release-${SAFE_FC}-${ARCH}/firecracker-${SAFE_FC}-${ARCH}" /usr/local/bin/firecracker - rm -fr "release-${SAFE_FC}-${ARCH}" + curl -fsSL -o monitors.tar.gz "${MONITORS_URL}" + echo "${MONITORS_SHA256} monitors.tar.gz" | sha256sum -c - + # The archive extracts to /opt/urunc, which is where the urunc + # configuration below points to. It records the files as owned by + # the user that built it, so let root own them instead. + sudo tar --no-same-owner --no-overwrite-dir -C /opt -xzf monitors.tar.gz + rm -f monitors.tar.gz + ls -l /opt/urunc/bin - name: Install Firecracker for FreeBSD env: @@ -268,33 +297,6 @@ jobs: sudo mv "release-${SAFE_FC}-${ARCH}/firecracker-${SAFE_FC}-${ARCH}" /usr/local/bin/firecracker-freebsd rm -fr "release-${SAFE_FC}-${ARCH}" - - name: Install Cloud Hypervisor - run: | - SAFE_CLOUD_HYPERVISOR="${CLOUD_HYPERVISOR_VERSION}" - curl -sL "https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/${SAFE_CLOUD_HYPERVISOR}/cloud-hypervisor-static" -o cloud-hypervisor - chmod +x cloud-hypervisor - sudo mv cloud-hypervisor /usr/local/bin/cloud-hypervisor - - - name: Install solo5 - run: | - SAFE_SOLO5="${SOLO5_VERSION}" - git clone -b "${SAFE_SOLO5}" https://github.com/Solo5/solo5.git - cd solo5 - ./configure.sh && make -j$(nproc) - sudo cp tenders/hvt/solo5-hvt /usr/local/bin - sudo cp tenders/spt/solo5-spt /usr/local/bin - - - name: Install hyperlight-unikraft - if: ${{ env.ARCH == 'amd64' }} - run: | - SAFE_HLUK="${HLUK_VERSION}" - # The Linux release binaries are static (musl), so the runner's glibc - # does not matter. - release_url="https://github.com/hyperlight-dev/hyperlight-unikraft/releases" - curl -fsSL "${release_url}/download/${SAFE_HLUK}/hluk-${SAFE_HLUK}-x86_64-unknown-linux-musl.tar.gz" | tar -xz - sudo install -m0755 hluk /usr/local/bin/hluk - rm -f hluk - - name: Download urunc artifact uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: @@ -316,27 +318,44 @@ jobs: sudo mv containerd-shim-urunc-v2_static_${ARCH} /usr/local/bin/containerd-shim-urunc-v2 urunc --version - - name: Configure urunc with debug logging + - name: Configure urunc with debug logging and the monitors' paths run: | sudo mkdir -p /etc/urunc - sudo tee /etc/urunc/config.toml > /dev/null <<'EOF' + sudo tee /etc/urunc/config.toml > /dev/null < /dev/null <<'EOF' - [log] - level = "debug" - syslog = true - - [monitors.firecracker] - path = "/usr/local/bin/firecracker-freebsd" - EOF + sed 's|^path = "/opt/urunc/bin/firecracker"$|path = "/usr/local/bin/firecracker-freebsd"|' \ + /etc/urunc/config.toml | sudo tee /etc/urunc/config-freebsd.toml > /dev/null + grep -q firecracker-freebsd /etc/urunc/config-freebsd.toml sudo tee /usr/local/bin/containerd-shim-urunc-fc-v2 > /dev/null <<'EOF' #!/bin/bash From 298bcb003ce2d351bb9ac77d1bbbc3ecf0bcc2ba Mon Sep 17 00:00:00 2001 From: Charalampos Mainas Date: Fri, 30 Oct 2026 12:18:21 +0000 Subject: [PATCH 2/2] docs: Update the monitors-build installation instructions The monitors-build releases now include hyperlight-unikraft and name their archives after the bundled versions. Update the example to the v0.2.0 release, install the monitors in `/opt/urunc` and add hyperlight-unikraft to the urunc configuration. PR: https://github.com/urunc-dev/urunc/pull/1183 Signed-off-by: Charalampos Mainas Reviewed-by: Anastassios Nanos Approved-by: Anastassios Nanos --- docs/installation.md | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/docs/installation.md b/docs/installation.md index 72beeb877..bec5fd2e0 100644 --- a/docs/installation.md +++ b/docs/installation.md @@ -345,27 +345,32 @@ creation of a new release with different versions. More information can be found in the [respective section of the repository's README file](https://github.com/urunc-dev/monitors-build?tab=readme-ov-file#how-to-use). -> NOTE: Hyperlight-unikraft is not included in this bundle yet. - -As an example, the following commands use the -[`FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e` -release](https://github.com/urunc-dev/monitors-build/releases/tag/FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e) +Each release provides, for every architecture, an archive with all the +monitors and tools. The archive is named after their versions, followed by the +architecture. As an example, the following commands use the +[`v0.2.0` release](https://github.com/urunc-dev/monitors-build/releases/tag/v0.2.0) which contains the following monitors and tools in the specified versions: - Firecracker v1.7.0 - Cloud Hypervisor v50.0 +- Hyperlight-unikraft v0.18.0 - Solo5 v0.12.1 - Virtiofsd v1.13.0 - Qemu v10.1.1 -To download and install the monitors in `/tmp`: +To download the archive, verify its SHA-256 checksum and install the monitors +in `/opt/urunc` (the checksum is taken from the GitHub API, using `jq`): ``` ARCH="$(dpkg --print-architecture)" -VERSION="FC-v1.7.0_CLH-v50.0_S5-v0.12.1_VFS_-v1.13.0_QM-v10.1.1-9a44e" +RELEASE="v0.2.0" +MONITORS="FC-v1.7.0_CLH-v50.0_HLUK-v0.18.0_S5-v0.12.1_VFS-v1.13.0_QM-v10.1.1-9a44e" release_url="https://github.com/urunc-dev/monitors-build/releases/download" -wget ${release_url}/${VERSION}/release-${ARCH}-${VERSION}.tar.gz -sudo tar Cxzvf /opt release-${ARCH}-${VERSION}.tar.gz -rm release-${ARCH}-${VERSION}.tar.gz +api_url="https://api.github.com/repos/urunc-dev/monitors-build/releases/tags" +wget ${release_url}/${RELEASE}/${MONITORS}-${ARCH}.tar.gz +DIGEST="$(wget -qO- ${api_url}/${RELEASE} | jq -r --arg name ${MONITORS}-${ARCH}.tar.gz '.assets[] | select(.name == $name) | .digest')" +echo "${DIGEST#sha256:} ${MONITORS}-${ARCH}.tar.gz" | sha256sum -c && \ + sudo tar --no-same-owner --no-overwrite-dir -C /opt -xzvf ${MONITORS}-${ARCH}.tar.gz +rm ${MONITORS}-${ARCH}.tar.gz ``` After downloading all the binaries, we need to instruct `urunc` about the @@ -377,7 +382,8 @@ get updated: 2. in Qemu, the `data_path` field, 3. in Virtiofsd, the `path` field needs to get updated. -Therefore, change or append the following lines in `urunc`'s configuration: +Therefore, change or append the following lines in `urunc`'s configuration +(on arm64, Qemu's binary is `qemu-system-aarch64`): ``` [monitors.qemu] @@ -390,6 +396,9 @@ path = "/opt/urunc/bin/firecracker" [monitors.cloud-hypervisor] path = "/opt/urunc/bin/cloud-hypervisor" +[monitors.hyperlight-unikraft] +path = "/opt/urunc/bin/hluk" + [monitors.hvt] path = "/opt/urunc/bin/solo5-hvt"